Daniel • 7/27/2026

Microsoft make silent but frequent changes to Entra ID roles

This article discusses recent silent changes Microsoft made to four Entra ID built-in roles: Entra Backup Administrator, AI Reader, Tenant Governance Administrator, and Tenant Governance Relationship Administrator. The changes, tracked via MS Admin Roles, add new permissions without official announcements, potentially breaking least-privilege security models. The article advises administrators to regularly review role definitions and consider custom roles to avoid unintended access. It emphasizes the need for ongoing privileged-access reviews due to Microsoft's frequent, unannounced role updates.

0 comments

#Microsoft 365 #Entra ID #Least Privilege