Rollen & AdministratorenRoles & Administrators

RBAC, eingebaute Rollen, benutzerdefinierte Rollen, Administrative Units und Least-Privilege-Praktiken.RBAC, built-in roles, custom roles, administrative units, and least-privilege practices.

RBAC-KonzeptRBAC concept

Role-Based Access Control trennt Aufgaben, Rollen und Geltungsbereiche. Ziel ist, Administratoren genau die Rechte zu geben, die sie für ihre Aufgabe benötigen – nicht mehr.Role-Based Access Control separates tasks, roles, and scopes. The goal is to grant administrators exactly the rights they need for their task—no more.

Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleDefinition -Top 10 |
  Select-Object DisplayName, Description

GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions?$top=10
Authorization: Bearer <token>

Eingebaute RollenBuilt-in roles

Die folgende Auswahl deckt die in der Praxis am häufigsten verwendeten integrierten Rollen ab. Für vollständige Details sollten produktive Delegationsmodelle dennoch gegen die aktuelle Microsoft-Dokumentation geprüft werden.The following selection covers the most commonly used built-in roles in practice. For full details, production delegation models should still be validated against current Microsoft documentation.

Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleDefinition -All |
  Sort-Object DisplayName |
  Select-Object DisplayName, Description

GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions
Authorization: Bearer <token>

Benutzerdefinierte RollenCustom roles

Custom Roles sind sinnvoll, wenn Standardrollen zu breit oder zu eng sind. Das ist vor allem für App-Registrierungen, Attributverwaltung oder spezialisierte Helpdesk-Prozesse interessant.Custom roles are useful when built-in roles are too broad or too narrow. This is especially relevant for app registrations, attribute management, or specialized helpdesk processes.

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"
$definition = @{
  displayName = "Custom App Registration Reader"
  description = "Read app registrations and service principals"
  isEnabled = $true
  rolePermissions = @(
    @{
      allowedResourceActions = @(
        "microsoft.directory/applications/basic/read",
        "microsoft.directory/servicePrincipals/basic/read"
      )
    }
  )
}
New-MgRoleManagementDirectoryRoleDefinition -BodyParameter $definition

POST https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions
Content-Type: application/json
Authorization: Bearer <token>

{
  "displayName": "Custom App Registration Reader",
  "description": "Read app registrations and service principals",
  "isEnabled": true,
  "rolePermissions": [
    {
      "allowedResourceActions": [
        "microsoft.directory/applications/basic/read",
        "microsoft.directory/servicePrincipals/basic/read"
      ]
    }
  ]
}

Administrative UnitsAdministrative Units

Administrative Units begrenzen die Reichweite bestimmter Rollen auf Benutzer, Gruppen oder Geräte innerhalb eines definierten Teilbereichs. Das ist ideal für Regionen, Tochtergesellschaften oder Bildungseinrichtungen.Administrative Units limit the reach of certain roles to users, groups, or devices inside a defined subset. This is ideal for regions, subsidiaries, or educational environments.

Connect-MgGraph -Scopes "AdministrativeUnit.ReadWrite.All"
New-MgDirectoryAdministrativeUnit `
  -DisplayName "AU-DE-Region" `
  -Description "Administrative Unit for Germany"

POST https://graph.microsoft.com/v1.0/directory/administrativeUnits
Content-Type: application/json
Authorization: Bearer <token>

{
  "displayName": "AU-DE-Region",
  "description": "Administrative Unit for Germany"
}

RollenzuweisungRole assignment

Rollen können direkt, gruppenbasiert oder über PIM-Elegibility vergeben werden. Dauerhafte Global-Admin-Zuweisungen sollten die absolute Ausnahme bleiben.Roles can be assigned directly, through groups, or as PIM eligibility. Permanent Global Administrator assignments should remain the absolute exception.

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"
New-MgRoleManagementDirectoryRoleAssignment `
  -PrincipalId "<principal-id>" `
  -RoleDefinitionId "<role-definition-id>" `
  -DirectoryScopeId "/"

POST https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments
Content-Type: application/json
Authorization: Bearer <token>

{
  "principalId": "<principal-id>",
  "roleDefinitionId": "<role-definition-id>",
  "directoryScopeId": "/"
}

Least-Privilege-EmpfehlungenLeast privilege recommendations

Least Privilege bedeutet nicht nur kleinere Rollen, sondern auch sauber definierte Prozesse, getrennte Adminkonten, Break-Glass-Konzepte und regelmäßige Reviews.Least privilege means not only smaller roles but also well-defined processes, separate admin accounts, break-glass concepts, and regular reviews.

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","AuditLog.Read.All"
Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance -Top 20

GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleInstances?$top=20
Authorization: Bearer <token>

PowerShell & Graph für RollenverwaltungPowerShell & Graph for role management

Für Inventare werden Role Definitions, Assignments und Principal-Objekte zusammengeführt. Gute Skripte dokumentieren nicht nur, wer welche Rolle hat, sondern auch warum und mit welchem Scope.For inventories, combine role definitions, assignments, and principal objects. Good scripts document not only who has which role, but also why and with which scope.

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","Directory.Read.All"
$assignments = Get-MgRoleManagementDirectoryRoleAssignment -All
$definitions = Get-MgRoleManagementDirectoryRoleDefinition -All

foreach ($assignment in $assignments) {
  $definition = $definitions | Where-Object Id -eq $assignment.RoleDefinitionId
  [pscustomobject]@{
    PrincipalId = $assignment.PrincipalId
    Role = $definition.DisplayName
    Scope = $assignment.DirectoryScopeId
  }
}

GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments
GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions
Authorization: Bearer <token>

Alle Built-in Roles – KompletttabelleAll built-in roles – complete table

Die Tabelle basiert auf der aktuellen Microsoft-Entra-Built-in-Roles-Referenz und enthält Name, templateId, Kurzbeschreibung und operative Schlüsselaktionen. Sie ist damit sowohl für Governance-Workshops als auch für Automatisierungsabgleiche mit roleDefinitions einsetzbar.This table is based on the current Microsoft Entra built-in roles reference and includes name, templateId, a concise description, and operational key actions. It is useful both in governance workshops and for automation comparisons against roleDefinitions.

Role Comparison MatrixRole comparison matrix

Die Matrix reduziert die häufigsten Delegationsfragen auf konkrete Aufgaben. Sie ersetzt nicht die Vollreferenz, ist aber ideal für Operating Model, Service Desk und SoD-Diskussionen.The matrix reduces common delegation questions to concrete tasks. It does not replace the full reference, but it is ideal for operating model, service desk, and separation-of-duties discussions.

Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleDefinition -All |
  Select-Object DisplayName, TemplateId, IsBuiltIn |
  Sort-Object DisplayName |
  Export-Csv ".\entra-built-in-roles.csv" -NoTypeInformation -Encoding UTF8