Authorization in Microsoft Entra ID

Authorization is the act of granting or denying access rights to authenticated parties based on their permissions. It determines what actions or resources a user or device is allowed to access. Authorization in Microsoft Entra ID is determined by its roles.

Microsoft Entra roles

Built-in Microsoft Entra roles are categorized into two main groups: built-in and custom roles.

• Custom roles: Microsoft Entra ID allows organizations to create roles. These roles provide more fine-grained control over access because they let organizations define permissions based on their needs.

• Built-in roles: Microsoft Entra ID offers several built-in roles with predefined permissions.

Create a custom role

Let’s say we want a role that only allows users to read group memberships. Follow the steps below to create this custom role:

• Search and select “Microsoft Entra ID” from the search bar and navigate to the “Roles and administrators” page.

• Click the “New custom role” option, name the new role, and select the "Start from scratch” option for the “Baseline permissions” field.

• Click the “Next” button.

• Search and select the “microsoft.directory/users/membersOf/read” permission from the Permissions search box.

• Click the “Next” button and click the “Create” button on the “Review +create” tab. You will be able to see the new role in the “Role” list on the “All roles” page.