Entra directory roles grant tenant-wide administrative power, and several intermediate roles reach Global Administrator through a short chain: a role that can assign roles, reset a privileged user's credentials, or add an application secret is effectively Global Admin. This surface is about recognizing those roles and the activation and scoping machinery around them.
What folds in here#
- Privilege escalation: the roles that chain to Global Administrator.
- PIM: activating eligible privileged roles just in time.
- Administrative units: scoped role assignments and their gaps.