Find the role.
Grant less.

Role selection context

Grant the task, not the job title

Microsoft Entra roles should be selected from the action an administrator must perform and the objects they must affect. Similar role names can hide important boundaries: one role may reset credentials only for ordinary users, another may manage enterprise applications without assigning directory roles, and a privileged role may reach protected accounts.

Search by task or role name to compare capabilities, explicit limitations, and Privileged Identity Management guidance. Use the result to design a test assignment, not as permission to grant a permanent role. Administrative units, scoped assignments, approval, activation duration, and access reviews can reduce exposure further.

Questions to answer before assignment

• Which exact tasks and target object types are required?
• Can the role be scoped by administrative unit or resource?
• Should eligibility replace an always-active assignment?
• Which protected roles or accounts remain outside the role's authority?

Validate the selected role with a non-production account and a representative task. Record the business owner, activation controls, expiration, and review date. If the task requires multiple broad roles, reconsider the workflow or use a purpose-built automation identity with narrowly defined Microsoft Graph permissions.