MFA Security Issues

Required Azure Role to Manage User Authentication Methods in Entra ID

Phi Hung Vo Oct 10, 2026 869 views

Question details

Determine the appropriate Microsoft Entra ID administrator role required for IT staff to manage or reset authentication methods for end users without granting Global Administrator permissions.

Required Azure Role to Manage User Authentication Methods in Entra ID

Product: Microsoft Entra ID
Device & OS: not provided
Scenario: Assigning administrative roles to IT support staff to handle end-user MFA and password resets securely.
Observed behavior: IT staff need permissions to manage user authentication methods, but assigning the Global Administrator role is too broad and violates the principle of least privilege.

Before you start

Ensure you are signed in to the Microsoft Entra admin center with at least Privileged Role Administrator or Global Administrator permissions to assign roles to other users.

Solution 1Recommended

Assign the Privileged Authentication Administrator Role

Assigning this role allows IT staff to manage or reset authentication methods, including passwords, for all users and Global Administrators without over-provisioning access.

The Privileged Authentication Administrator is the recommended role when your IT staff need to manage credentials and MFA methods for both standard users and highly privileged administrators.

If they only need to manage non-administrators, the standard Authentication Administrator role can be used instead.

Sign in to Entra admin center

Navigate to the Microsoft Entra admin center and sign in with a suitably privileged administrative account.

Access Roles and Administrators

In the left-hand navigation menu, expand 'Identity', select 'Roles & admins', and then click on 'Roles & admins'.

Locate the specific role

Use the search bar to find the 'Privileged Authentication Administrator' role and click on its name to open the role details.

Add the assignment

Click the 'Add assignments' button, search for the IT staff member or security group you want to assign the role to, and click 'Add' to save the changes.

Assign the Privileged Authentication Administrator Role

Principle of Least Privilege: By using the Privileged Authentication Administrator role, you successfully restrict your IT staff's permissions to just credential and MFA management, improving your tenant's security posture.

Free Microsoft Office alternative

Draft and Manage IT Security Policies with WPS Office

While WPS Office does not manage Microsoft Entra ID roles, it is an excellent, free alternative to Microsoft Office for creating your IT documentation, security policies, and access management guides.

1. Download WPS Office: Visit the official WPS website to download and install the free WPS Office suite on your computer.
2. Create standard operating procedures: Open WPS Writer to draft your organization's IT security guidelines and role assignment protocols.
3. Save in standard formats: Save your documents as standard .docx or .pdf files to easily share them with your IT department and security auditors.

Free, lightweight, and fast alternative to Microsoft OfficeHighly compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Familiar user interface makes migration seamless for IT teamsPerfect for drafting Standard Operating Procedures (SOPs) for role assignments and security audits

microsoft office alternative - wps office

Frequently Asked Questions

What is the difference between Authentication Administrator and Privileged Authentication Administrator?

The Authentication Administrator role can only manage authentication methods and reset passwords for non-administrators and a few lower-level admin roles. The Privileged Authentication Administrator can perform these actions for all users, including Global Administrators.

Does assigning this role require a premium Microsoft Entra ID license?

Basic role assignment is included in the free tier of Microsoft Entra ID. However, if you want to use Privileged Identity Management (PIM) for time-bound or approval-based role assignments, an Entra ID P2 license is required.

Can I use PowerShell to assign the Privileged Authentication Administrator role?

Yes, you can use the Microsoft Graph PowerShell module. You would use the New-MgRoleManagementDirectoryRoleAssignment cmdlet, specifying the Role Definition ID for the Privileged Authentication Administrator and the Object ID of the user.

Microsoft Office Security Issues