Which Entra ID roles are privileged? isPrivileged is beta-only

Symptom

A security report counts "holders of privileged roles" and flags guests who hold one. The list of privileged role template IDs is hard-coded and looks reasonable, but the numbers disagree with the "Privileged" label in the Entra admin center.

Cause

Measured on 30 October 2026 with a delegated token (Directory.Read.All):

Comparing the live flags with our list written from experience:

• Not privileged (although our list had them): Exchange Administrator, SharePoint Administrator, Teams Administrator, Authentication Policy Administrator, Microsoft Entra Joined Device Local Administrator (formerly Azure AD Joined Device Local Administrator).
• Privileged (our list missed them): among others Global Reader, Security Reader, Application Developer, AI Administrator, AI Reader and Agent ID Administrator. Not every new AI role is privileged – Agent ID Developer and Agent Registry Administrator are not.

Microsoft keeps adding roles, and the privileged label itself is still in preview, so any fixed list goes stale.

Fix

Read the flag at scan time, and keep a dated fallback only for when the beta call fails:

async function privilegedRoleIds(client: MSGraphClientV3): Promise<string[]> {
  try {
    // beta only – v1.0 does not return isPrivileged.
    const r = await client.api('/roleManagement/directory/roleDefinitions').version('beta').get();
    const ids = (r.value || [])
      .filter((d: any) => d.isPrivileged === true && d.isBuiltIn !== false && d.templateId)
      .map((d: any) => String(d.templateId).toLowerCase());
    return ids.length ? ids : FALLBACK_PRIVILEGED; // measured list, with its date in a comment
  } catch {
    return FALLBACK_PRIVILEGED;
  }
}

Match role assignments by roleDefinitionId against these template IDs (for built-in roles, Microsoft's examples show the definition id equal to templateId). Beta also documents $filter=isPrivileged eq true (we did not measure it), and the least privileged permission for reading role definitions is RoleManagement.Read.Directory – Directory.Read.All works too.

See also

• Microsoft Entra built-in roles – privileged roles
• Privileged roles and permissions in Microsoft Entra ID
• unifiedRoleDefinition resource type (beta)