Microsoft recently implemented silent but frequent changes to four key Microsoft Entra ID built-in roles: Entra Backup Administrator, AI Reader, Tenant Governance Administrator, and Tenant Governance Relationship Administrator. Unlike typical updates, these modifications were released with no official announcement, catching many administrators off-guard. Since built-in role permissions dictate what users can perform across your tenant, these covert changes can have significant security and governance implications.

Built-in roles are often assigned based on least-privilege principles, where each role grants just enough permission for a user to do their job. However, when Microsoft updates a role’s permissions without explicit notification, the scope of access can broaden unexpectedly. This understandably raises concerns around privilege creep and compliance, especially when managing sensitive identity and governance services in Entra ID.

This post, based on analysis by Daniel Bradley from Our Cloud Network, unpacks what changed with these roles, discusses why silent updates matter, and advocates for continuous vigilance through regular role reviews and potential customization. We’ll also explore practical steps administrators should take right now to ensure your tenant’s role assignments remain secure and appropriately scoped.

---

Architecture Overview

(This section is a conceptual summary to help understand the flow from Microsoft's Entra built-in role permission definitions to tenant security management.)

┌─────────────────────────────────────────────┐
│               Microsoft Entra ID             │
├─────────────────────────────────────────────┤
│  • Built-in Roles Permissions                │
│  • Custom Role Definitions                    │
│  • Role Assignment & Eligibility             │
└─────────────────────────────────────────────┘
               ↓
┌─────────────────────────────────────────────┐
│          Administrator & Tenant Actions      │
├─────────────────────────────────────────────┤
│  • Assign Roles to Users/Groups              │
│  • Review and Audit Role Permissions         │
│  • Adjust Assignments Based on Access Needs  │
└─────────────────────────────────────────────┘
               ↓
┌─────────────────────────────────────────────┐
│               Tenant Security Posture        │
├─────────────────────────────────────────────┤
│  • Enforced Least Privilege                   │
│  • Mitigation of Privilege Escalation Risks  │
│  • Compliance with Governance Policies       │
└─────────────────────────────────────────────┘

Changes in role permissions ripple through this chain, making clarity and control essential.

---

Key Technical Observations

• Unannounced Role Updates Can Risk Privilege Escalation — Microsoft modified built-in role permissions quietly, underscoring that these roles are not immutable. An assignment that was safe yesterday might grant more privileges today, potentially opening avenues for misuse.

• Frequent Role Revision Reflects Service Evolution — Roles related to new or evolving Entra features like Backup and Tenant Governance are expected to change as Microsoft enhances functionality. Administrators must keep pace rather than rely on static definitions.

• Built-in Roles Include Privileged Access Without Explicit Consent — Two of the updated roles, Entra Backup Administrator and Tenant Governance Administrator, are marked as privileged, meaning they carry high-risk permissions that demand rigorous oversight.

• Role Versioning and Tracking Are Crucial — Using tools like MS Admin Roles to snapshot role definitions over time allows admins to detect and assess changes promptly, a foundation for effective role security maintenance.

• Custom Roles as a Guardrail Against Unexpected Changes — Creating tailored roles aligned to organizational policy prevents silent Microsoft updates from broadening access unpredictably, preserving the intended principle of least privilege.

---

How It Works: Understanding the Lifecycle of Entra ID Role Permissions

Microsoft Defines and Updates Built-in Roles

Microsoft curates a set of built-in roles for Entra ID that grant specific permissions to perform administrative tasks. These include roles such as Entra Backup Administrator and AI Reader. Over time, Microsoft silently revises the permissions behind these roles to accommodate new features, fix bugs, or tighten security boundaries. These changes are captured by snapshot tools like MS Admin Roles but often lack formal announcements.

Administrators Assign Roles Based on Published Permissions

When admins assign a built-in role to a user or group, they rely on Microsoft’s publicly documented permissions to ensure least privilege. Because built-in role permissions can change silently, there is an implicit trust that roles remain constant, which may no longer hold true.

Permissions Impact Tenant Security and Governance

Role permissions govern what administrators and users can do across the tenant, including sensitive operations like backup job creation, hard deletion protection toggling, or managing governance relationships. Broader permissions than expected increase the risk of privilege escalation or inadvertent access leakage.

The Importance of Regular Role Review and Customization

To mitigate risks, administrators must regularly review assigned roles and compare the current permission sets against previous versions. If a built-in role’s permissions no longer align with organizational policies, shifting to custom roles with explicitly defined permissions gives tighter control.

# Example: Using MS Admin Roles API or module to track role changes
Get-MSAdminRoles -Filter "RecentlyChanged eq true" | Format-Table RoleName, LastModified

# Example: Export custom role definition for review
Export-EntraRoleDefinition -RoleName "Custom Backup Admin" -Path "C:\roles\backup-admin.json"

These approaches help maintain a secure identity environment by proactively detecting and adapting to silent role changes.

---

Quick Tips & Tricks

1. Monitor Role Changes Regularly — Use tools like MS Admin Roles to keep automated alerts for any updates to built-in roles, ensuring you are never caught unaware.

2. Review Current Assignments After Updates — Immediately audit who holds the changed roles and assess whether their access remains justified with the new permissions.

3. Implement Custom Roles for Critical Permissions — When possible, create custom roles tailored to your organization's needs to reduce dependency on shifting Microsoft defaults.

4. Integrate Role Reviews into Governance Cycles — Make role permission comparison and reassignment part of your regular privileged access reviews to maintain least-privilege enforcement.

5. Leverage Microsoft Entra Role-Based Access Control (RBAC) Reference — Regularly consult the official Microsoft Entra built-in roles reference to understand baseline role capabilities and updates.

6. Educate Your Teams About Role Changes — Alert your security and identity teams about the possibility of silent changes to built-in roles to foster shared vigilance.

---

Conclusion

Microsoft’s silent but frequent updates to Entra ID built-in roles highlight a critical shift away from the assumption that built-in roles are static and unchanging. While these evolving roles reflect the dynamic nature of Microsoft Entra’s expanding functionality, they also usher in potential risks of privilege creep and compliance gaps if administrators are not vigilant.

The key takeaway is that managing identity and access in Entra requires ongoing attention. Blind trust in built-in roles can jeopardize security; instead, regular review, timely detection of changes, and the adoption of custom roles should be cornerstones of your privilege governance strategy. As Microsoft's platform continues to advance, proactive role management will be essential to maintaining a secure and compliant cloud environment.

---

References

1. Microsoft make silent but frequent changes to Entra ID roles — Original detailed analysis by Daniel Bradley on Our Cloud Network
2. MS Admin Roles — Tool for snapshotting and tracking Microsoft 365 role definitions and changes
3. Microsoft Entra built-in roles reference — Official Microsoft documentation on role permissions
4. Microsoft Entra Identity and Access Management — Overview of Entra roles and management
5. Principle of Least Privilege — Microsoft guidance on access governance best practices

Figure: Illustration credit to Our Cloud Network – visualizing silent Entra role changes

Author: Daniel Bradley, Microsoft MVP in Security