--- title: Tenant Governance Administrator description: Tenant Governance Administrator ms.topic: include ms.date: 10/06/2026 ms.custom: include file ai-usage: ai-assisted --- [![Privileged label icon.](../media/permissions-reference/privileged-label.png)](../privileged-roles-permissions.md) Assign the Tenant Governance Administrator role to users who manage capabilities in the Microsoft Entra Tenant Governance service. The table below lists the role's existing actions and additional application-management operations. Operations marked **application-scoped** are available only through the approved Tenant Governance application. Assigning this role does not grant equivalent unrestricted application-management permissions through other applications. This restriction does not change the scope of the role's other permissions. > [!IMPORTANT] > This is a privileged role. Its application-management capabilities can grant access to tenant resources. Assign it only to trusted administrators. > [!div class="mx-tableFixed"] > | Actions and operations | Description | > | --- | --- | > | Create service principals (application-scoped) | Create service principals for first-party and third-party applications. | > | Update service principal endpoints (application-scoped) | Update endpoints on service principals. | > | Delete service principals (application-scoped) | Delete service principals. | > | Permanently delete service principals (application-scoped) | Permanently delete service principals, including those for social identity providers. | > | Restore service principals (application-scoped) | Restore deleted service principals, including those for social identity providers. | > | Manage delegated permission grants (application-scoped) | List, create, update, and delete delegated permission grants. | > | Manage application role assignments (application-scoped) | Manage application role assignments, including assignments for Microsoft Graph and Azure AD Graph. | > | microsoft.directory/crossTenantAccessPolicy/basic/update | Update basic settings of cross-tenant access policy | > | microsoft.directory/crossTenantAccessPolicy/default/standard/read | Read basic properties of the default cross-tenant access policy | > | microsoft.directory/crossTenantAccessPolicy/partners/create | Create cross-tenant access policy for partners | > | microsoft.directory/crossTenantAccessPolicy/partners/delete | Delete cross-tenant access policy for partners | > | microsoft.directory/crossTenantAccessPolicy/partners/standard/read | Read basic properties of cross-tenant access policy for partners | > | microsoft.directory/crossTenantAccessPolicy/standard/read | Read basic properties of cross-tenant access policy | > | microsoft.directory/tenantGovernance/invitations/create | Create tenant governance invitations | > | microsoft.directory/tenantGovernance/invitations/delete | Delete tenant governance invitations | > | microsoft.directory/tenantGovernance/invitations/standard/read | Read tenant governance invitations | > | microsoft.directory/tenantGovernance/policyTemplates/allProperties/update | Update tenant governance policy templates | > | microsoft.directory/tenantGovernance/policyTemplates/create | Create tenant governance policy templates | > | microsoft.directory/tenantGovernance/policyTemplates/delete | Delete tenant governance policy templates | > | microsoft.directory/tenantGovernance/policyTemplates/standard/read | Read tenant governance policy templates | > | microsoft.directory/tenantGovernance/relatedTenants/refresh | Trigger a data refresh about related tenants discovered by Microsoft Entra Tenant Governance service | > | microsoft.directory/tenantGovernance/relatedTenants/standard/read | Read data about related tenants discovered by Microsoft Entra Tenant Governance service | > | microsoft.directory/tenantGovernance/relationships/allProperties/update | Update the status of governance relationships | > | microsoft.directory/tenantGovernance/relationships/create | Create tenant governance relationships | > | microsoft.directory/tenantGovernance/relationships/standard/read | Read tenant governance relationships | > | microsoft.directory/tenantGovernance/requests/allProperties/update | Update the status of tenant governance requests | > | microsoft.directory/tenantGovernance/requests/create | Create tenant governance requests | > | microsoft.directory/tenantGovernance/requests/standard/read | Read tenant governance requests | > | microsoft.directory/tenantGovernance/settings/allProperties/update | Manage Microsoft Entra Tenant Governance settings | > | microsoft.directory/tenantGovernance/settings/standard/read | Read tenant governance settings | > | microsoft.office365.webPortal/allEntities/standard/read | Read basic properties on all resources in the Microsoft 365 admin center |