Microsoft Introduces People Administrator Role
People Administrator is the 116th Entra ID Role
Message center notification MC992218 (30 January 2025) announces the arrival of the new People administrator role for Entra ID. There’s nothing remarkable about Microsoft creating a new Entra ID roles because People administrator is the 116th role.
Not every role is used inside every Microsoft 365 tenant. Right now, my tenant uses 36 roles. In fact, the way that things work is that Microsoft defines roles as sets of permissions to allow accounts or apps to perform specific actions. The roles are published as templates which are common across Entra ID and then become “real” roles when first assigned to a holder.
To see the full set of roles, run the Get-MgDirectoryRoleTemplate cmdlet, while to see the set used in a tenant, run Get-MgDirectoryRole. Microsoft documentation also lists the available roles.
New Role to Manage People Settings
People administrator sounds as if it’s like User administrator. In a way, that’s true, but only if equate people with users and assume that the two roles do the same thing, which they don’t. One way of comparing the new roles is that User administrator is all about maintaining user accounts and their attributes whereas People administrator assigns “permissions for managing people-related settings and profile photos without needing the high privileges of Global admin or User admin roles.” In other words, the new role is the implementation of the principle of least privilege to manage settings for the user profile card.
People settings have a very specific meaning within Microsoft 365 and are closely related to the profile card. Along with a bunch of information extracted from different parts of Microsoft 365, you’ll find the user’s photo, pronouns, pronunciation, and custom profiles set by the tenant.
What Assignees with the People Administrator Role Can Do
Holders of the People administrator role will be able to:
- Upload new photos on behalf of users. This capability is controlled by the new user photo update policy. People administrator joins the set of default Entra ID roles allowed to update photos.
- Enable personal pronouns for display on the profile card (Figure 1)
- Enable pronunciation recordings for the profile card.
- Define custom properties for display on the profile card. For instance, many tenants use custom properties to reveal organizational information like cost center designations.
Apart from photos, people administrators cannot update the values that appear in the profile card. Other roles, like User administrator, are required to update settings like change a phone number or a surname.
Processes such as those that update user photos from central (often HR) systems can use the new role instead of a higher-permissioned role like User administrator. This is likely the most important point to review and amend. The other functionality enabled by people administrator are, for now at least, one-off operations. After all, tenants don’t usually customize the properties shown on the people card every week or decide to pronouns off or on periodically.
The interesting aspect of this development is that Microsoft is obviously dedicating resources to building out capabilities around what they call “people-related tasks.” Giving users the ability to record their personal name pronunciation was the most recent example before now. I don’t know what else Microsoft has up their sleeves in this respect, but it’s certainly an interesting area to watch.
Check Your Role Assignments
The advent of the People administrator role is a reminder that some active role assignments might be for elevated roles that aren’t absolutely necessary. It’s probably a good idea to review the set of active and eligible role assignments to decide which remain justified and valid and if any assignments are no longer necessary or require adjustment. Any assignment that’s been in place for a year or more deserves a check. Leaving things alone is a recipe for permission inflation and that’s a horrible thing.
So much change, all the time. It’s a challenge to stay abreast of all the updates Microsoft makes across the Microsoft 365 ecosystem. Subscribe to the Office 365 for IT Pros eBook to receive monthly insights into what happens, why it happens, and what new features and capabilities mean for your tenant.
