Least-privileged Microsoft Entra role for tenant-level SSPR settings and the authentication methods policy, neither of which Authentication Administrator can change.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Authentication Policy Administrator in context, with comparison tables and the common traps.
Terms in this definition
- Microsoft Entra
The umbrella brand covering Microsoft's identity and network access portfolio. Internet Access, Private Access, External ID and ID Governance all belong to it, built on top of the core directory service, Entra ID.
- Role
How an actor normally or expectedly behaves, or the part a person takes in a process. A single actor may hold more than one role.
- SSPR
Allows users to unlock or reset their own passwords with methods they have registered. It can apply to All users, None, or Selected (a single group, with nesting supported).
- Authentication methods policy
Tenant-level Microsoft Entra policy that switches on each sign-in method, such as FIDO2, Authenticator, certificate-based authentication, TAP or SMS, for chosen users or groups.
- Authentication Administrator
Microsoft Entra role for managing authentication methods on individual user accounts. Tenant-wide SSPR and the authentication methods policy lie outside its reach.
See Authentication Policy Administrator in the full glossary