Managing Privileged Roles in Microsoft Entra ID: A Pragmatic Approach

This TrustedSec article introduces the Entra Privileged Tier Model to classify Microsoft Entra ID built-in roles into three tiers—Tier 0 (core tenant/security control), Tier 1 (service-level administration), and Tier 2 (limited or read-only)—lists the roles assigned to each tier, explains the rationale for assignments, and provides tier-specific security recommendations such as PIM, attack-resistant MFA, least-privilege assignments, and use of privileged access workstations.