Check inherited full access before narrowing a Cloud Apps administrator locally

Source facts

Defender for Cloud Apps can override some Microsoft Entra or Microsoft 365 permissions through a manually added local administrator role. It cannot override Entra roles already providing full access: Global administrator, Security administrator and Cloud App Security administrator. Those directory-service roles do not appear on the Cloud Apps Manage admin access page. The built-in local Cloud Apps roles grant access only to that service. Microsoft Learn.

Applicability

Use this distinction when an administrator is meant to have limited Cloud Apps responsibilities but may also hold a broader directory role. A local assignment review is only part of the access review; it does not establish the complete inherited permission set.

DSE recommendation

Inspect the directory role assignments before relying on a narrower local Cloud Apps role as the access boundary. Have the identity owner and Cloud Apps owner reconcile the user’s intended duties with both assignment surfaces. If a broader role is required for another task, document that conflict and consider a separate administrative identity under the organization’s access policy. Do not describe the local role as a restriction that the product cannot enforce.

Verification

With an approved test identity, compare the expected visible data and allowed actions with actual access. Include a directory-role review rather than checking only the Cloud Apps role list. Preserve the assignment evidence and observed restrictions without performing destructive governance actions. Resolve unexpected full access before signing off the narrower role, and repeat the comparison after any approved directory-role change.

Official references

Microsoft Learn: Configure Cloud Apps admin access. Source reviewed September 9, 2026.