Similar to [[202401072038 Azure RBAC custom roles]]

Permissions start with microsoft.directory/

• requires P1 license
• use powershell or microsoft graph api for more control over permissions not in azure portal
• need global admin or privileged role admin

references: