Microsoft Entra: Blocking new assignments to partner tier support roles

🚨 The Signal: Microsoft Entra will block new assignments to Partner Tier1 and Tier2 Support roles from August 2026. These roles are being retired to enhance security by promoting least-privilege access and clearer role usage.

The Impact

Admins managing Entra ID role assignments are affected, reducing the risk of excessive permissions through deprecated partner roles.

  • CSP/GDAP admins: Existing automation assigning these roles will fail.
  • Security teams: Reduced risk of over-privileged partner access.
  • Identity architects: Review and update role assignment strategies.
  • Compliance officers: Improved adherence to least privilege principles.

The Action

  1. Identify existing assignments to 'Partner Tier1 Support' and 'Partner Tier2 Support' roles.
  2. Review all scripts, automation, and workflows that assign these roles.
  3. Modify automation to assign 'User Administrator' or other least-privilege roles instead.
  4. Communicate the change to affected partner organizations and internal teams.

Domain: Entra · Impact: medium · Workload: Entra ID · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898