builtin_aad_roles = [
  {
    "id": "62e90394-69f5-4237-9190-012177145e10",
    "primitives": [
      {
        "action": "microsoft.directory/groups/allProperties/allTasks",
        "tier": "0",
        "description": "Can update the owner of privileged groups, or add members to privileged groups"
      },
      {
        "action": "microsoft.directory/groupsAssignableToRoles/allProperties/update",
        "tier": "1",
        "description": "Can update members of role-assignable groups"
      },
      {
        "action": "microsoft.directory/roleAssignments/allProperties/allTasks",
        "tier": "0",
        "description": "Can create directory role assignments"
      },
      {
        "action": "microsoft.directory/servicePrincipals/allProperties/allTasks",
        "tier": "0",
        "description": "Can create application secrets, and impersonate them"
      },
      {
        "action": "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin",
        "tier": "0",
        "description": "Consent to privileged permissions on a Service Principal and elevate privileges using those permissions"
      },
      {
        "action": "microsoft.directory/directoryRoles/allProperties/allTasks",
        "tier": "0",
        "description": "Update custom directory roles to include additional privileges."
      }
    ],
    "name": "Global Administrator"
  },
  {
    "id": "10dae51f-b6af-4016-8d66-8c2a99b929b3",
    "primitives": [],
    "name": "Guest User"
  },
  {
    "id": "2af84b1e-32c8-42b7-82bc-daa82404023b",
    "primitives": [],
    "name": "Restricted Guest User"
  },
  {
    "id": "95e79109-95c0-4d8e-aee3-d01accf2d47b",
    "primitives": [],
    "name": "Guest Inviter"
  },
  {
    "id": "fe930be7-5e62-47db-91af-98c3a49a38b1",
    "primitives": [
      {
        "action": "microsoft.directory/groups/owners/update",
        "tier": "0",
        "description": "Update the owner of any group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/groups/members/update",
        "tier": "0",
        "description": "Add self as member to any group to become more privileged"
      },
      {
        "action": "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
        "tier": "1",
        "description": "Add self to a privileged role on a service principal, and assume the privileges of the Service Principal."
      }
    ],
    "name": "User Administrator"
  },
  {
    "id": "729827e3-9c14-49f7-bb1b-9608f156bbb8",
    "primitives": [],
    "name": "Helpdesk Administrator"
  },
  {
    "id": "f023fd81-a637-4b56-95fd-791ac0226033",
    "primitives": [],
    "name": "Service Support Administrator"
  },
  {
    "id": "b0f54661-2d74-4c50-afa3-1ec803f12efe",
    "primitives": [],
    "name": "Billing Administrator"
  },
  {
    "id": "a0b1b346-4d3e-4e8b-98f8-753987be4970",
    "primitives": [],
    "name": "User"
  },
  {
    "id": "4ba39ca4-527c-499a-b93d-d9b492c50246",
    "primitives": [
      {
        "action": "microsoft.directory/groups/owners/update",
        "tier": "0",
        "description": "Update the owner of any group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/applications/credentials/update",
        "tier": "0",
        "description": "Can create application secrets, and impersonate them"
      },
      {
        "action": "microsoft.directory/applications/owners/update",
        "tier": "0",
        "description": "Can make self an application owner, then create a secret to impersonate the application"
      },
      {
        "action": "microsoft.directory/groups/members/update",
        "tier": "0",
        "description": "Add self as member to any group to become more privileged"
      },
      {
        "action": "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
        "tier": "1",
        "description": "Add self to a privileged role on a service principal, and assume the privileges of the Service Principal."
      }
    ],
    "name": "Partner Tier1 Support"
  },
  {
    "id": "e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8",
    "primitives": [
      {
        "action": "microsoft.directory/groups/owners/update",
        "tier": "0",
        "description": "Update the owner of any group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/roleAssignments/allProperties/allTasks",
        "tier": "0",
        "description": "Can create directory role assignments"
      },
      {
        "action": "microsoft.directory/applications/credentials/update",
        "tier": "0",
        "description": "Can create application secrets, and impersonate them"
      },
      {
        "action": "microsoft.directory/applications/owners/update",
        "tier": "0",
        "description": "Can make self an application owner, then create a secret to impersonate the application"
      },
      {
        "action": "microsoft.directory/groups/members/update",
        "tier": "0",
        "description": "Add self as member to any group to become more privileged"
      },
      {
        "action": "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
        "tier": "1",
        "description": "Add self to a privileged role on a service principal, and assume the privileges of the Service Principal."
      }
    ],
    "name": "Partner Tier2 Support"
  },
  {
    "id": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b",
    "primitives": [],
    "name": "Directory Readers"
  },
  {
    "id": "9360feb5-f418-4baa-8175-e2a00bac4301",
    "primitives": [
      {
        "action": "microsoft.directory/groups/owners/update",
        "tier": "0",
        "description": "Update the owner of any group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/groups/members/update",
        "tier": "0",
        "description": "Add self as member to any group to become more privileged"
      },
      {
        "action": "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
        "tier": "1",
        "description": "Add self to a privileged role on a service principal, and assume the privileges of the Service Principal."
      }
    ],
    "name": "Directory Writers"
  },
  {
    "id": "29232cdf-9323-42fd-ade2-1d097af3e4de",
    "primitives": [
      {
        "action": "microsoft.directory/groups.unified/owners/update",
        "tier": "1",
        "description": "Update the owner of any unified group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/groups.unified/members/update",
        "tier": "1",
        "description": "Add self as member to any unified group to become more privileged"
      }
    ],
    "name": "Exchange Administrator"
  },
  {
    "id": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c",
    "primitives": [
      {
        "action": "microsoft.directory/groups.unified/owners/update",
        "tier": "1",
        "description": "Update the owner of any unified group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/groups.unified/members/update",
        "tier": "1",
        "description": "Add self as member to any unified group to become more privileged"
      }
    ],
    "name": "SharePoint Administrator"
  },
  {
    "id": "75941009-915a-4869-abe7-691bff18279e",
    "primitives": [],
    "name": "Skype for Business Administrator"
  },
  {
    "id": "d405c6df-0af8-4e3b-95e4-4d06e542189e",
    "primitives": [],
    "name": "Device Users"
  },
  {
    "id": "9f06204d-73c1-4d4c-880a-6edb90606fd8",
    "primitives": [],
    "name": "Azure AD Joined Device Local Administrator"
  },
  {
    "id": "9c094953-4995-41c8-84c8-3ebb9b32c93f",
    "primitives": [],
    "name": "Device Join"
  },
  {
    "id": "c34f683f-4d5a-4403-affd-6615e00e3a7f",
    "primitives": [],
    "name": "Workplace Device Join"
  },
  {
    "id": "17315797-102d-40b4-93e0-432062caca18",
    "primitives": [],
    "name": "Compliance Administrator"
  },
  {
    "id": "d29b2b05-8046-44ba-8758-1e26182fcf32",
    "primitives": [
      {
        "action": "microsoft.directory/applications/credentials/update",
        "tier": "0",
        "description": "Can create application secrets, and impersonate them"
      },
      {
        "action": "microsoft.directory/applications/owners/update",
        "tier": "0",
        "description": "Can make self an application owner, then create a secret to impersonate the application"
      },
      {
        "action": "microsoft.directory/servicePrincipals/owners/update",
        "tier": "0",
        "description": "Make self a service principal owner, then create a secret to impersonate the service principal"
      },
      {
        "action": "microsoft.directory/servicePrincipals/credentials/update",
        "tier": "0",
        "description": "Create service principal secrets, and impersonate them"
      },
      {
        "action": "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
        "tier": "1",
        "description": "Add self to a privileged role on a service principal, and assume the privileges of the Service Principal."
      }
    ],
    "name": "Directory Synchronization Accounts"
  },
  {
    "id": "2b499bcd-da44-4968-8aec-78e1674fa64d",
    "primitives": [],
    "name": "Device Managers"
  },
  {
    "id": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
    "primitives": [
      {
        "action": "microsoft.directory/applications/credentials/update",
        "tier": "0",
        "description": "Can create application secrets, and impersonate them"
      },
      {
        "action": "microsoft.directory/applications/owners/update",
        "tier": "0",
        "description": "Can make self an application owner, then create a secret to impersonate the application"
      },
      {
        "action": "microsoft.directory/servicePrincipals/owners/update",
        "tier": "0",
        "description": "Make self a service principal owner, then create a secret to impersonate the service principal"
      },
      {
        "action": "microsoft.directory/servicePrincipals/credentials/update",
        "tier": "0",
        "description": "Create service principal secrets, and impersonate them"
      },
      {
        "action": "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-application-admin",
        "tier": "1",
        "description": "Consent to high-privileged application permissions on a Service Principal, except for Graph. May be used to elevate access on applications or SaaS offerings."
      },
      {
        "action": "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
        "tier": "1",
        "description": "Add self to a privileged role on a service principal, and assume the privileges of the Service Principal."
      }
    ],
    "name": "Application Administrator"
  },
  {
    "id": "cf1c38e5-3621-4004-a7cb-879624dced7c",
    "primitives": [],
    "name": "Application Developer"
  },
  {
    "id": "5d6b6bb7-de71-4623-b4af-96380a352509",
    "primitives": [],
    "name": "Security Reader"
  },
  {
    "id": "194ae4cb-b126-40b2-bd5b-6091b380977d",
    "primitives": [
      {
        "action": "microsoft.directory/conditionalAccessPolicies/create",
        "tier": "1",
        "description": "Create prioritized conditional access policies to bypass restrictions"
      },
      {
        "action": "microsoft.directory/conditionalAccessPolicies/delete",
        "tier": "1",
        "description": "Remove conditional access policies to bypass restrictions"
      },
      {
        "action": "microsoft.directory/domains/federation/update",
        "tier": "0",
        "description": "Federate access to the directory via a malicious Identity Provider, and take over current user accounts."
      }
    ],
    "name": "Security Administrator"
  },
  {
    "id": "e8611ab8-c189-46e8-94e1-60213ab1f814",
    "primitives": [
      {
        "action": "microsoft.directory/groupsAssignableToRoles/allProperties/update",
        "tier": "1",
        "description": "Can update members of role-assignable groups"
      },
      {
        "action": "microsoft.directory/roleAssignments/allProperties/allTasks",
        "tier": "0",
        "description": "Can create directory role assignments"
      },
      {
        "action": "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin",
        "tier": "0",
        "description": "Consent to privileged permissions on a Service Principal and elevate privileges using those permissions"
      },
      {
        "action": "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
        "tier": "1",
        "description": "Add self to a privileged role on a service principal, and assume the privileges of the Service Principal."
      },
      {
        "action": "microsoft.directory/directoryRoles/allProperties/allTasks",
        "tier": "0",
        "description": "Update custom directory roles to include additional privileges."
      }
    ],
    "name": "Privileged Role Administrator"
  },
  {
    "id": "3a2c62db-5318-420d-8d74-23affee5d9d5",
    "primitives": [
      {
        "action": "microsoft.directory/groups.security/owners/update",
        "tier": "0",
        "description": "Update the owner of any security group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/groups.security/members/update",
        "tier": "0",
        "description": "Add self as member to any security group to become more privileged"
      }
    ],
    "name": "Intune Administrator"
  },
  {
    "id": "158c047a-c907-4556-b7ef-446551a6b5f7",
    "primitives": [
      {
        "action": "microsoft.directory/applications/credentials/update",
        "tier": "0",
        "description": "Can create application secrets, and impersonate them"
      },
      {
        "action": "microsoft.directory/applications/owners/update",
        "tier": "0",
        "description": "Can make self an application owner, then create a secret to impersonate the application"
      },
      {
        "action": "microsoft.directory/servicePrincipals/owners/update",
        "tier": "0",
        "description": "Make self a service principal owner, then create a secret to impersonate the service principal"
      },
      {
        "action": "microsoft.directory/servicePrincipals/credentials/update",
        "tier": "0",
        "description": "Create service principal secrets, and impersonate them"
      },
      {
        "action": "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-application-admin",
        "tier": "1",
        "description": "Consent to high-privileged application permissions on a Service Principal, except for Graph. May be used to elevate access on applications or SaaS offerings."
      },
      {
        "action": "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
        "tier": "1",
        "description": "Add self to a privileged role on a service principal, and assume the privileges of the Service Principal."
      }
    ],
    "name": "Cloud Application Administrator"
  },
  {
    "id": "5c4f9dcd-47dc-4cf7-8c9a-9e4207cbfc91",
    "primitives": [],
    "name": "Customer LockBox Access Approver"
  },
  {
    "id": "44367163-eba1-44c3-98af-f5787879f96a",
    "primitives": [],
    "name": "Dynamics 365 Administrator"
  },
  {
    "id": "a9ea8996-122f-4c74-9520-8edcd192826c",
    "primitives": [],
    "name": "Power BI Administrator"
  },
  {
    "id": "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
    "primitives": [
      {
        "action": "microsoft.directory/conditionalAccessPolicies/create",
        "tier": "1",
        "description": "Create prioritized conditional access policies to bypass restrictions"
      },
      {
        "action": "microsoft.directory/conditionalAccessPolicies/delete",
        "tier": "1",
        "description": "Remove conditional access policies to bypass restrictions"
      }
    ],
    "name": "Conditional Access Administrator"
  },
  {
    "id": "4a5d8f65-41da-4de4-8968-e035b65339cf",
    "primitives": [],
    "name": "Reports Reader"
  },
  {
    "id": "790c1fb9-7f7d-4f88-86a1-ef1f95c05c1b",
    "primitives": [],
    "name": "Message Center Reader"
  },
  {
    "id": "7495fdc4-34c4-4d15-a289-98788ce399fd",
    "primitives": [],
    "name": "Azure Information Protection Administrator"
  },
  {
    "id": "38a96431-2bdf-4b4c-8b6e-5d3d8abac1a4",
    "primitives": [],
    "name": "Desktop Analytics Administrator"
  },
  {
    "id": "4d6ac14f-3453-41d0-bef9-a3e0c569773a",
    "primitives": [],
    "name": "License Administrator"
  },
  {
    "id": "7698a772-787b-4ac8-901f-60d6b08affd2",
    "primitives": [],
    "name": "Cloud Device Administrator"
  },
  {
    "id": "c4e39bd9-1100-46d3-8c65-fb160da0071f",
    "primitives": [],
    "name": "Authentication Administrator"
  },
  {
    "id": "7be44c8a-adaf-4e2a-84d6-ab2649e08a13",
    "primitives": [],
    "name": "Privileged Authentication Administrator"
  },
  {
    "id": "baf37b3a-610e-45da-9e62-d9d1e5e8914b",
    "primitives": [],
    "name": "Teams Communications Administrator"
  },
  {
    "id": "f70938a0-fc10-4177-9e90-2178f8765737",
    "primitives": [],
    "name": "Teams Communications Support Engineer"
  },
  {
    "id": "fcf91098-03e3-41a9-b5ba-6f0ec8188a12",
    "primitives": [],
    "name": "Teams Communications Support Specialist"
  },
  {
    "id": "69091246-20e8-4a56-aa4d-066075b2a7a8",
    "primitives": [
      {
        "action": "microsoft.directory/groups.unified/owners/update",
        "tier": "1",
        "description": "Update the owner of any unified group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/groups.unified/members/update",
        "tier": "1",
        "description": "Add self as member to any unified group to become more privileged"
      }
    ],
    "name": "Teams Administrator"
  },
  {
    "id": "eb1f4a8d-243a-41f0-9fbd-c7cdf6c5ef7c",
    "primitives": [],
    "name": "Insights Administrator"
  },
  {
    "id": "ac16e43d-7b2d-40e0-ac05-243ff356ab5b",
    "primitives": [],
    "name": "Message Center Privacy Reader"
  },
  {
    "id": "6e591065-9bad-43ed-90f3-e9424366d2f0",
    "primitives": [],
    "name": "External ID User Flow Administrator"
  },
  {
    "id": "0f971eea-41eb-4569-a71e-57bb8a3eff1e",
    "primitives": [],
    "name": "External ID User Flow Attribute Administrator"
  },
  {
    "id": "aaf43236-0c0d-4d5f-883a-6955382ac081",
    "primitives": [],
    "name": "B2C IEF Keyset Administrator"
  },
  {
    "id": "3edaf663-341e-4475-9f94-5c398ef6c070",
    "primitives": [],
    "name": "B2C IEF Policy Administrator"
  },
  {
    "id": "be2f45a1-457d-42af-a067-6ec1fa63bc45",
    "primitives": [
      {
        "action": "microsoft.directory/domains/federation/update",
        "tier": "0",
        "description": "Federate access to the directory via a malicious Identity Provider, and take over current user accounts."
      }
    ],
    "name": "External Identity Provider Administrator"
  },
  {
    "id": "e6d1a23a-da11-4be4-9570-befc86d067a7",
    "primitives": [],
    "name": "Compliance Data Administrator"
  },
  {
    "id": "5f2222b1-57c3-48ba-8ad5-d4759f1fde6f",
    "primitives": [],
    "name": "Security Operator"
  },
  {
    "id": "74ef975b-6605-40af-a5d2-b9539d836353",
    "primitives": [],
    "name": "Kaizala Administrator"
  },
  {
    "id": "f2ef992c-3afb-46b9-b7cf-a126ee74c451",
    "primitives": [],
    "name": "Global Reader"
  },
  {
    "id": "0964bb5e-9bdb-4d7b-ac29-58e794862a40",
    "primitives": [],
    "name": "Search Administrator"
  },
  {
    "id": "8835291a-918c-4fd7-a9ce-faa49f0cf7d9",
    "primitives": [],
    "name": "Search Editor"
  },
  {
    "id": "966707d0-3269-4727-9be2-8c3a10f19b9d",
    "primitives": [],
    "name": "Password Administrator"
  },
  {
    "id": "644ef478-e28f-4e28-b9dc-3fdde9aa0b1f",
    "primitives": [],
    "name": "Printer Administrator"
  },
  {
    "id": "e8cef6f1-e4bd-4ea8-bc07-4b8d950f4477",
    "primitives": [],
    "name": "Printer Technician"
  },
  {
    "id": "0526716b-113d-4c15-b2c8-68e3c22b9f80",
    "primitives": [],
    "name": "Authentication Policy Administrator"
  },
  {
    "id": "fdd7a751-b60b-444a-984c-02652fe8fa1c",
    "primitives": [
      {
        "action": "microsoft.directory/groups/owners/update",
        "tier": "0",
        "description": "Update the owner of any group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/groups/members/update",
        "tier": "0",
        "description": "Add self as member to any group to become more privileged"
      }
    ],
    "name": "Groups Administrator"
  },
  {
    "id": "11648597-926c-4cf3-9c36-bcebb0ba8dcc",
    "primitives": [],
    "name": "Power Platform Administrator"
  },
  {
    "id": "e3973bdf-4987-49ae-837a-ba8e231c7286",
    "primitives": [],
    "name": "Azure DevOps Administrator"
  },
  {
    "id": "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2",
    "primitives": [
      {
        "action": "microsoft.directory/applications/owners/update",
        "tier": "0",
        "description": "Can make self an application owner, then create a secret to impersonate the application"
      },
      {
        "action": "microsoft.directory/servicePrincipals/owners/update",
        "tier": "0",
        "description": "Make self a service principal owner, then create a secret to impersonate the service principal"
      },
      {
        "action": "microsoft.directory/domains/federation/update",
        "tier": "0",
        "description": "Federate access to the directory via a malicious Identity Provider, and take over current user accounts."
      }
    ],
    "name": "Hybrid Identity Administrator"
  },
  {
    "id": "2b745bdf-0803-4d80-aa65-822c4493daac",
    "primitives": [],
    "name": "Office Apps Administrator"
  },
  {
    "id": "d37c8bed-0711-4417-ba38-b4abe66ce4c2",
    "primitives": [],
    "name": "Network Administrator"
  },
  {
    "id": "31e939ad-9672-4796-9c2e-873181342d2d",
    "primitives": [],
    "name": "Insights Business Leader"
  },
  {
    "id": "3d762c5a-1b6c-493f-843e-55a3b42923d4",
    "primitives": [],
    "name": "Teams Devices Administrator"
  },
  {
    "id": "c430b396-e693-46cc-96f3-db01bf8bb62a",
    "primitives": [],
    "name": "Attack Simulation Administrator"
  },
  {
    "id": "9c6df0f2-1e7c-4dc3-b195-66dfbd24aa8f",
    "primitives": [],
    "name": "Attack Payload Author"
  },
  {
    "id": "75934031-6c7e-415a-99d7-48dbd49e875e",
    "primitives": [],
    "name": "Usage Summary Reports Reader"
  },
  {
    "id": "b5a8dcf3-09d5-43a9-a639-8e29ef291470",
    "primitives": [
      {
        "action": "microsoft.directory/groups.security/owners/update",
        "tier": "0",
        "description": "Update the owner of any security group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/groups.security/members/update",
        "tier": "0",
        "description": "Add self as member to any security group to become more privileged"
      }
    ],
    "name": "Knowledge Administrator"
  },
  {
    "id": "744ec460-397e-42ad-a462-8b3f9747a02c",
    "primitives": [
      {
        "action": "microsoft.directory/groups.security/owners/update",
        "tier": "0",
        "description": "Update the owner of any security group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/groups.security/members/update",
        "tier": "0",
        "description": "Add self as member to any security group to become more privileged"
      }
    ],
    "name": "Knowledge Manager"
  },
  {
    "id": "8329153b-31d0-4727-b945-745eb3bc5f31",
    "primitives": [],
    "name": "Domain Name Administrator"
  },
  {
    "id": "8424c6f0-a189-499e-bbd0-26c1753c96d4",
    "primitives": [],
    "name": "Attribute Definition Administrator"
  },
  {
    "id": "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",
    "primitives": [],
    "name": "Attribute Assignment Administrator"
  },
  {
    "id": "1d336d2c-4ae8-42ef-9711-b3604ce3fc2c",
    "primitives": [],
    "name": "Attribute Definition Reader"
  },
  {
    "id": "ffd52fa5-98dc-465c-991d-fc073eb59f8f",
    "primitives": [],
    "name": "Attribute Assignment Reader"
  },
  {
    "id": "31392ffb-586c-42d1-9346-e59415a2cc4e",
    "primitives": [],
    "name": "Exchange Recipient Administrator"
  },
  {
    "id": "45d8d3c5-c802-45c6-b32a-1d70b5e1e86e",
    "primitives": [
      {
        "action": "microsoft.directory/groups/members/update",
        "tier": "0",
        "description": "Add self as member to any group to become more privileged"
      },
      {
        "action": "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
        "tier": "1",
        "description": "Add self to a privileged role on a service principal, and assume the privileges of the Service Principal."
      }
    ],
    "name": "Identity Governance Administrator"
  },
  {
    "id": "892c5842-a9a6-463a-8041-72aa08ca3cf6",
    "primitives": [],
    "name": "Cloud App Security Administrator"
  },
  {
    "id": "32696413-001a-46ae-978c-ce0f6b3620d2",
    "primitives": [],
    "name": "Windows Update Deployment Administrator"
  },
  {
    "id": "11451d60-acb2-45eb-a7d6-43d0f0125c13",
    "primitives": [
      {
        "action": "microsoft.directory/groups.security/owners/update",
        "tier": "0",
        "description": "Update the owner of any security group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/groups.security/members/update",
        "tier": "0",
        "description": "Add self as member to any security group to become more privileged"
      }
    ],
    "name": "Windows 365 Administrator"
  },
  {
    "id": "3f1acade-1e04-4fbc-9b69-f0302cd84aef",
    "primitives": [],
    "name": "Edge Administrator"
  },
  {
    "id": "810a2642-a034-447f-a5e8-41beaa378541",
    "primitives": [
      {
        "action": "microsoft.directory/groups.unified/owners/update",
        "tier": "1",
        "description": "Update the owner of any unified group, and add self as member to become more privileged"
      },
      {
        "action": "microsoft.directory/groups.unified/members/update",
        "tier": "1",
        "description": "Add self as member to any unified group to become more privileged"
      }
    ],
    "name": "Yammer Administrator"
  },
  {
    "id": "25a516ed-2fa0-40ea-a2d0-12923a21473a",
    "primitives": [],
    "name": "Authentication Extensibility Administrator"
  },
  {
    "id": "e300d9e7-4a2b-4295-9eff-f1c78b36cc98",
    "primitives": [],
    "name": "Virtual Visits Administrator"
  },
  {
    "id": "25df335f-86eb-4119-b717-0ff02de207e9",
    "primitives": [],
    "name": "Insights Analyst"
  },
  {
    "id": "1501b917-7653-4ff9-a4b5-203eaf33784f",
    "primitives": [],
    "name": "Microsoft Hardware Warranty Administrator"
  },
  {
    "id": "281fe777-fb20-4fbb-b7a3-ccebce5b0d96",
    "primitives": [],
    "name": "Microsoft Hardware Warranty Specialist"
  },
  {
    "id": "112ca1a2-15ad-4102-995e-45b0bc479a6a",
    "primitives": [],
    "name": "Tenant Creator"
  },
  {
    "id": "59d46f88-662b-457b-bceb-5c3809e5908f",
    "primitives": [],
    "name": "Lifecycle Workflows Administrator"
  },
  {
    "id": "92b086b3-e367-4ef2-b869-1de128fb986e",
    "primitives": [],
    "name": "Viva Goals Administrator"
  },
  {
    "id": "27460883-1df1-4691-b032-3b79643e5e63",
    "primitives": [],
    "name": "User Experience Success Manager"
  },
  {
    "id": "af78dc32-cf4d-46f9-ba4e-4428526346b5",
    "primitives": [],
    "name": "Permissions Management Administrator"
  },
  {
    "id": "507f53e4-4e52-4077-abd3-d2e1558b6ea2",
    "primitives": [],
    "name": "Organizational Messages Writer"
  },
  {
    "id": "87761b17-1ed2-4af3-9acd-92a150038160",
    "primitives": [],
    "name": "Viva Pulse Administrator"
  },
  {
    "id": "dd13091a-6207-4fc0-82ba-3641e056ab95",
    "primitives": [],
    "name": "Extended Directory User Administrator"
  }
]