Which Roles Can Manage Microsoft Entra Internet Access?

Why the Answer Is Correct

Microsoft documents that the Global Secure Access Administrator role can "create and manage all aspects of Microsoft Entra Internet Access and Microsoft Entra Private Access," which covers User2. The Global Administrator role is the highest-privilege directory role and holds full access to every Microsoft Entra workload, including Global Secure Access, so User1 also qualifies. Because the question asks which users CAN manage Internet Access and both User1 and User2 can, option D is the only defensible pick. As TRN80 reasoned, User1's Global Administrator role "has full access to manage all aspects of Microsoft Entra," while User2's role is purpose-built for this workload. User3's Privileged Role Administrator role is scoped to role assignments and does not grant configuration rights over the Internet Access service, so a three-user answer cannot be right.

Why the Other Options Are Wrong

A (User1 only) ignores that the Global Secure Access Administrator role exists specifically to operate Internet Access and Private Access. B (User2 only) is the most popular distractor because it treats the feature-specific role as exclusive, but it wrongly excludes the tenant-wide Global Administrator. C (User3 only) confuses role-assignment governance with service configuration: Privileged Role Administrator can grant roles to others but cannot itself edit Internet Access settings. E (all three) over-extends the Privileged Role Administrator role and would only be true if that admin had also been assigned Global Administrator or Global Secure Access Administrator.

Community Comment Notes

The community split reflects exactly this confusion, with the majority siding with D and a sizable minority holding B. TRN80 laid out the role-by-role logic, noting that User3's role "is focused on managing role assignments and does not include permissions to manage" Internet Access. Sunth65 argued for B by quoting the role description, "Create and manage all aspects of Microsoft Entra Internet Access," but that text describes what the Global Secure Access Administrator can do — it never states the role is exclusive of Global Administrator. nicolaslindt pointed to Microsoft's role-based permissions reference for Global Secure Access, which is the authoritative source for resolving this question.