Well-known application and role identifiers

The GUIDs and enumeration values you need when reading or writing policy JSON.
Published by Urbannerd Consulting · Reviewed 2026-07-29

Well-known identifiers

GUIDs the agent needs when reading or writing policy JSON. **Provenance is recorded per

entry** — the agent may state a [benchmark guidance v7.0.0] value confidently and must hedge anything

marked [VERIFY].

Application IDs

Microsoft Intune Enrollment caveat: in newer tenants this app may not appear in the CA

resource picker until an administrator creates a service principal with that app ID via

PowerShell or Graph . Warn users before they go looking for it.

Microsoft Admin Portals appears as a selectable target in the CA resource picker rather

than as a GUID users typically handle. The agent should refer to it by name and not assert

an ID.

Directory role template IDs

Other role template IDs are stable but are not reproduced here from memory. When a policy

JSON contains includeRoles GUIDs the agent does not recognise, it should ask the user to

confirm the role names from the portal rather than guess. [VERIFY] against the Entra

role permissions reference when an ID is decisive.

benchmark guidance administrative role set

The minimum directory roles benchmark guidance specifies for admin-targeted policies (5.2.2.1, 5.2.2.4,

5.2.2.5), by name rather than ID:

Application administrator · Authentication administrator · Billing administrator ·

Cloud application administrator · Conditional Access administrator · Exchange administrator ·

Global administrator · Global reader · Helpdesk administrator · Password administrator ·

Privileged authentication administrator · Privileged role administrator ·

Security administrator · SharePoint administrator · User administrator

Global reader belongs on this list. Read-only is still privileged.

User action URNs

Enumeration values

Safe to use — these are corroborated by the benchmark guidance audit procedures.

state: enabled · disabled · enabledForReportingButNotEnforced

clientAppTypes: all · browser · mobileAppsAndDesktopClients ·

exchangeActiveSync · other

builtInControls: block · mfa · compliantDevice · domainJoinedDevice ·

approvedApplication · compliantApplication · passwordChange

grantControls.operator: AND (require all) · OR (require one of)

Risk levels: low · medium · high · none

authenticationFlows.transferMethods: deviceCodeFlow · authenticationTransfer

(comma-delimited string, not an array)

Phishing-resistant strength combinations: windowsHelloForBusiness · fido2 ·

x509CertificateMultiFactor

signInFrequency.frequencyInterval: timeBased · everyTime

persistentBrowser.mode: always · never

Location special values: All · AllTrusted

Named location types: microsoft.graph.ipNamedLocation (supports isTrusted) ·

microsoft.graph.countryNamedLocation (does not support isTrusted)

Dates and thresholds worth citing

Portal terminology changes

Users and older documentation use the old labels. Recognise both; use the current one.

[VERIFY] — portal navigation is the fastest-changing surface in this whole knowledge

base. The agent should describe the destination ("the Conditional Access policies blade in

the Entra admin center") as well as any path, so guidance survives a relabelling.