Enforce least privilege for Entra ID Company Branding with the new Organizational Branding role

Hello friends,   

I’m pleased to announce General Availability (GA) of the Organizational Branding role for Microsoft Entra ID Company Branding. 

This new role is part of our ongoing efforts to implement Zero Trust network access by enforcing the principle of least privilege for users when customizing their authentication user experience (UX) via Entra ID Company Branding. 

Previously, users wanting to configure Entra ID Company Branding required the Global Admin role. This role, though, has sweeping privileges beyond what’s necessary for configuring Entra ID Company Branding.  

The new Organizational Branding role limits its privileges to the configuration of Entra ID Company Branding, significantly improving security and reducing the attack surface associated with its configuration. 

To assign the role to a user, follow these steps: 

1. Log on to Microsoft Entra ID and select Users. 

2. Select and open the user to assign the Organizational Branding role. 

3. Select Assigned roles and then Add assignments.  

4. Select the Organizational Branding Administrator role and assign it to the user. 

Once the settings are applied, the user will be able to configure the authentication UX via Entra ID Company Branding.  

Learn more about how to configure your company branding and create a consistent sign-in experience for your users 

James Mantu 

Sr. Product Manager, Microsoft identity  

LinkedIn: jamesmantu | LinkedIn 

Learn more about Microsoft Entra: 

• Related Articles:  Add company branding to your organization's sign-in page (preview) - Azure AD - Microsoft Entra | Microsoft Learn  
• See recent Microsoft Entra blogs  
• Dive into Microsoft Entra technical documentation  
• Join the conversation on the Microsoft Entra discussion space and Twitter  
• Learn more about Microsoft Security