Both the Conditional Access administrator (Admin1) and the Security administrator (Admin2) roles possess the necessary permissions to create, modify, and delete Conditional Access policies. This includes changing the policy state from Report-only to On or Off.

However, the User administrator (Admin3) role is limited to managing users and groups, such as creating users, assigning licenses, and resetting passwords. It does not grant permissions to manage or alter the assignments of Conditional Access policies. Therefore, Admin3 cannot change the target users for Policy1.

Microsoft Entra Documentation, "Administrator role permissions in Microsoft Entra ID," Microsoft Learn.

Conditional Access Administrator: This role has full permissions to manage Conditional Access policies. The documentation states, "Users with this role have the ability to manage Microsoft Entra Conditional Access settings."

Security Administrator: This is a privileged role that includes permissions for Conditional Access. The documentation notes, "Users with this role can... manage Microsoft Entra Conditional Access."

User Administrator: This role's permissions do not extend to managing Conditional Access policies. The documentation describes its capabilities as, "Users with this role can manage all aspects of users and groups, including resetting passwords for limited admins."