Merge pull request #50184 from curtand/license0827

[Azure AD admin roles] add License Administrator

Author: PRMerger14

articles/active-directory/users-groups-roles/directory-assign-admin-roles.md

@@ -11,7 +11,7 @@ ms.service: active-directory
 ms.workload: identity
 ms.component: users-groups-roles
 ms.topic: article
-ms.date: 08/21/2018
+ms.date: 08/27/2018
 ms.author: curtand
 ms.reviewer: vincesm
 ms.custom: it-pro
@@ -73,6 +73,9 @@ The following administrator roles are available:
 
 * **[Intune Service Administrator](#intune-service-administrator)**: Users with this role have global permissions within Microsoft Intune Online, when the service is present. Additionally, this role contains the ability to manage users and devices in order to associate policy, as well as create and manage groups. More information at [Role-based administration control (RBAC) with Microsoft Intune](https://docs.microsoft.com/intune/role-based-access-control)
 
+* **[License Administrator](#license-administrator)**: 
+Users in this role can add, remove, and update license assignments on users, groups (using group-based licensing), and manage the usage location on users. The role does not grant the ability to purchase or manage subscriptions, create or manage groups, or create or manage users beyond the usage location.
+
 * **[Message Center Reader](#message-center-reader)**: Users in this role can monitor notifications and advisory health updates in [Office 365 Message center](https://support.office.com/article/Message-center-in-Office-365-38FB3333-BFCC-4340-A37B-DEDA509C2093) for their organization on configured services such as Exchange, Intune and Microsoft Teams. Message Center Readers receive weekly email digests of posts, updates, and can share message center posts in Office 365. In Azure AD, users assigned to this role will only have read-only access on Azure AD services such as users and groups. 
 
 * **[Partner Tier1 Support](#partner-tier1-support)**: Do not use. This role has been deprecated and will be removed from Azure AD in the future. This role is intended for use by a small number of Microsoft resale partners, and is not intended for general use.
@@ -608,6 +611,17 @@ Can manage all aspects of the Intune product.
 | microsoft.aad.supporttickets/AllEntities/AllActions | Create and manage Office 365 support tickets. |
 | microsoft.intune/AllEntities/AllActions | Manage all aspects of Intune. |
 
+### License Administrator
+Can assign licenses to users.
+
+| **Actions** | **Description** |
+| --- | --- |
+| microsoft.aad.directory/users/assignLicense        |   |
+| microsoft.aad.directory/users/usageLocation/update |   |
+| microsoft.azure.accessService/allEntities/allTasks |   |
+| microsoft.azure.serviceHealth/allEntities/allTasks |   |
+| microsoft.office365.serviceHealth/allEntities/allTasks |   |
+
 ### Lync Service Administrator
 Can manage all aspects of the Skype for Business product.