"Access package assignment manager" role with "Restricted access to Microsoft Entra admin center"

Hi, this is one of those Entra permission cases where the role assignment alone may not be enough if portal access is restricted.

I would confirm:

1. The user has the catalog-scoped role assignment.

2. They can access the Entra admin center when restricted access is enabled.

3. The catalog and access package are in the exact scope of their role.

4. They are not blocked by Conditional Access or admin portal restrictions.

If the goal is least privilege, test with a pilot account and document the minimum extra role or portal access needed. The catalog role controls entitlement management scope, but the portal restriction can still block the front door.