members

Creates, updates, deletes, gets or lists a members resource.

Overview

Name	members
Type	Resource
Id	entra_id.directory_roles.members

Fields

The following fields are returned by SELECT queries:

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
deletedDateTime	string (date-time)	Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list	select	directory_role_id	ConsistencyLevel	Retrieve the list of principals that are assigned to the directory role. You can use both the object ID and template ID of the directoryRole with this API. The template ID of a built-in role is immutable and can be seen in the role description on the Microsoft Entra admin center. For details, see Role template IDs.
add_ref	insert	directory_role_id		Create a new directory role member. You can use both the object ID and template ID of the directoryRole with this API. The template ID of a built-in role is immutable and can be seen in the role description on the Microsoft Entra admin center. For details, see Role template IDs.
remove_ref	delete	directory_role_id, directory_object_id	If-Match	Remove a member from a directoryRole. You can use both the object ID and template ID of the directoryRole with this API. The template ID of a built-in role is immutable and can be seen in the role description on the Microsoft Entra admin center. For details, see Role template IDs.
remove_ref_2	delete	directory_role_id	If-Match	Remove a member from a directoryRole. You can use both the object ID and template ID of the directoryRole with this API. The template ID of a built-in role is immutable and can be seen in the role description on the Microsoft Entra admin center. For details, see Role template IDs.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
directory_object_id	string	The unique identifier of directoryObject
directory_role_id	string	The unique identifier of directoryRole
ConsistencyLevel	string	Indicates the requested consistency level. Documentation URL: https://docs.microsoft.com/graph/aad-advanced-queries
If-Match	string	ETag

SELECT examples

list

Retrieve the list of principals that are assigned to the directory role. You can use both the object ID and template ID of the directoryRole with this API. The template ID of a built-in role is immutable and can be seen in the role description on the Microsoft Entra admin center. For details, see Role template IDs.

SELECT
id,
deletedDateTime
FROM entra_id.directory_roles.members
WHERE directory_role_id = '{{ directory_role_id }}' -- required
AND ConsistencyLevel = '{{ ConsistencyLevel }}'
;

INSERT examples

add_ref

Create a new directory role member. You can use both the object ID and template ID of the directoryRole with this API. The template ID of a built-in role is immutable and can be seen in the role description on the Microsoft Entra admin center. For details, see Role template IDs.

INSERT INTO entra_id.directory_roles.members (
directoryObjectId,
directory_role_id
)
SELECT 
'{{ directoryObjectId }}',
'{{ directory_role_id }}'
;

Manifest

# Description fields are for documentation purposes
- name: members
props:
  - name: directory_role_id
    value: "{{ directory_role_id }}"
    description: Required parameter for the members resource.
  - name: directoryObjectId
    value: "{{ directoryObjectId }}"
    description: |
      The id of the directory object to reference (a user, group, service principal, device, ...). Sent on the wire as '@odata.id': 'https://graph.microsoft.com/v1.0/directoryObjects/{id}'.

DELETE examples

remove_ref

Remove a member from a directoryRole. You can use both the object ID and template ID of the directoryRole with this API. The template ID of a built-in role is immutable and can be seen in the role description on the Microsoft Entra admin center. For details, see Role template IDs.

DELETE FROM entra_id.directory_roles.members
WHERE directory_role_id = '{{ directory_role_id }}' --required
AND directory_object_id = '{{ directory_object_id }}' --required
AND If-Match = '{{ If-Match }}'
;

remove_ref_2

Remove a member from a directoryRole. You can use both the object ID and template ID of the directoryRole with this API. The template ID of a built-in role is immutable and can be seen in the role description on the Microsoft Entra admin center. For details, see Role template IDs.

DELETE FROM entra_id.directory_roles.members
AND directory_role_id = '{{ directory_role_id }}' --required
AND If-Match = '{{ If-Match }}'
;