Skip to main content

app_role_assignments

Creates, updates, deletes, gets or lists an app_role_assignments resource.

Overview​

Nameapp_role_assignments
TypeResource
Identra_id.groups.app_role_assignments

Fields​

The following fields are returned by SELECT queries:

Retrieved navigation property

NameDatatypeDescription
idstringThe unique identifier for an entity. Read-only.
appRoleIdstring (uuid)The identifier (id) for the app role that's assigned to the principal. This app role must be exposed in the appRoles property on the resource application's service principal (resourceId). If the resource application hasn't declared any app roles, a default app role ID of 00000000-0000-0000-0000-000000000000 can be specified to signal that the principal is assigned to the resource app without any specific app roles. Required on create. (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)
createdDateTimestring (date-time)The time when the app role assignment was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
deletedDateTimestring (date-time)Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
principalDisplayNamestringThe display name of the user, group, or service principal that was granted the app role assignment. Maximum length is 256 characters. Read-only. Supports $filter (eq and startswith).
principalIdstring (uuid)The unique identifier (id) for the user, security group, or service principal being granted the app role. Security groups with dynamic memberships are supported. Required on create. (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)
principalTypestringThe type of the assigned principal. This can either be User, Group, or ServicePrincipal. Read-only.
resourceDisplayNamestringThe display name of the resource app's service principal to which the assignment is made. Maximum length is 256 characters.
resourceIdstring (uuid)The unique identifier (id) for the resource service principal for which the assignment is made. Required on create. Supports $filter (eq only). (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
getselectgroup_id, app_role_assignment_idConsistencyLevelRepresents the app roles granted to a group for an application. Supports $expand.
listselectgroup_idConsistencyLevelRetrieve the list of appRoleAssignment that have been granted to a group.
insertinsertgroup_idUse this API to assign an app role to a security group. All direct members of the group will be considered assigned. Security groups with dynamic memberships are supported. To grant an app role assignment to a group, you need three identifiers: Additional licenses might be required to use a group to manage access to applications.
updateupdategroup_id, app_role_assignment_id
deletedeletegroup_id, app_role_assignment_idIf-MatchDeletes an appRoleAssignment that a group has been granted.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
app_role_assignment_idstringThe unique identifier of appRoleAssignment
group_idstringThe unique identifier of group
ConsistencyLevelstringIndicates the requested consistency level. Documentation URL: https://docs.microsoft.com/graph/aad-advanced-queries
If-MatchstringETag

SELECT examples​

Represents the app roles granted to a group for an application. Supports $expand.

SELECT
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId
FROM entra_id.groups.app_role_assignments
WHERE group_id = '{{ group_id }}' -- required
AND app_role_assignment_id = '{{ app_role_assignment_id }}' -- required
AND ConsistencyLevel = '{{ ConsistencyLevel }}'
;

INSERT examples​

Use this API to assign an app role to a security group. All direct members of the group will be considered assigned. Security groups with dynamic memberships are supported. To grant an app role assignment to a group, you need three identifiers: Additional licenses might be required to use a group to manage access to applications.

INSERT INTO entra_id.groups.app_role_assignments (
id,
deletedDateTime,
appRoleId,
createdDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId,
group_id
)
SELECT 
'{{ id }}',
'{{ deletedDateTime }}',
'{{ appRoleId }}',
'{{ createdDateTime }}',
'{{ principalDisplayName }}',
'{{ principalId }}',
'{{ principalType }}',
'{{ resourceDisplayName }}',
'{{ resourceId }}',
'{{ group_id }}'
RETURNING
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId
;

UPDATE examples​

No description available.

UPDATE entra_id.groups.app_role_assignments
SET 
id = '{{ id }}',
deletedDateTime = '{{ deletedDateTime }}',
appRoleId = '{{ appRoleId }}',
createdDateTime = '{{ createdDateTime }}',
principalDisplayName = '{{ principalDisplayName }}',
principalId = '{{ principalId }}',
principalType = '{{ principalType }}',
resourceDisplayName = '{{ resourceDisplayName }}',
resourceId = '{{ resourceId }}'
WHERE 
group_id = '{{ group_id }}' --required
AND app_role_assignment_id = '{{ app_role_assignment_id }}' --required
RETURNING
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId;

DELETE examples​

Deletes an appRoleAssignment that a group has been granted.

DELETE FROM entra_id.groups.app_role_assignments
WHERE group_id = '{{ group_id }}' --required
AND app_role_assignment_id = '{{ app_role_assignment_id }}' --required
AND If-Match = '{{ If-Match }}'
;