role_management_policies

Creates, updates, deletes, gets or lists a role_management_policies resource.

Overview

Name	role_management_policies
Type	Resource
Id	entra_id.policies.role_management_policies

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
description	string	Description for the policy.
displayName	string	Display name for the policy.
effectiveRules	array	The list of effective rules like approval rules and expiration rules evaluated based on inherited referenced rules. For example, if there is a tenant-wide policy to enforce enabling an approval rule, the effective rule will be to enable approval even if the policy has a rule to disable approval. Supports $expand.
isOrganizationDefault	boolean	This can only be set to true for a single tenant-wide policy which will apply to all scopes and roles. Set the scopeId to / and scopeType to Directory. Supports $filter (eq, ne).
lastModifiedBy		The identity who last modified the role setting.
lastModifiedDateTime	string (date-time)	The time when the role setting was last modified. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
rules	array	The collection of rules like approval rules and expiration rules. Supports $expand.
scopeId	string	The identifier of the scope where the policy is created. Can be / for the tenant or a group ID. Required.
scopeType	string	The type of the scope where the policy is created. One of Directory, DirectoryRole, Group. Required.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
description	string	Description for the policy.
displayName	string	Display name for the policy.
effectiveRules	array	The list of effective rules like approval rules and expiration rules evaluated based on inherited referenced rules. For example, if there is a tenant-wide policy to enforce enabling an approval rule, the effective rule will be to enable approval even if the policy has a rule to disable approval. Supports $expand.
isOrganizationDefault	boolean	This can only be set to true for a single tenant-wide policy which will apply to all scopes and roles. Set the scopeId to / and scopeType to Directory. Supports $filter (eq, ne).
lastModifiedBy		The identity who last modified the role setting.
lastModifiedDateTime	string (date-time)	The time when the role setting was last modified. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
rules	array	The collection of rules like approval rules and expiration rules. Supports $expand.
scopeId	string	The identifier of the scope where the policy is created. Can be / for the tenant or a group ID. Required.
scopeType	string	The type of the scope where the policy is created. One of Directory, DirectoryRole, Group. Required.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	unified_role_management_policy_id		Retrieve the details of a role management policy.
list	select			Get the details of the policies in PIM that can be applied to Microsoft Entra roles or group membership or ownership. To retrieve policies that apply to Azure RBAC, use the Azure REST PIM API for role management policies.
insert	insert
update	update	unified_role_management_policy_id
delete	delete	unified_role_management_policy_id	If-Match

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
unified_role_management_policy_id	string	The unique identifier of unifiedRoleManagementPolicy
If-Match	string	ETag

SELECT examples

get

Retrieve the details of a role management policy.

SELECT
id,
description,
displayName,
effectiveRules,
isOrganizationDefault,
lastModifiedBy,
lastModifiedDateTime,
rules,
scopeId,
scopeType
FROM entra_id.policies.role_management_policies
WHERE unified_role_management_policy_id = '{{ unified_role_management_policy_id }}' -- required
;

list

Get the details of the policies in PIM that can be applied to Microsoft Entra roles or group membership or ownership. To retrieve policies that apply to Azure RBAC, use the Azure REST PIM API for role management policies.

SELECT
id,
description,
displayName,
effectiveRules,
isOrganizationDefault,
lastModifiedBy,
lastModifiedDateTime,
rules,
scopeId,
scopeType
FROM entra_id.policies.role_management_policies
;

INSERT examples

insert

No description available.

INSERT INTO entra_id.policies.role_management_policies (
id,
description,
displayName,
isOrganizationDefault,
lastModifiedBy,
lastModifiedDateTime,
scopeId,
scopeType,
effectiveRules,
rules
)
SELECT 
'{{ id }}',
'{{ description }}',
'{{ displayName }}',
{{ isOrganizationDefault }},
'{{ lastModifiedBy }}',
'{{ lastModifiedDateTime }}',
'{{ scopeId }}',
'{{ scopeType }}',
'{{ effectiveRules }}',
'{{ rules }}'
RETURNING
id,
description,
displayName,
effectiveRules,
isOrganizationDefault,
lastModifiedBy,
lastModifiedDateTime,
rules,
scopeId,
scopeType
;

Manifest

# Description fields are for documentation purposes
- name: role_management_policies
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: description
    value: "{{ description }}"
    description: |
      Description for the policy.
  - name: displayName
    value: "{{ displayName }}"
    description: |
      Display name for the policy.
  - name: isOrganizationDefault
    value: {{ isOrganizationDefault }}
    description: |
      This can only be set to true for a single tenant-wide policy which will apply to all scopes and roles. Set the scopeId to / and scopeType to Directory. Supports $filter (eq, ne).
  - name: lastModifiedBy
    value: "{{ lastModifiedBy }}"
    description: |
      The identity who last modified the role setting.
  - name: lastModifiedDateTime
    value: "{{ lastModifiedDateTime }}"
    description: |
      The time when the role setting was last modified.
  - name: scopeId
    value: "{{ scopeId }}"
    description: |
      The identifier of the scope where the policy is created. Can be / for the tenant or a group ID. Required.
  - name: scopeType
    value: "{{ scopeType }}"
    description: |
      The type of the scope where the policy is created. One of Directory, DirectoryRole, Group. Required.
  - name: effectiveRules
    description: |
      The list of effective rules like approval rules and expiration rules evaluated based on inherited referenced rules. For example, if there is a tenant-wide policy to enforce enabling an approval rule, the effective rule will be to enable approval even if the policy has a rule to disable approval. Supports $expand.
    value:
      - id: "{{ id }}"
        target: "{{ target }}"
  - name: rules
    description: |
      The collection of rules like approval rules and expiration rules. Supports $expand.
    value:
      - id: "{{ id }}"
        target: "{{ target }}"

UPDATE examples

update

No description available.

UPDATE entra_id.policies.role_management_policies
SET 
id = '{{ id }}',
description = '{{ description }}',
displayName = '{{ displayName }}',
isOrganizationDefault = {{ isOrganizationDefault }},
lastModifiedBy = '{{ lastModifiedBy }}',
lastModifiedDateTime = '{{ lastModifiedDateTime }}',
scopeId = '{{ scopeId }}',
scopeType = '{{ scopeType }}',
effectiveRules = '{{ effectiveRules }}',
rules = '{{ rules }}'
WHERE 
unified_role_management_policy_id = '{{ unified_role_management_policy_id }}' --required
RETURNING
id,
description,
displayName,
effectiveRules,
isOrganizationDefault,
lastModifiedBy,
lastModifiedDateTime,
rules,
scopeId,
scopeType;

DELETE examples

delete

No description available.

DELETE FROM entra_id.policies.role_management_policies
WHERE unified_role_management_policy_id = '{{ unified_role_management_policy_id }}' --required
AND If-Match = '{{ If-Match }}'
;