role_management_policy_assignments

Creates, updates, deletes, gets or lists a role_management_policy_assignments resource.

Overview

Name	role_management_policy_assignments
Type	Resource
Id	entra_id.policies.role_management_policy_assignments

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
policy		The policy that's associated with a policy assignment. Supports $expand and a nested $expand of the rules and effectiveRules relationships for the policy.
policyId	string	The id of the policy. Inherited from entity.
roleDefinitionId	string	For Microsoft Entra roles policy, it's the identifier of the role definition object where the policy applies. For PIM for Groups membership and ownership, it's either member or owner. Supports $filter (eq).
scopeId	string	The identifier of the scope where the policy is assigned. Can be / for the tenant or a group ID. Required.
scopeType	string	The type of the scope where the policy is assigned. One of Directory, DirectoryRole, Group. Required.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
policy		The policy that's associated with a policy assignment. Supports $expand and a nested $expand of the rules and effectiveRules relationships for the policy.
policyId	string	The id of the policy. Inherited from entity.
roleDefinitionId	string	For Microsoft Entra roles policy, it's the identifier of the role definition object where the policy applies. For PIM for Groups membership and ownership, it's either member or owner. Supports $filter (eq).
scopeId	string	The identifier of the scope where the policy is assigned. Can be / for the tenant or a group ID. Required.
scopeType	string	The type of the scope where the policy is assigned. One of Directory, DirectoryRole, Group. Required.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	unified_role_management_policy_assignment_id		Get the details of a policy assignment in PIM that's assigned to Microsoft Entra roles or group membership or ownership.
list	select			Get the details of all role management policy assignments made in PIM for Microsoft Entra roles and PIM for Groups.
insert	insert
update	update	unified_role_management_policy_assignment_id
delete	delete	unified_role_management_policy_assignment_id	If-Match

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
unified_role_management_policy_assignment_id	string	The unique identifier of unifiedRoleManagementPolicyAssignment
If-Match	string	ETag

SELECT examples

get

Get the details of a policy assignment in PIM that's assigned to Microsoft Entra roles or group membership or ownership.

SELECT
id,
policy,
policyId,
roleDefinitionId,
scopeId,
scopeType
FROM entra_id.policies.role_management_policy_assignments
WHERE unified_role_management_policy_assignment_id = '{{ unified_role_management_policy_assignment_id }}' -- required
;

list

Get the details of all role management policy assignments made in PIM for Microsoft Entra roles and PIM for Groups.

SELECT
id,
policy,
policyId,
roleDefinitionId,
scopeId,
scopeType
FROM entra_id.policies.role_management_policy_assignments
;

INSERT examples

insert

No description available.

INSERT INTO entra_id.policies.role_management_policy_assignments (
id,
policyId,
roleDefinitionId,
scopeId,
scopeType,
policy
)
SELECT 
'{{ id }}',
'{{ policyId }}',
'{{ roleDefinitionId }}',
'{{ scopeId }}',
'{{ scopeType }}',
'{{ policy }}'
RETURNING
id,
policy,
policyId,
roleDefinitionId,
scopeId,
scopeType
;

Manifest

# Description fields are for documentation purposes
- name: role_management_policy_assignments
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: policyId
    value: "{{ policyId }}"
    description: |
      The id of the policy. Inherited from entity.
  - name: roleDefinitionId
    value: "{{ roleDefinitionId }}"
    description: |
      For Microsoft Entra roles policy, it's the identifier of the role definition object where the policy applies. For PIM for Groups membership and ownership, it's either member or owner. Supports $filter (eq).
  - name: scopeId
    value: "{{ scopeId }}"
    description: |
      The identifier of the scope where the policy is assigned. Can be / for the tenant or a group ID. Required.
  - name: scopeType
    value: "{{ scopeType }}"
    description: |
      The type of the scope where the policy is assigned. One of Directory, DirectoryRole, Group. Required.
  - name: policy
    value: "{{ policy }}"
    description: |
      The policy that's associated with a policy assignment. Supports $expand and a nested $expand of the rules and effectiveRules relationships for the policy.

UPDATE examples

update

No description available.

UPDATE entra_id.policies.role_management_policy_assignments
SET 
id = '{{ id }}',
policyId = '{{ policyId }}',
roleDefinitionId = '{{ roleDefinitionId }}',
scopeId = '{{ scopeId }}',
scopeType = '{{ scopeType }}',
policy = '{{ policy }}'
WHERE 
unified_role_management_policy_assignment_id = '{{ unified_role_management_policy_assignment_id }}' --required
RETURNING
id,
policy,
policyId,
roleDefinitionId,
scopeId,
scopeType;

DELETE examples

delete

No description available.

DELETE FROM entra_id.policies.role_management_policy_assignments
WHERE unified_role_management_policy_assignment_id = '{{ unified_role_management_policy_assignment_id }}' --required
AND If-Match = '{{ If-Match }}'
;