directory_role_assignments

Creates, updates, deletes, gets or lists a directory_role_assignments resource.

Overview

Name	directory_role_assignments
Type	Resource
Id	entra_id.role_management.directory_role_assignments

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
appScope		Read-only property with details of the app specific scope when the assignment scope is app specific. Containment entity. Supports $expand for the entitlement provider only.
appScopeId	string	Identifier of the app specific scope when the assignment scope is app specific. The scope of an assignment determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by a resource application only. For the entitlement management provider, use this property to specify a catalog. For example, /AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997. Supports $filter (eq, in). For example, /roleManagement/entitlementManagement/roleAssignments?$filter=appScopeId eq '/AccessPackageCatalog/{catalog id}'.
condition	string
directoryScope		The directory object that is the scope of the assignment. Read-only. Supports $expand for the directory provider.
directoryScopeId	string	Identifier of the directory object representing the scope of the assignment. The scope of an assignment determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications, unlike app scopes that are defined and understood by a resource application only. Supports $filter (eq, in).
principal		Referencing the assigned principal. Read-only. Supports $expand except for the Exchange provider.
principalId	string	Identifier of the principal to which the assignment is granted. Supported principals are users, role-assignable groups, and service principals. Supports $filter (eq, in).
roleDefinition		The roleDefinition the assignment is for. Supports $expand.
roleDefinitionId	string	Identifier of the unifiedRoleDefinition the assignment is for. Read-only. Supports $filter (eq, in).

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
appScope		Read-only property with details of the app specific scope when the assignment scope is app specific. Containment entity. Supports $expand for the entitlement provider only.
appScopeId	string	Identifier of the app specific scope when the assignment scope is app specific. The scope of an assignment determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by a resource application only. For the entitlement management provider, use this property to specify a catalog. For example, /AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997. Supports $filter (eq, in). For example, /roleManagement/entitlementManagement/roleAssignments?$filter=appScopeId eq '/AccessPackageCatalog/{catalog id}'.
condition	string
directoryScope		The directory object that is the scope of the assignment. Read-only. Supports $expand for the directory provider.
directoryScopeId	string	Identifier of the directory object representing the scope of the assignment. The scope of an assignment determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications, unlike app scopes that are defined and understood by a resource application only. Supports $filter (eq, in).
principal		Referencing the assigned principal. Read-only. Supports $expand except for the Exchange provider.
principalId	string	Identifier of the principal to which the assignment is granted. Supported principals are users, role-assignable groups, and service principals. Supports $filter (eq, in).
roleDefinition		The roleDefinition the assignment is for. Supports $expand.
roleDefinitionId	string	Identifier of the unifiedRoleDefinition the assignment is for. Read-only. Supports $filter (eq, in).

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	unified_role_assignment_id		Retrieve the properties and relationships of a unifiedRoleAssignment object.
list	select			Get a list of unifiedRoleAssignment objects for the RBAC provider. The following RBAC providers are currently supported: - directory (Microsoft Entra ID) - entitlement management (Microsoft Entra entitlement management)
insert	insert			Create a new unifiedRoleAssignment object.
update	update	unified_role_assignment_id
delete	delete	unified_role_assignment_id	If-Match	Delete a unifiedRoleAssignment object.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
unified_role_assignment_id	string	The unique identifier of unifiedRoleAssignment
If-Match	string	ETag

SELECT examples

get

Retrieve the properties and relationships of a unifiedRoleAssignment object.

SELECT
id,
appScope,
appScopeId,
condition,
directoryScope,
directoryScopeId,
principal,
principalId,
roleDefinition,
roleDefinitionId
FROM entra_id.role_management.directory_role_assignments
WHERE unified_role_assignment_id = '{{ unified_role_assignment_id }}' -- required
;

list

Get a list of unifiedRoleAssignment objects for the RBAC provider. The following RBAC providers are currently supported:
- directory (Microsoft Entra ID)
- entitlement management (Microsoft Entra entitlement management)

SELECT
id,
appScope,
appScopeId,
condition,
directoryScope,
directoryScopeId,
principal,
principalId,
roleDefinition,
roleDefinitionId
FROM entra_id.role_management.directory_role_assignments
;

INSERT examples

insert

Create a new unifiedRoleAssignment object.

INSERT INTO entra_id.role_management.directory_role_assignments (
id,
appScopeId,
condition,
directoryScopeId,
principalId,
roleDefinitionId,
appScope,
directoryScope,
principal,
roleDefinition
)
SELECT 
'{{ id }}',
'{{ appScopeId }}',
'{{ condition }}',
'{{ directoryScopeId }}',
'{{ principalId }}',
'{{ roleDefinitionId }}',
'{{ appScope }}',
'{{ directoryScope }}',
'{{ principal }}',
'{{ roleDefinition }}'
RETURNING
id,
appScope,
appScopeId,
condition,
directoryScope,
directoryScopeId,
principal,
principalId,
roleDefinition,
roleDefinitionId
;

Manifest

# Description fields are for documentation purposes
- name: directory_role_assignments
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: appScopeId
    value: "{{ appScopeId }}"
    description: |
      Identifier of the app specific scope when the assignment scope is app specific. The scope of an assignment determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by a resource application only. For the entitlement management provider, use this property to specify a catalog. For example, /AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997. Supports $filter (eq, in). For example, /roleManagement/entitlementManagement/roleAssignments?$filter=appScopeId eq '/AccessPackageCatalog/{catalog id}'.
  - name: condition
    value: "{{ condition }}"
  - name: directoryScopeId
    value: "{{ directoryScopeId }}"
    description: |
      Identifier of the directory object representing the scope of the assignment. The scope of an assignment determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications, unlike app scopes that are defined and understood by a resource application only. Supports $filter (eq, in).
  - name: principalId
    value: "{{ principalId }}"
    description: |
      Identifier of the principal to which the assignment is granted. Supported principals are users, role-assignable groups, and service principals. Supports $filter (eq, in).
  - name: roleDefinitionId
    value: "{{ roleDefinitionId }}"
    description: |
      Identifier of the unifiedRoleDefinition the assignment is for. Read-only. Supports $filter (eq, in).
  - name: appScope
    value: "{{ appScope }}"
    description: |
      Read-only property with details of the app specific scope when the assignment scope is app specific. Containment entity. Supports $expand for the entitlement provider only.
  - name: directoryScope
    value: "{{ directoryScope }}"
    description: |
      The directory object that is the scope of the assignment. Read-only. Supports $expand for the directory provider.
  - name: principal
    value: "{{ principal }}"
    description: |
      Referencing the assigned principal. Read-only. Supports $expand except for the Exchange provider.
  - name: roleDefinition
    value: "{{ roleDefinition }}"
    description: |
      The roleDefinition the assignment is for. Supports $expand.

UPDATE examples

update

No description available.

UPDATE entra_id.role_management.directory_role_assignments
SET 
id = '{{ id }}',
appScopeId = '{{ appScopeId }}',
condition = '{{ condition }}',
directoryScopeId = '{{ directoryScopeId }}',
principalId = '{{ principalId }}',
roleDefinitionId = '{{ roleDefinitionId }}',
appScope = '{{ appScope }}',
directoryScope = '{{ directoryScope }}',
principal = '{{ principal }}',
roleDefinition = '{{ roleDefinition }}'
WHERE 
unified_role_assignment_id = '{{ unified_role_assignment_id }}' --required
RETURNING
id,
appScope,
appScopeId,
condition,
directoryScope,
directoryScopeId,
principal,
principalId,
roleDefinition,
roleDefinitionId;

DELETE examples

delete

Delete a unifiedRoleAssignment object.

DELETE FROM entra_id.role_management.directory_role_assignments
WHERE unified_role_assignment_id = '{{ unified_role_assignment_id }}' --required
AND If-Match = '{{ If-Match }}'
;