directory_role_definitions

Creates, updates, deletes, gets or lists a directory_role_definitions resource.

Overview

Name	directory_role_definitions
Type	Resource
Id	entra_id.role_management.directory_role_definitions

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
description	string	The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true.
displayName	string	The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required. Supports $filter (eq, in).
inheritsPermissionsFrom	array	Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand.
isBuiltIn	boolean	Flag indicating whether the role definition is part of the default set included in Microsoft Entra or a custom definition. Read-only. Supports $filter (eq, in).
isEnabled	boolean	Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true.
resourceScopes	array	List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment.
rolePermissions	array	List of permissions included in the role. Read-only when isBuiltIn is true. Required.
templateId	string	Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories.
version	string	Indicates version of the role definition. Read-only when isBuiltIn is true.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
description	string	The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true.
displayName	string	The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required. Supports $filter (eq, in).
inheritsPermissionsFrom	array	Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand.
isBuiltIn	boolean	Flag indicating whether the role definition is part of the default set included in Microsoft Entra or a custom definition. Read-only. Supports $filter (eq, in).
isEnabled	boolean	Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true.
resourceScopes	array	List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment.
rolePermissions	array	List of permissions included in the role. Read-only when isBuiltIn is true. Required.
templateId	string	Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories.
version	string	Indicates version of the role definition. Read-only when isBuiltIn is true.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	unified_role_definition_id		Read the properties and relationships of a unifiedRoleDefinition object. The following role-based access control (RBAC) providers are currently supported:
list	select			Get a list of unifiedRoleDefinition objects for the provider. The following RBAC providers are currently supported: - directory (Microsoft Entra ID) - entitlement management (Microsoft Entra Entitlement Management)
insert	insert			Create a new custom unifiedRoleDefinition object. This feature requires a Microsoft Entra ID P1 or P2 license.
update	update	unified_role_definition_id		Update the properties of a unifiedRoleDefinition object. You cannot update built-in roles. This feature requires a Microsoft Entra ID P1 or P2 license.
delete	delete	unified_role_definition_id	If-Match	Delete a unifiedRoleDefinition object. You can't delete built-in roles. This feature requires a Microsoft Entra ID P1 or P2 license.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
unified_role_definition_id	string	The unique identifier of unifiedRoleDefinition
If-Match	string	ETag

SELECT examples

get

Read the properties and relationships of a unifiedRoleDefinition object. The following role-based access control (RBAC) providers are currently supported:

SELECT
id,
description,
displayName,
inheritsPermissionsFrom,
isBuiltIn,
isEnabled,
resourceScopes,
rolePermissions,
templateId,
version
FROM entra_id.role_management.directory_role_definitions
WHERE unified_role_definition_id = '{{ unified_role_definition_id }}' -- required
;

list

Get a list of unifiedRoleDefinition objects for the provider. The following RBAC providers are currently supported:
- directory (Microsoft Entra ID)
- entitlement management (Microsoft Entra Entitlement Management)

SELECT
id,
description,
displayName,
inheritsPermissionsFrom,
isBuiltIn,
isEnabled,
resourceScopes,
rolePermissions,
templateId,
version
FROM entra_id.role_management.directory_role_definitions
;

INSERT examples

insert

Create a new custom unifiedRoleDefinition object. This feature requires a Microsoft Entra ID P1 or P2 license.

INSERT INTO entra_id.role_management.directory_role_definitions (
id,
description,
displayName,
isBuiltIn,
isEnabled,
resourceScopes,
rolePermissions,
templateId,
version,
inheritsPermissionsFrom
)
SELECT 
'{{ id }}',
'{{ description }}',
'{{ displayName }}',
{{ isBuiltIn }},
{{ isEnabled }},
'{{ resourceScopes }}',
'{{ rolePermissions }}',
'{{ templateId }}',
'{{ version }}',
'{{ inheritsPermissionsFrom }}'
RETURNING
id,
description,
displayName,
inheritsPermissionsFrom,
isBuiltIn,
isEnabled,
resourceScopes,
rolePermissions,
templateId,
version
;

Manifest

# Description fields are for documentation purposes
- name: directory_role_definitions
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: description
    value: "{{ description }}"
    description: |
      The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true.
  - name: displayName
    value: "{{ displayName }}"
    description: |
      The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required.  Supports $filter (eq, in).
  - name: isBuiltIn
    value: {{ isBuiltIn }}
    description: |
      Flag indicating whether the role definition is part of the default set included in Microsoft Entra or a custom definition. Read-only. Supports $filter (eq, in).
  - name: isEnabled
    value: {{ isEnabled }}
    description: |
      Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true.
  - name: resourceScopes
    value:
      - "{{ resourceScopes }}"
    description: |
      List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment.
  - name: rolePermissions
    description: |
      List of permissions included in the role. Read-only when isBuiltIn is true. Required.
    value:
      - allowedResourceActions: "{{ allowedResourceActions }}"
        condition: "{{ condition }}"
        excludedResourceActions: "{{ excludedResourceActions }}"
  - name: templateId
    value: "{{ templateId }}"
    description: |
      Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories.
  - name: version
    value: "{{ version }}"
    description: |
      Indicates version of the role definition. Read-only when isBuiltIn is true.
  - name: inheritsPermissionsFrom
    description: |
      Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand.
    value:
      - id: "{{ id }}"
        description: "{{ description }}"
        displayName: "{{ displayName }}"
        isBuiltIn: {{ isBuiltIn }}
        isEnabled: {{ isEnabled }}
        resourceScopes: "{{ resourceScopes }}"
        rolePermissions: "{{ rolePermissions }}"
        templateId: "{{ templateId }}"
        version: "{{ version }}"
        inheritsPermissionsFrom: "{{ inheritsPermissionsFrom }}"

UPDATE examples

update

Update the properties of a unifiedRoleDefinition object. You cannot update built-in roles. This feature requires a Microsoft Entra ID P1 or P2 license.

UPDATE entra_id.role_management.directory_role_definitions
SET 
id = '{{ id }}',
description = '{{ description }}',
displayName = '{{ displayName }}',
isBuiltIn = {{ isBuiltIn }},
isEnabled = {{ isEnabled }},
resourceScopes = '{{ resourceScopes }}',
rolePermissions = '{{ rolePermissions }}',
templateId = '{{ templateId }}',
version = '{{ version }}',
inheritsPermissionsFrom = '{{ inheritsPermissionsFrom }}'
WHERE 
unified_role_definition_id = '{{ unified_role_definition_id }}' --required
RETURNING
id,
description,
displayName,
inheritsPermissionsFrom,
isBuiltIn,
isEnabled,
resourceScopes,
rolePermissions,
templateId,
version;

DELETE examples

delete

Delete a unifiedRoleDefinition object. You can't delete built-in roles. This feature requires a Microsoft Entra ID P1 or P2 license.

DELETE FROM entra_id.role_management.directory_role_definitions
WHERE unified_role_definition_id = '{{ unified_role_definition_id }}' --required
AND If-Match = '{{ If-Match }}'
;