entitlement_management_role_definitions_inherits_permissions_from

Creates, updates, deletes, gets or lists an entitlement_management_role_definitions_inherits_permissions_from resource.

Overview

Name	entitlement_management_role_definitions_inherits_permissions_from
Type	Resource
Id	entra_id.role_management.entitlement_management_role_definitions_inherits_permissions_from

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
description	string	The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true.
displayName	string	The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required. Supports $filter (eq, in).
inheritsPermissionsFrom	array	Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand.
isBuiltIn	boolean	Flag indicating whether the role definition is part of the default set included in Microsoft Entra or a custom definition. Read-only. Supports $filter (eq, in).
isEnabled	boolean	Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true.
resourceScopes	array	List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment.
rolePermissions	array	List of permissions included in the role. Read-only when isBuiltIn is true. Required.
templateId	string	Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories.
version	string	Indicates version of the role definition. Read-only when isBuiltIn is true.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
description	string	The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true.
displayName	string	The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required. Supports $filter (eq, in).
inheritsPermissionsFrom	array	Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand.
isBuiltIn	boolean	Flag indicating whether the role definition is part of the default set included in Microsoft Entra or a custom definition. Read-only. Supports $filter (eq, in).
isEnabled	boolean	Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true.
resourceScopes	array	List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment.
rolePermissions	array	List of permissions included in the role. Read-only when isBuiltIn is true. Required.
templateId	string	Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories.
version	string	Indicates version of the role definition. Read-only when isBuiltIn is true.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	unified_role_definition_id, unified_role_definition_id1		Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand.
list	select	unified_role_definition_id		Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand.
insert	insert	unified_role_definition_id
update	update	unified_role_definition_id, unified_role_definition_id1
delete	delete	unified_role_definition_id, unified_role_definition_id1	If-Match

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
unified_role_definition_id	string	The unique identifier of unifiedRoleDefinition
unified_role_definition_id1	string	The unique identifier of unifiedRoleDefinition
If-Match	string	ETag

SELECT examples

get

Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand.

SELECT
id,
description,
displayName,
inheritsPermissionsFrom,
isBuiltIn,
isEnabled,
resourceScopes,
rolePermissions,
templateId,
version
FROM entra_id.role_management.entitlement_management_role_definitions_inherits_permissions_from
WHERE unified_role_definition_id = '{{ unified_role_definition_id }}' -- required
AND unified_role_definition_id1 = '{{ unified_role_definition_id1 }}' -- required
;

list

Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand.

SELECT
id,
description,
displayName,
inheritsPermissionsFrom,
isBuiltIn,
isEnabled,
resourceScopes,
rolePermissions,
templateId,
version
FROM entra_id.role_management.entitlement_management_role_definitions_inherits_permissions_from
WHERE unified_role_definition_id = '{{ unified_role_definition_id }}' -- required
;

INSERT examples

insert

No description available.

INSERT INTO entra_id.role_management.entitlement_management_role_definitions_inherits_permissions_from (
id,
description,
displayName,
isBuiltIn,
isEnabled,
resourceScopes,
rolePermissions,
templateId,
version,
inheritsPermissionsFrom,
unified_role_definition_id
)
SELECT 
'{{ id }}',
'{{ description }}',
'{{ displayName }}',
{{ isBuiltIn }},
{{ isEnabled }},
'{{ resourceScopes }}',
'{{ rolePermissions }}',
'{{ templateId }}',
'{{ version }}',
'{{ inheritsPermissionsFrom }}',
'{{ unified_role_definition_id }}'
RETURNING
id,
description,
displayName,
inheritsPermissionsFrom,
isBuiltIn,
isEnabled,
resourceScopes,
rolePermissions,
templateId,
version
;

Manifest

# Description fields are for documentation purposes
- name: entitlement_management_role_definitions_inherits_permissions_from
props:
  - name: unified_role_definition_id
    value: "{{ unified_role_definition_id }}"
    description: Required parameter for the entitlement_management_role_definitions_inherits_permissions_from resource.
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: description
    value: "{{ description }}"
    description: |
      The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true.
  - name: displayName
    value: "{{ displayName }}"
    description: |
      The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required.  Supports $filter (eq, in).
  - name: isBuiltIn
    value: {{ isBuiltIn }}
    description: |
      Flag indicating whether the role definition is part of the default set included in Microsoft Entra or a custom definition. Read-only. Supports $filter (eq, in).
  - name: isEnabled
    value: {{ isEnabled }}
    description: |
      Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true.
  - name: resourceScopes
    value:
      - "{{ resourceScopes }}"
    description: |
      List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment.
  - name: rolePermissions
    description: |
      List of permissions included in the role. Read-only when isBuiltIn is true. Required.
    value:
      - allowedResourceActions: "{{ allowedResourceActions }}"
        condition: "{{ condition }}"
        excludedResourceActions: "{{ excludedResourceActions }}"
  - name: templateId
    value: "{{ templateId }}"
    description: |
      Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories.
  - name: version
    value: "{{ version }}"
    description: |
      Indicates version of the role definition. Read-only when isBuiltIn is true.
  - name: inheritsPermissionsFrom
    description: |
      Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand.
    value:
      - id: "{{ id }}"
        description: "{{ description }}"
        displayName: "{{ displayName }}"
        isBuiltIn: {{ isBuiltIn }}
        isEnabled: {{ isEnabled }}
        resourceScopes: "{{ resourceScopes }}"
        rolePermissions: "{{ rolePermissions }}"
        templateId: "{{ templateId }}"
        version: "{{ version }}"
        inheritsPermissionsFrom: "{{ inheritsPermissionsFrom }}"

UPDATE examples

update

No description available.

UPDATE entra_id.role_management.entitlement_management_role_definitions_inherits_permissions_from
SET 
id = '{{ id }}',
description = '{{ description }}',
displayName = '{{ displayName }}',
isBuiltIn = {{ isBuiltIn }},
isEnabled = {{ isEnabled }},
resourceScopes = '{{ resourceScopes }}',
rolePermissions = '{{ rolePermissions }}',
templateId = '{{ templateId }}',
version = '{{ version }}',
inheritsPermissionsFrom = '{{ inheritsPermissionsFrom }}'
WHERE 
unified_role_definition_id = '{{ unified_role_definition_id }}' --required
AND unified_role_definition_id1 = '{{ unified_role_definition_id1 }}' --required
RETURNING
id,
description,
displayName,
inheritsPermissionsFrom,
isBuiltIn,
isEnabled,
resourceScopes,
rolePermissions,
templateId,
version;

DELETE examples

delete

No description available.

DELETE FROM entra_id.role_management.entitlement_management_role_definitions_inherits_permissions_from
WHERE unified_role_definition_id = '{{ unified_role_definition_id }}' --required
AND unified_role_definition_id1 = '{{ unified_role_definition_id1 }}' --required
AND If-Match = '{{ If-Match }}'
;