Skip to main content

app_role_assigned_to

Creates, updates, deletes, gets or lists an app_role_assigned_to resource.

Overview​

Nameapp_role_assigned_to
TypeResource
Identra_id.service_principals.app_role_assigned_to

Fields​

The following fields are returned by SELECT queries:

Retrieved navigation property

NameDatatypeDescription
idstringThe unique identifier for an entity. Read-only.
appRoleIdstring (uuid)The identifier (id) for the app role that's assigned to the principal. This app role must be exposed in the appRoles property on the resource application's service principal (resourceId). If the resource application hasn't declared any app roles, a default app role ID of 00000000-0000-0000-0000-000000000000 can be specified to signal that the principal is assigned to the resource app without any specific app roles. Required on create. (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)
createdDateTimestring (date-time)The time when the app role assignment was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
deletedDateTimestring (date-time)Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
principalDisplayNamestringThe display name of the user, group, or service principal that was granted the app role assignment. Maximum length is 256 characters. Read-only. Supports $filter (eq and startswith).
principalIdstring (uuid)The unique identifier (id) for the user, security group, or service principal being granted the app role. Security groups with dynamic memberships are supported. Required on create. (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)
principalTypestringThe type of the assigned principal. This can either be User, Group, or ServicePrincipal. Read-only.
resourceDisplayNamestringThe display name of the resource app's service principal to which the assignment is made. Maximum length is 256 characters.
resourceIdstring (uuid)The unique identifier (id) for the resource service principal for which the assignment is made. Required on create. Supports $filter (eq only). (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
getselectservice_principal_id, app_role_assignment_idRead the properties and relationships of an appRoleAssignment object.
listselectservice_principal_idRead the properties and relationships of an appRoleAssignment object.
insertinsertservice_principal_idAssign an app role for a resource service principal, to a user, group, or client service principal. App roles that are assigned to service principals are also known as application permissions. Application permissions can be granted directly with app role assignments, or through a consent experience. To grant an app role assignment, you need three identifiers:
updateupdateservice_principal_id, app_role_assignment_id
deletedeleteservice_principal_id, app_role_assignment_idIf-MatchDeletes an appRoleAssignment that a user, group, or client service principal has been granted for a resource service principal.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
app_role_assignment_idstringThe unique identifier of appRoleAssignment
service_principal_idstringThe unique identifier of servicePrincipal
If-MatchstringETag

SELECT examples​

Read the properties and relationships of an appRoleAssignment object.

SELECT
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId
FROM entra_id.service_principals.app_role_assigned_to
WHERE service_principal_id = '{{ service_principal_id }}' -- required
AND app_role_assignment_id = '{{ app_role_assignment_id }}' -- required
;

INSERT examples​

Assign an app role for a resource service principal, to a user, group, or client service principal. App roles that are assigned to service principals are also known as application permissions. Application permissions can be granted directly with app role assignments, or through a consent experience. To grant an app role assignment, you need three identifiers:

INSERT INTO entra_id.service_principals.app_role_assigned_to (
id,
deletedDateTime,
appRoleId,
createdDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId,
service_principal_id
)
SELECT 
'{{ id }}',
'{{ deletedDateTime }}',
'{{ appRoleId }}',
'{{ createdDateTime }}',
'{{ principalDisplayName }}',
'{{ principalId }}',
'{{ principalType }}',
'{{ resourceDisplayName }}',
'{{ resourceId }}',
'{{ service_principal_id }}'
RETURNING
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId
;

UPDATE examples​

No description available.

UPDATE entra_id.service_principals.app_role_assigned_to
SET 
id = '{{ id }}',
deletedDateTime = '{{ deletedDateTime }}',
appRoleId = '{{ appRoleId }}',
createdDateTime = '{{ createdDateTime }}',
principalDisplayName = '{{ principalDisplayName }}',
principalId = '{{ principalId }}',
principalType = '{{ principalType }}',
resourceDisplayName = '{{ resourceDisplayName }}',
resourceId = '{{ resourceId }}'
WHERE 
service_principal_id = '{{ service_principal_id }}' --required
AND app_role_assignment_id = '{{ app_role_assignment_id }}' --required
RETURNING
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId;

DELETE examples​

Deletes an appRoleAssignment that a user, group, or client service principal has been granted for a resource service principal.

DELETE FROM entra_id.service_principals.app_role_assigned_to
WHERE service_principal_id = '{{ service_principal_id }}' --required
AND app_role_assignment_id = '{{ app_role_assignment_id }}' --required
AND If-Match = '{{ If-Match }}'
;