app_role_assignments

Creates, updates, deletes, gets or lists an app_role_assignments resource.

Overview

Name	app_role_assignments
Type	Resource
Id	entra_id.service_principals.app_role_assignments

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
appRoleId	string (uuid)	The identifier (id) for the app role that's assigned to the principal. This app role must be exposed in the appRoles property on the resource application's service principal (resourceId). If the resource application hasn't declared any app roles, a default app role ID of 00000000-0000-0000-0000-000000000000 can be specified to signal that the principal is assigned to the resource app without any specific app roles. Required on create. (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)
createdDateTime	string (date-time)	The time when the app role assignment was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
deletedDateTime	string (date-time)	Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
principalDisplayName	string	The display name of the user, group, or service principal that was granted the app role assignment. Maximum length is 256 characters. Read-only. Supports $filter (eq and startswith).
principalId	string (uuid)	The unique identifier (id) for the user, security group, or service principal being granted the app role. Security groups with dynamic memberships are supported. Required on create. (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)
principalType	string	The type of the assigned principal. This can either be User, Group, or ServicePrincipal. Read-only.
resourceDisplayName	string	The display name of the resource app's service principal to which the assignment is made. Maximum length is 256 characters.
resourceId	string (uuid)	The unique identifier (id) for the resource service principal for which the assignment is made. Required on create. Supports $filter (eq only). (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
appRoleId	string (uuid)	The identifier (id) for the app role that's assigned to the principal. This app role must be exposed in the appRoles property on the resource application's service principal (resourceId). If the resource application hasn't declared any app roles, a default app role ID of 00000000-0000-0000-0000-000000000000 can be specified to signal that the principal is assigned to the resource app without any specific app roles. Required on create. (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)
createdDateTime	string (date-time)	The time when the app role assignment was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
deletedDateTime	string (date-time)	Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
principalDisplayName	string	The display name of the user, group, or service principal that was granted the app role assignment. Maximum length is 256 characters. Read-only. Supports $filter (eq and startswith).
principalId	string (uuid)	The unique identifier (id) for the user, security group, or service principal being granted the app role. Security groups with dynamic memberships are supported. Required on create. (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)
principalType	string	The type of the assigned principal. This can either be User, Group, or ServicePrincipal. Read-only.
resourceDisplayName	string	The display name of the resource app's service principal to which the assignment is made. Maximum length is 256 characters.
resourceId	string (uuid)	The unique identifier (id) for the resource service principal for which the assignment is made. Required on create. Supports $filter (eq only). (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	service_principal_id, app_role_assignment_id		Read the properties and relationships of an appRoleAssignment object.
list	select	service_principal_id	ConsistencyLevel	Read the properties and relationships of an appRoleAssignment object.
insert	insert	service_principal_id		Assign an app role to a client service principal. App roles that are assigned to service principals are also known as application permissions. Application permissions can be granted directly with app role assignments, or through a consent experience. To grant an app role assignment to a client service principal, you need three identifiers:
update	update	service_principal_id, app_role_assignment_id
delete	delete	service_principal_id, app_role_assignment_id	If-Match	Deletes an appRoleAssignment that a service principal has been granted. App roles which are assigned to service principals are also known as application permissions. Deleting an app role assignment for a service principal is equivalent to revoking the app-only permission grant.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
app_role_assignment_id	string	The unique identifier of appRoleAssignment
service_principal_id	string	The unique identifier of servicePrincipal
ConsistencyLevel	string	Indicates the requested consistency level. Documentation URL: https://docs.microsoft.com/graph/aad-advanced-queries
If-Match	string	ETag

SELECT examples

get

Read the properties and relationships of an appRoleAssignment object.

SELECT
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId
FROM entra_id.service_principals.app_role_assignments
WHERE service_principal_id = '{{ service_principal_id }}' -- required
AND app_role_assignment_id = '{{ app_role_assignment_id }}' -- required
;

list

Read the properties and relationships of an appRoleAssignment object.

SELECT
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId
FROM entra_id.service_principals.app_role_assignments
WHERE service_principal_id = '{{ service_principal_id }}' -- required
AND ConsistencyLevel = '{{ ConsistencyLevel }}'
;

INSERT examples

insert

Assign an app role to a client service principal. App roles that are assigned to service principals are also known as application permissions. Application permissions can be granted directly with app role assignments, or through a consent experience. To grant an app role assignment to a client service principal, you need three identifiers:

INSERT INTO entra_id.service_principals.app_role_assignments (
id,
deletedDateTime,
appRoleId,
createdDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId,
service_principal_id
)
SELECT 
'{{ id }}',
'{{ deletedDateTime }}',
'{{ appRoleId }}',
'{{ createdDateTime }}',
'{{ principalDisplayName }}',
'{{ principalId }}',
'{{ principalType }}',
'{{ resourceDisplayName }}',
'{{ resourceId }}',
'{{ service_principal_id }}'
RETURNING
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId
;

Manifest

# Description fields are for documentation purposes
- name: app_role_assignments
props:
  - name: service_principal_id
    value: "{{ service_principal_id }}"
    description: Required parameter for the app_role_assignments resource.
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: deletedDateTime
    value: "{{ deletedDateTime }}"
    description: |
      Date and time when this object was deleted. Always null when the object hasn't been deleted.
  - name: appRoleId
    value: "{{ appRoleId }}"
    description: |
      The identifier (id) for the app role that's assigned to the principal. This app role must be exposed in the appRoles property on the resource application's service principal (resourceId). If the resource application hasn't declared any app roles, a default app role ID of 00000000-0000-0000-0000-000000000000 can be specified to signal that the principal is assigned to the resource app without any specific app roles. Required on create.
  - name: createdDateTime
    value: "{{ createdDateTime }}"
    description: |
      The time when the app role assignment was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.
  - name: principalDisplayName
    value: "{{ principalDisplayName }}"
    description: |
      The display name of the user, group, or service principal that was granted the app role assignment. Maximum length is 256 characters. Read-only. Supports $filter (eq and startswith).
  - name: principalId
    value: "{{ principalId }}"
    description: |
      The unique identifier (id) for the user, security group, or service principal being granted the app role. Security groups with dynamic memberships are supported. Required on create.
  - name: principalType
    value: "{{ principalType }}"
    description: |
      The type of the assigned principal. This can either be User, Group, or ServicePrincipal. Read-only.
  - name: resourceDisplayName
    value: "{{ resourceDisplayName }}"
    description: |
      The display name of the resource app's service principal to which the assignment is made. Maximum length is 256 characters.
  - name: resourceId
    value: "{{ resourceId }}"
    description: |
      The unique identifier (id) for the resource service principal for which the assignment is made. Required on create. Supports $filter (eq only).

UPDATE examples

update

No description available.

UPDATE entra_id.service_principals.app_role_assignments
SET 
id = '{{ id }}',
deletedDateTime = '{{ deletedDateTime }}',
appRoleId = '{{ appRoleId }}',
createdDateTime = '{{ createdDateTime }}',
principalDisplayName = '{{ principalDisplayName }}',
principalId = '{{ principalId }}',
principalType = '{{ principalType }}',
resourceDisplayName = '{{ resourceDisplayName }}',
resourceId = '{{ resourceId }}'
WHERE 
service_principal_id = '{{ service_principal_id }}' --required
AND app_role_assignment_id = '{{ app_role_assignment_id }}' --required
RETURNING
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId;

DELETE examples

delete

Deletes an appRoleAssignment that a service principal has been granted. App roles which are assigned to service principals are also known as application permissions. Deleting an app role assignment for a service principal is equivalent to revoking the app-only permission grant.

DELETE FROM entra_id.service_principals.app_role_assignments
WHERE service_principal_id = '{{ service_principal_id }}' --required
AND app_role_assignment_id = '{{ app_role_assignment_id }}' --required
AND If-Match = '{{ If-Match }}'
;