Skip to main content

app_role_assignments

Creates, updates, deletes, gets or lists an app_role_assignments resource.

Overview​

Nameapp_role_assignments
TypeResource
Identra_id.users.app_role_assignments

Fields​

The following fields are returned by SELECT queries:

Retrieved navigation property

NameDatatypeDescription
idstringThe unique identifier for an entity. Read-only.
appRoleIdstring (uuid)The identifier (id) for the app role that's assigned to the principal. This app role must be exposed in the appRoles property on the resource application's service principal (resourceId). If the resource application hasn't declared any app roles, a default app role ID of 00000000-0000-0000-0000-000000000000 can be specified to signal that the principal is assigned to the resource app without any specific app roles. Required on create. (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)
createdDateTimestring (date-time)The time when the app role assignment was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
deletedDateTimestring (date-time)Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
principalDisplayNamestringThe display name of the user, group, or service principal that was granted the app role assignment. Maximum length is 256 characters. Read-only. Supports $filter (eq and startswith).
principalIdstring (uuid)The unique identifier (id) for the user, security group, or service principal being granted the app role. Security groups with dynamic memberships are supported. Required on create. (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)
principalTypestringThe type of the assigned principal. This can either be User, Group, or ServicePrincipal. Read-only.
resourceDisplayNamestringThe display name of the resource app's service principal to which the assignment is made. Maximum length is 256 characters.
resourceIdstring (uuid)The unique identifier (id) for the resource service principal for which the assignment is made. Required on create. Supports $filter (eq only). (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
getselectuser_id, app_role_assignment_idConsistencyLevelRepresents the app roles a user is granted for an application. Supports $expand.
listselectuser_idConsistencyLevelRetrieve the list of appRoleAssignments granted to an agentUser.
insertinsertuser_idGrant an app role assignment to an agentUser.
updateupdateuser_id, app_role_assignment_id
deletedeleteuser_id, app_role_assignment_idIf-MatchDelete an appRoleAssignment that has been granted to a user.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
app_role_assignment_idstringThe unique identifier of appRoleAssignment
user_idstringThe unique identifier of user
ConsistencyLevelstringIndicates the requested consistency level. Documentation URL: https://docs.microsoft.com/graph/aad-advanced-queries
If-MatchstringETag

SELECT examples​

Represents the app roles a user is granted for an application. Supports $expand.

SELECT
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId
FROM entra_id.users.app_role_assignments
WHERE user_id = '{{ user_id }}' -- required
AND app_role_assignment_id = '{{ app_role_assignment_id }}' -- required
AND ConsistencyLevel = '{{ ConsistencyLevel }}'
;

INSERT examples​

Grant an app role assignment to an agentUser.

INSERT INTO entra_id.users.app_role_assignments (
id,
deletedDateTime,
appRoleId,
createdDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId,
user_id
)
SELECT 
'{{ id }}',
'{{ deletedDateTime }}',
'{{ appRoleId }}',
'{{ createdDateTime }}',
'{{ principalDisplayName }}',
'{{ principalId }}',
'{{ principalType }}',
'{{ resourceDisplayName }}',
'{{ resourceId }}',
'{{ user_id }}'
RETURNING
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId
;

UPDATE examples​

No description available.

UPDATE entra_id.users.app_role_assignments
SET 
id = '{{ id }}',
deletedDateTime = '{{ deletedDateTime }}',
appRoleId = '{{ appRoleId }}',
createdDateTime = '{{ createdDateTime }}',
principalDisplayName = '{{ principalDisplayName }}',
principalId = '{{ principalId }}',
principalType = '{{ principalType }}',
resourceDisplayName = '{{ resourceDisplayName }}',
resourceId = '{{ resourceId }}'
WHERE 
user_id = '{{ user_id }}' --required
AND app_role_assignment_id = '{{ app_role_assignment_id }}' --required
RETURNING
id,
appRoleId,
createdDateTime,
deletedDateTime,
principalDisplayName,
principalId,
principalType,
resourceDisplayName,
resourceId;

DELETE examples​

Delete an appRoleAssignment that has been granted to a user.

DELETE FROM entra_id.users.app_role_assignments
WHERE user_id = '{{ user_id }}' --required
AND app_role_assignment_id = '{{ app_role_assignment_id }}' --required
AND If-Match = '{{ If-Match }}'
;