New-MgBetaRoleManagementDirectoryRoleDefinition

Module:

Microsoft.Graph.Beta.Identity.Governance Module

Create a new unifiedRoleDefinition object for an RBAC provider. This feature requires a Microsoft Entra ID P1 or P2 license. The following RBAC providers are currently supported:\r- Cloud PC\r- device management (Intune)\r- Defender (Microsoft Defender XDR)\r- directory (Microsoft Entra ID)

New-MgBetaRoleManagementDirectoryRoleDefinition
 [-ResponseHeadersVariable <string>]
 [-AdditionalProperties <hashtable>]
 [-AllowedPrincipalTypes <string>]
 [-Description <string>]
 [-DisplayName <string>]
 [-Id <string>]
 [-InheritsPermissionsFrom <IMicrosoftGraphUnifiedRoleDefinition[]>]
 [-IsBuiltIn]
 [-IsEnabled]
 [-IsPrivileged]
 [-ResourceScopes <string[]>]
 [-RolePermissions <IMicrosoftGraphUnifiedRolePermission[]>]
 [-TemplateId <string>]
 [-Version <string>]
 [-Break]
 [-Headers <IDictionary>]
 [-HttpPipelineAppend <SendAsyncStep[]>]
 [-HttpPipelinePrepend <SendAsyncStep[]>]
 [-Proxy <uri>]
 [-ProxyCredential <pscredential>]
 [-ProxyUseDefaultCredentials]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

New-MgBetaRoleManagementDirectoryRoleDefinition

 -BodyParameter <IMicrosoftGraphUnifiedRoleDefinition>
 [-ResponseHeadersVariable <string>]
 [-Break]
 [-Headers <IDictionary>]
 [-HttpPipelineAppend <SendAsyncStep[]>]
 [-HttpPipelinePrepend <SendAsyncStep[]>]
 [-Proxy <uri>]
 [-ProxyCredential <pscredential>]
 [-ProxyUseDefaultCredentials]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

Create a new unifiedRoleDefinition object for an RBAC provider. This feature requires a Microsoft Entra ID P1 or P2 license. The following RBAC providers are currently supported:\r- Cloud PC\r- device management (Intune)\r- Defender (Microsoft Defender XDR)\r- directory (Microsoft Entra ID)

Permissions

Import-Module Microsoft.Graph.Beta.Identity.Governance

$params = @{
	description = "Update basic properties of application registrations"
	displayName = "Application Registration Support Administrator"
	rolePermissions = @(
		@{
			allowedResourceActions = @(
			"microsoft.directory/applications/basic/read"
		)
	}
)
isEnabled = "true"
}

New-MgBetaRoleManagementDirectoryRoleDefinition -BodyParameter $params

This example shows how to use the New-MgBetaRoleManagementDirectoryRoleDefinition Cmdlet.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

{{ Fill in the Description }}

{{ Fill in the Description }}

{{ Fill in the Description }}

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

BODYPARAMETER <IMicrosoftGraphUnifiedRoleDefinition>: unifiedRoleDefinition [(Any) <Object>]: This indicates any property can be added to this object. [Id <String>]: The unique identifier for an entity. Read-only. [AllowedPrincipalTypes <String>]: allowedRolePrincipalTypes [Description <String>]: The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true. [DisplayName <String>]: The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required. Supports $filter (eq and startsWith). [InheritsPermissionsFrom <IMicrosoftGraphUnifiedRoleDefinition[]>]: Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles support this attribute. [IsBuiltIn <Boolean?>]: Flag indicating if the unifiedRoleDefinition is part of the default set included with the product or custom. Read-only. Supports $filter (eq). [IsEnabled <Boolean?>]: Flag indicating if the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true. [IsPrivileged <Boolean?>]: Flag indicating if the role is privileged. Microsoft Entra ID defines a role as privileged if it contains at least one sensitive resource action in the rolePermissions and allowedResourceActions objects. Applies only for actions in the microsoft.directory resource namespace. Read-only. Supports $filter (eq). [ResourceScopes <String[]>]: List of scopes permissions granted by the role definition apply to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment. [RolePermissions <IMicrosoftGraphUnifiedRolePermission[]>]: List of permissions included in the role. Read-only when isBuiltIn is true. Required. [AllowedResourceActions <String[]>]: Set of tasks that can be performed on a resource. [Condition <String>]: Optional constraints that must be met for the permission to be effective. Not supported for custom roles. [ExcludedResourceActions <String[]>]: [TemplateId <String>]: Custom template identifier that can be set when isBuiltIn is false. This identifier is typically used if one needs an identifier to be the same across different directories. Read-only when isBuiltIn is true. [Version <String>]: Indicates the version of the unifiedRoleDefinition object. Read-only when isBuiltIn is true.

INHERITSPERMISSIONSFROM <IMicrosoftGraphUnifiedRoleDefinition[]>: Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles support this attribute. [Id <String>]: The unique identifier for an entity. Read-only. [AllowedPrincipalTypes <String>]: allowedRolePrincipalTypes [Description <String>]: The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true. [DisplayName <String>]: The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required. Supports $filter (eq and startsWith). [InheritsPermissionsFrom <IMicrosoftGraphUnifiedRoleDefinition[]>]: Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles support this attribute. [IsBuiltIn <Boolean?>]: Flag indicating if the unifiedRoleDefinition is part of the default set included with the product or custom. Read-only. Supports $filter (eq). [IsEnabled <Boolean?>]: Flag indicating if the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true. [IsPrivileged <Boolean?>]: Flag indicating if the role is privileged. Microsoft Entra ID defines a role as privileged if it contains at least one sensitive resource action in the rolePermissions and allowedResourceActions objects. Applies only for actions in the microsoft.directory resource namespace. Read-only. Supports $filter (eq). [ResourceScopes <String[]>]: List of scopes permissions granted by the role definition apply to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment. [RolePermissions <IMicrosoftGraphUnifiedRolePermission[]>]: List of permissions included in the role. Read-only when isBuiltIn is true. Required. [AllowedResourceActions <String[]>]: Set of tasks that can be performed on a resource. [Condition <String>]: Optional constraints that must be met for the permission to be effective. Not supported for custom roles. [ExcludedResourceActions <String[]>]: [TemplateId <String>]: Custom template identifier that can be set when isBuiltIn is false. This identifier is typically used if one needs an identifier to be the same across different directories. Read-only when isBuiltIn is true. [Version <String>]: Indicates the version of the unifiedRoleDefinition object. Read-only when isBuiltIn is true.

ROLEPERMISSIONS <IMicrosoftGraphUnifiedRolePermission[]>: List of permissions included in the role. Read-only when isBuiltIn is true. Required. [AllowedResourceActions <String[]>]: Set of tasks that can be performed on a resource. [Condition <String>]: Optional constraints that must be met for the permission to be effective. Not supported for custom roles. [ExcludedResourceActions <String[]>]: