New-MgRoleManagementDirectoryRoleDefinition

Module:

Microsoft.Graph.Identity.Governance Module

Create a new custom unifiedRoleDefinition object. This feature requires a Microsoft Entra ID P1 or P2 license.

New-MgRoleManagementDirectoryRoleDefinition
 [-ResponseHeadersVariable <string>]
 [-AdditionalProperties <hashtable>]
 [-Description <string>]
 [-DisplayName <string>]
 [-Id <string>]
 [-InheritsPermissionsFrom <IMicrosoftGraphUnifiedRoleDefinition[]>]
 [-IsBuiltIn]
 [-IsEnabled]
 [-ResourceScopes <string[]>]
 [-RolePermissions <IMicrosoftGraphUnifiedRolePermission[]>]
 [-TemplateId <string>]
 [-Version <string>]
 [-Break]
 [-Headers <IDictionary>]
 [-HttpPipelineAppend <SendAsyncStep[]>]
 [-HttpPipelinePrepend <SendAsyncStep[]>]
 [-Proxy <uri>]
 [-ProxyCredential <pscredential>]
 [-ProxyUseDefaultCredentials]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

New-MgRoleManagementDirectoryRoleDefinition
 -BodyParameter <IMicrosoftGraphUnifiedRoleDefinition>
 [-ResponseHeadersVariable <string>]
 [-Break]
 [-Headers <IDictionary>]
 [-HttpPipelineAppend <SendAsyncStep[]>]
 [-HttpPipelinePrepend <SendAsyncStep[]>]
 [-Proxy <uri>]
 [-ProxyCredential <pscredential>]
 [-ProxyUseDefaultCredentials]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

Create a new custom unifiedRoleDefinition object. This feature requires a Microsoft Entra ID P1 or P2 license.

Permissions

Import-Module Microsoft.Graph.Identity.Governance

$params = @{
	description = "Update basic properties of application registrations"
	displayName = "Application Registration Support Administrator"
	rolePermissions = @(
		@{
			allowedResourceActions = @(
			"microsoft.directory/applications/basic/read"
		)
	}
)
isEnabled = $true
}

New-MgRoleManagementDirectoryRoleDefinition -BodyParameter $params

This example shows how to use the New-MgRoleManagementDirectoryRoleDefinition Cmdlet.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

{{ Fill in the Description }}

{{ Fill in the Description }}

{{ Fill in the Description }}

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

BODYPARAMETER <IMicrosoftGraphUnifiedRoleDefinition>: unifiedRoleDefinition [(Any) <Object>]: This indicates any property can be added to this object. [Id <String>]: The unique identifier for an entity. Read-only. [Description <String>]: The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true. [DisplayName <String>]: The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required. Supports $filter (eq, in). [InheritsPermissionsFrom <IMicrosoftGraphUnifiedRoleDefinition[]>]: Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand. [IsBuiltIn <Boolean?>]: Flag indicating whether the role definition is part of the default set included in Microsoft Entra or a custom definition. Read-only. Supports $filter (eq, in). [IsEnabled <Boolean?>]: Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true. [ResourceScopes <String[]>]: List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment. [RolePermissions <IMicrosoftGraphUnifiedRolePermission[]>]: List of permissions included in the role. Read-only when isBuiltIn is true. Required. [AllowedResourceActions <String[]>]: Set of tasks that can be performed on a resource. Required. [Condition <String>]: Optional constraints that must be met for the permission to be effective. Not supported for custom roles. [ExcludedResourceActions <String[]>]: Set of tasks that may not be performed on a resource. Not yet supported. [TemplateId <String>]: Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories. [Version <String>]: Indicates version of the role definition. Read-only when isBuiltIn is true.

INHERITSPERMISSIONSFROM <IMicrosoftGraphUnifiedRoleDefinition[]>: Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand. [Id <String>]: The unique identifier for an entity. Read-only. [Description <String>]: The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true. [DisplayName <String>]: The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required. Supports $filter (eq, in). [InheritsPermissionsFrom <IMicrosoftGraphUnifiedRoleDefinition[]>]: Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand. [IsBuiltIn <Boolean?>]: Flag indicating whether the role definition is part of the default set included in Microsoft Entra or a custom definition. Read-only. Supports $filter (eq, in). [IsEnabled <Boolean?>]: Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true. [ResourceScopes <String[]>]: List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment. [RolePermissions <IMicrosoftGraphUnifiedRolePermission[]>]: List of permissions included in the role. Read-only when isBuiltIn is true. Required. [AllowedResourceActions <String[]>]: Set of tasks that can be performed on a resource. Required. [Condition <String>]: Optional constraints that must be met for the permission to be effective. Not supported for custom roles. [ExcludedResourceActions <String[]>]: Set of tasks that may not be performed on a resource. Not yet supported. [TemplateId <String>]: Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories. [Version <String>]: Indicates version of the role definition. Read-only when isBuiltIn is true.

ROLEPERMISSIONS <IMicrosoftGraphUnifiedRolePermission[]>: List of permissions included in the role. Read-only when isBuiltIn is true. Required. [AllowedResourceActions <String[]>]: Set of tasks that can be performed on a resource. Required. [Condition <String>]: Optional constraints that must be met for the permission to be effective. Not supported for custom roles. [ExcludedResourceActions <String[]>]: Set of tasks that may not be performed on a resource. Not yet supported.