Create roleDefinition
Namespace: microsoft.graph
Important: Microsoft Graph APIs under the /beta version are subject to change; production use is not supported.
Note: The Microsoft Graph API for Intune requires an active Intune license for the tenant.
Create a new roleDefinition object.
This API is available in the following national cloud deployments.
Global service | US Government L4 | US Government L5 (DOD) | China operated by 21Vianet |
---|---|---|---|
✅ | ✅ | ✅ | ✅ |
Permissions
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.
Permission type | Permissions (from least to most privileged) |
---|---|
Delegated (work or school account) | DeviceManagementConfiguration.ReadWrite.All, DeviceManagementRBAC.ReadWrite.All |
Delegated (personal Microsoft account) | Not supported. |
Application | DeviceManagementConfiguration.ReadWrite.All, DeviceManagementRBAC.ReadWrite.All |
HTTP Request
POST /deviceManagement/roleDefinitions
Request headers
Header | Value |
---|---|
Authorization | Bearer {token}. Required. Learn more about authentication and authorization. |
Accept | application/json |
Request body
In the request body, supply a JSON representation for the roleDefinition object.
The following table shows the properties that are required when you create the roleDefinition.
Property | Type | Description |
---|---|---|
id | String | Key of the entity. This is read-only and automatically generated. |
displayName | String | Display Name of the Role definition. |
description | String | Description of the Role definition. |
permissions | rolePermission collection | List of Role Permissions this role is allowed to perform. These must match the actionName that is defined as part of the rolePermission. |
rolePermissions | rolePermission collection | List of Role Permissions this role is allowed to perform. These must match the actionName that is defined as part of the rolePermission. |
isBuiltInRoleDefinition | Boolean | Type of Role. Set to True if it is built-in, or set to False if it is a custom role definition. |
isBuiltIn | Boolean | Type of Role. Set to True if it is built-in, or set to False if it is a custom role definition. |
roleScopeTagIds | String collection | List of Scope Tags for this Entity instance. |
Response
If successful, this method returns a 201 Created
response code and a roleDefinition object in the response body.
Example
Request
Here is an example of the request.
POST https://graph.microsoft.com/beta/deviceManagement/roleDefinitions
Content-type: application/json
Content-length: 1207
{
"@odata.type": "#microsoft.graph.roleDefinition",
"displayName": "Display Name value",
"description": "Description value",
"permissions": [
{
"@odata.type": "microsoft.graph.rolePermission",
"actions": [
"Actions value"
],
"resourceActions": [
{
"@odata.type": "microsoft.graph.resourceAction",
"allowedResourceActions": [
"Allowed Resource Actions value"
],
"notAllowedResourceActions": [
"Not Allowed Resource Actions value"
]
}
]
}
],
"rolePermissions": [
{
"@odata.type": "microsoft.graph.rolePermission",
"actions": [
"Actions value"
],
"resourceActions": [
{
"@odata.type": "microsoft.graph.resourceAction",
"allowedResourceActions": [
"Allowed Resource Actions value"
],
"notAllowedResourceActions": [
"Not Allowed Resource Actions value"
]
}
]
}
],
"isBuiltInRoleDefinition": true,
"isBuiltIn": true,
"roleScopeTagIds": [
"Role Scope Tag Ids value"
]
}
Response
Here is an example of the response. Note: The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
HTTP/1.1 201 Created
Content-Type: application/json
Content-Length: 1256
{
"@odata.type": "#microsoft.graph.roleDefinition",
"id": "70fdcd08-cd08-70fd-08cd-fd7008cdfd70",
"displayName": "Display Name value",
"description": "Description value",
"permissions": [
{
"@odata.type": "microsoft.graph.rolePermission",
"actions": [
"Actions value"
],
"resourceActions": [
{
"@odata.type": "microsoft.graph.resourceAction",
"allowedResourceActions": [
"Allowed Resource Actions value"
],
"notAllowedResourceActions": [
"Not Allowed Resource Actions value"
]
}
]
}
],
"rolePermissions": [
{
"@odata.type": "microsoft.graph.rolePermission",
"actions": [
"Actions value"
],
"resourceActions": [
{
"@odata.type": "microsoft.graph.resourceAction",
"allowedResourceActions": [
"Allowed Resource Actions value"
],
"notAllowedResourceActions": [
"Not Allowed Resource Actions value"
]
}
]
}
],
"isBuiltInRoleDefinition": true,
"isBuiltIn": true,
"roleScopeTagIds": [
"Role Scope Tag Ids value"
]
}