Microsoft.Graph appRoleAssignedTo

Article
06/21/2024

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

Note

Permissions for personal Microsoft accounts cannot be used to deploy Microsoft Graph resources declared in Bicep files.

Permission type	Least privileged permissions	Higher privileged permissions
Delegated (work or school account)	AppRoleAssignment.ReadWrite.All and Application.Read.All	AppRoleAssignment.ReadWrite.All and Directory.Read.All
Delegated (personal Microsoft account)	Not supported.	Not supported.
Application	AppRoleAssignment.ReadWrite.All and Application.Read.All	AppRoleAssignment.ReadWrite.All and Directory.Read.All

Resource format

To create a Microsoft.Graph/appRoleAssignedTo resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Graph/appRoleAssignedTo@beta' = {
  appRoleId: 'string'
  principalId: 'string'
  resourceDisplayName: 'string'
  resourceId: 'string'
}

Property values

appRoleAssignedTo

Name	Description	Value
apiVersion	The resource api version	'beta' (ReadOnly)
appRoleId	The identifier (id) for the app role which is assigned to the principal. This app role must be exposed in the appRoles property on the resource application's service principal (resourceId). If the resource application has not declared any app roles, a default app role ID of 00000000-0000-0000-0000-000000000000 can be specified to signal that the principal is assigned to the resource app without any specific app roles. Required on create.	string (Required) Constraints: Min length = 36 Max length = 36 Pattern = `^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$`
creationTimestamp	The time when the app role assignment was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.	string (ReadOnly)
id	The unique identifier for an entity. Read-only.	string (ReadOnly)
principalDisplayName	The display name of the user, group, or service principal that was granted the app role assignment. Read-only	string (ReadOnly)
principalId	The unique identifier (id) for the user, security group, or service principal being granted the app role. Security groups with dynamic memberships are supported. Required on create.	string (Required) Constraints: Min length = 36 Max length = 36 Pattern = `^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$`
principalType	The type of the assigned principal. This can either be User, Group, or ServicePrincipal. Read-only.	string (ReadOnly)
resourceDisplayName	The display name of the resource app's service principal to which the assignment is made.	string
resourceId	The unique identifier (id) for the resource service principal for which the assignment is made. Required on create	string (Required) Constraints: Min length = 36 Max length = 36 Pattern = `^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$`
type	The resource type	'Microsoft.Graph/appRoleAssignedTo' (ReadOnly)

Share via