EduRoster.ReadWrite

Allows the app to read and write the structure of schools and classes in an organization's roster and education-specific information about users to be read and written on behalf of the user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the EduRoster.ReadWrite permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	-	359e19a6-e3fa-4d7f-bcab-d28ec592b51e
DisplayText	-	Read and write users' view of the roster
Description	-	Allows the app to read and write the structure of schools and classes in an organization's roster and education-specific information about users to be read and written on behalf of the user.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /education/classes/delta
	GET /education/schools/delta
	GET /education/users/delta

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /education/classes/delta
	GET /education/schools/delta
	GET /education/users/delta

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgEducationClassDelta
	Get-MgEducationSchoolDelta
	Get-MgEducationUserDelta

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaEducationClassDelta
	Get-MgBetaEducationSchoolDelta
	Get-MgBetaEducationUserDelta

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: educationClass

Property	Type	Description
classCode	String	Class code used by the school to identify the class.
createdBy	identitySet	Entity who created the class
description	String	Description of the class.
displayName	String	Name of the class.
externalId	String	ID of the class from the syncing system.
externalSource	educationExternalSource	How this class was created. Possible values are: `sis`, `manual`.
externalSourceDetail	String	The name of the external source this resource was generated from.
externalName	String	Name of the class in the syncing system.
grade	String	Grade level of the class.
id	String	Object identifier. Inherited from entity.
mailNickname	String	Mail name for sending email to all members, if this is enabled.
term	educationTerm	Term for this class.

Graph reference: educationSchool

Property	Type	Description
address	physicalAddress	Address of the school.
createdBy	identitySet	Entity who created the school.
description	String	Description of the school. Inherited from educationOrganization.
displayName	String	Display name of the school. Inherited from educationOrganization.
externalId	String	ID of school in syncing system.
externalPrincipalId	String	ID of principal in syncing system.
externalSource	educationExternalSource	Source where this organization was created from. Inherited from educationOrganization. Possible values are: `sis`, `manual`.
externalSourceDetail	String	The name of the external source this resource was generated from.
highestGrade	String	Highest grade taught.
id	String	Object identifier. Inherited from entity.
lowestGrade	String	Lowest grade taught.
phone	String	Phone number of school.
principalEmail	String	Email address of the principal.
principalName	String	Name of the principal.
schoolNumber	String	School Number.

Graph reference: educationUser

Property	Type	Description
accountEnabled	Boolean	`True` if the account is enabled; otherwise, `false`. This property is required when a user is created. Supports `$filter`.
assignedLicenses	assignedLicense collection	The licenses that are assigned to the user. Not nullable.
assignedPlans	assignedPlan collection	The plans that are assigned to the user. Read-only. Not nullable.
businessPhones	String collection	The telephone numbers for the user. Note: Although this is a string collection, only one number can be set for this property.
createdBy	identitySet	The entity who created the user.
department	String	The name for the department in which the user works. Supports `$filter`.
displayName	String	The name displayed in the address book for the user. This is usually the combination of the user's first name, middle initial, and last name. This property is required when a user is created and it cannot be cleared during updates. Supports `$filter` and `$orderby`.
externalSource	educationExternalSource	Where this user was created from. Possible values are: `sis`, `manual`.
externalSourceDetail	String	The name of the external source this resource was generated from.
givenName	String	The given name (first name) of the user. Supports `$filter`.
id	String	Object identifier. Inherited from entity.
mail	String	The SMTP address for the user, for example, `[email protected]`. Read-Only. Supports `$filter`.
mailingAddress	physicalAddress	The mail address of the user.
mailNickname	String	The mail alias for the user. This property must be specified when a user is created. Supports `$filter`.
middleName	String	The middle name of the user.
mobilePhone	String	The primary cellular telephone number for the user.
officeLocation	String	The office location for the user.
onPremisesInfo	educationOnPremisesInfo	Additional information used to associate the Microsoft Entra user with its Active Directory counterpart.
passwordPolicies	String	Specifies password policies for the user. This value is an enumeration with one possible value being `DisableStrongPassword`, which allows weaker passwords than the default policy to be specified. `DisablePasswordExpiration` can also be specified. The two can be specified together; for example: `DisablePasswordExpiration, DisableStrongPassword`.
passwordProfile	passwordProfile	Specifies the password profile for the user. The profile contains the user's password. This property is required when a user is created. The password in the profile must satisfy minimum requirements as specified by the passwordPolicies property. By default, a strong password is required.
preferredLanguage	String	The preferred language for the user that should follow the ISO 639-1 code, for example, `en-US`.
primaryRole	educationUserRole	Default role for a user. The user's role might be different in an individual class. Possible values are: `student`, `teacher`, `none`, `unknownFutureValue`.
provisionedPlans	provisionedPlan collection	The plans that are provisioned for the user. Read-only. Not nullable.
refreshTokensValidFromDateTime	DateTimeOffset	Any refresh tokens or sessions tokens (session cookies) issued before this time are invalid, and applications get an error when using an invalid refresh or sessions token to acquire a delegated access token (to access APIs such as Microsoft Graph). If this happens, the application needs to acquire a new refresh token by requesting the authorized endpoint. Returned only on `$select`. Read-only.
relatedContacts	[relatedContact] collection	Related records associated with the user. Read-only.
residenceAddress	physicalAddress	The address where the user lives.
showInAddressList	Boolean	`True` if the Outlook Global Address List should contain this user; otherwise, `false`. If not set, this will be treated as `true`. For users invited through the invitation manager, this property will be set to `false`.
student	educationStudent	If the primary role is student, this block will contain student specific data.
surname	String	The user's surname (family name or last name). Supports `$filter`.
teacher	educationTeacher	If the primary role is teacher, this block will contain teacher specific data.
usageLocation	String	A two-letter country code (ISO standard 3166). Required for users who will be assigned licenses due to a legal requirement to check for availability of services in countries or regions. Examples include: `US`, `JP`, and `GB`. Not nullable. Supports `$filter`.
userPrincipalName	String	The user principal name (UPN) of the user. The UPN is an internet-style login name for the user based on the internet standard RFC 822. By convention, this should map to the user's email name. The general format is `alias@domain`, where domain must be present in the tenant's collection of verified domains. This property is required when a user is created. The verified domains for the tenant can be accessed from the verifiedDomains property of the organization. Supports `$filter` and `$orderby`.
userType	String	A string value that can be used to classify user types in your directory, such as `Member` and `Guest`. Supports `$filter`.

Table of Contents

EduRoster.ReadWrite

Graph Methods

Resources