RoleEligibilitySchedule.Read.Directory

Allows the app to read the eligible role-based access control (RBAC) assignments for your company's directory, on behalf of the signed-in user. This includes reading directory role templates, and directory roles.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the RoleEligibilitySchedule.Read.Directory permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	ff278e11-4a33-4d0c-83d2-d01dc58929a5	eb0788c2-6d4e-4658-8c9e-c0fb8053f03d
DisplayText	Read all eligible role assignments and role schedules for your company's directory	Read all eligible role assignments for your company's directory
Description	Allows the app to read the eligible role-based access control (RBAC) assignments and schedules for your company's directory, without a signed-in user. This includes reading directory role templates, and directory roles.	Allows the app to read the eligible role-based access control (RBAC) assignments for your company's directory, on behalf of the signed-in user. This includes reading directory role templates, and directory roles.
AdminConsentRequired	Yes	Yes

Graph Methods

• API [v1.0]
• API [beta]
• PowerShell [v1.0]
• PowerShell [beta]

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /roleManagement/directory/roleEligibilityScheduleInstances
	GET /roleManagement/directory/roleEligibilityScheduleInstances/{unifiedRoleEligibilityScheduleInstanceId}
	GET /roleManagement/directory/roleEligibilityScheduleInstances/filterByCurrentUser(on='parameterValue')
	GET /roleManagement/directory/roleEligibilitySchedules
	GET /roleManagement/directory/roleEligibilitySchedules/{unifiedRoleEligibilityScheduleId}
	GET /roleManagement/directory/roleEligibilitySchedules/filterByCurrentUser(on='parameterValue')

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

• unifiedRoleEligibilitySchedule
• unifiedRoleEligibilityScheduleInstance

Graph reference: unifiedRoleEligibilitySchedule

Property	Type	Description
appScopeId	String	Identifier of the app-specific scope when the role eligibility is scoped to an app. The scope of a role eligibility determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by this application only. Use / for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units. Inherited from unifiedRoleScheduleBase. Supports $filter (eq, ne, and on null values).
createdDateTime	DateTimeOffset	When the schedule was created. Inherited from unifiedRoleScheduleBase.
createdUsing	String	Identifier of the object through which this schedule was created. Inherited from unifiedRoleScheduleBase. Supports $filter (eq, ne, and on null values).
directoryScopeId	String	Identifier of the directory object representing the scope of the role eligibility. The scope of a role eligibility determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use / for tenant-wide scope. Use appScopeId to limit the scope to an application only. Inherited from unifiedRoleScheduleBase. Supports $filter (eq, ne, and on null values).
id	String	The unique identifier for the schedule object. Inherited from entity. Supports $filter (eq).
memberType	String	How the role eligibility is inherited. It can either be Inherited, Direct, or Group. It can further imply whether the unifiedRoleEligibilitySchedule can be managed by the caller. Supports $filter (eq, ne).
modifiedDateTime	DateTimeOffset	When the schedule was last modified. Inherited from unifiedRoleScheduleBase.
principalId	String	Identifier of the principal that is eligible for a role.Inherited from unifiedRoleScheduleBase. Supports $filter (eq, ne).
roleDefinitionId	String	Identifier of the unifiedRoleDefinition object that a principal is eligible for. Inherited from unifiedRoleScheduleBase.
scheduleInfo	requestSchedule	The period of the role eligibility.
status	String	The status of the role eligibility request. Inherited from unifiedRoleScheduleBase. The possible values are: Canceled, Denied, Failed, Granted, PendingAdminDecision, PendingApproval, PendingProvisioning, PendingScheduleCreation, Provisioned, Revoked, and ScheduleCreated. Not nullable. Supports $filter (eq, ne).