RoleManagement.ReadWrite.Directory

Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.

Caution

Permissions that allow granting authorization, such as RoleManagement.ReadWrite.Directory, allow an application to grant additional privileges to itself, other applications, or any user. Use caution when granting any of these permissions.

With the RoleManagement.ReadWrite.Directory permission an application can read and write /directoryRoles and /roleManagement/directory/*. This includes adding and removing members to and from Microsoft Entra roles, and working with PIM for Microsoft Entra roles APIs.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the RoleManagement.ReadWrite.Directory permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8	d01b97e9-cbc0-49fe-810a-750afd5527a3
DisplayText	Read and write all directory RBAC settings	Read and write directory RBAC settings
Description	Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, without a signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.	Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /directory/administrativeUnits/{id}/scopedRoleMembers/{id}
	DELETE /directoryRoles(roleTemplateId='{roleTemplateId}')/members/{id}/$ref
	DELETE /directoryRoles/{role-id}/members/{id}/$ref
	DELETE /roleManagement/directory/roleAssignments/{id}
	DELETE /roleManagement/directory/roleDefinitions/{id}
	GET /directory/administrativeUnits/{id}/scopedRoleMembers
	GET /directory/administrativeUnits/{id}/scopedRoleMembers/{id}
	GET /directoryRoles
	GET /directoryRoles(roleTemplateId='{roleTemplateId}')
	GET /directoryRoles(roleTemplateId='{roleTemplateId}')/members
	GET /directoryRoles(roleTemplateId='{roleTemplateId}')/scopedMembers
	GET /directoryRoles/{role-id}
	GET /directoryRoles/{role-id}/members
	GET /directoryroles/{role-id}/scopedMembers
	GET /directoryRoles/delta
	GET /directoryRoleTemplates
	GET /directoryRoleTemplates/{id}
	GET /policies/roleManagementPolicies?$filter=scopeId eq '/' and scopeType eq 'DirectoryRole'
	GET /policies/roleManagementPolicies/{unifiedRoleManagementPolicyId}
	GET /policies/roleManagementPolicies/{unifiedRoleManagementPolicyId}/rules
	GET /policies/roleManagementPolicies/{unifiedRoleManagementPolicyId}/rules/{unifiedRoleManagementPolicyRuleId}
	GET /policies/roleManagementPolicyAssignments?$filter=scopeId eq '/' and scopeType eq 'DirectoryRole'
	GET /policies/roleManagementPolicyAssignments/{unifiedRoleManagementPolicyAssignmentId}
	GET /roleManagement/directory/roleAssignments
	GET /roleManagement/directory/roleAssignments/{id}
	GET /roleManagement/directory/roleAssignmentScheduleInstances
	GET /roleManagement/directory/roleAssignmentScheduleInstances/{unifiedRoleAssignmentScheduleInstanceId}
	GET /roleManagement/directory/roleAssignmentScheduleInstances/filterByCurrentUser(on=parameterValue)
	GET /roleManagement/directory/roleAssignmentScheduleRequests
	GET /roleManagement/directory/roleAssignmentScheduleRequests/{unifiedRoleAssignmentScheduleRequestId}
	GET /roleManagement/directory/roleAssignmentScheduleRequests/filterByCurrentUser(on='parameterValue')
	GET /roleManagement/directory/roleAssignmentSchedules
	GET /roleManagement/directory/roleAssignmentSchedules/{unifiedRoleAssignmentScheduleId}
	GET /roleManagement/directory/roleAssignmentSchedules/filterByCurrentUser(on='parameterValue')
	GET /roleManagement/directory/roleDefinitions
	GET /roleManagement/directory/roleDefinitions/{id}
	GET /roleManagement/directory/roleEligibilityScheduleInstances
	GET /roleManagement/directory/roleEligibilityScheduleInstances/{unifiedRoleEligibilityScheduleInstanceId}
	GET /roleManagement/directory/roleEligibilityScheduleInstances/filterByCurrentUser(on='parameterValue')
	GET /roleManagement/directory/roleEligibilityScheduleRequests
	GET /roleManagement/directory/roleEligibilityScheduleRequests/{unifiedRoleEligibilityScheduleRequestId}
	GET /roleManagement/directory/roleEligibilityScheduleRequests/filterByCurrentUser(on='parameterValue')
	GET /roleManagement/directory/roleEligibilitySchedules
	GET /roleManagement/directory/roleEligibilitySchedules/{unifiedRoleEligibilityScheduleId}
	GET /roleManagement/directory/roleEligibilitySchedules/filterByCurrentUser(on='parameterValue')
	PATCH /policies/roleManagementPolicies/{unifiedRoleManagementPolicyId}
	PATCH /policies/roleManagementPolicies/{unifiedRoleManagementPolicyId}/rules/{unifiedRoleManagementPolicyRuleId}
	PATCH /roleManagement/directory/roleDefinitions/{id}
	POST /directory/administrativeUnits/{id}/scopedRoleMembers
	POST /directoryRoles
	POST /directoryRoles/{role-id}/members/$ref
	POST /directoryRoles/roleTemplateId={roleTemplateId}/members/$ref
	POST /roleManagement/directory/roleAssignments
	POST /roleManagement/directory/roleAssignmentScheduleRequests
	POST /roleManagement/directory/roleAssignmentScheduleRequests/{unifiedRoleAssignmentScheduleRequestId}/cancel
	POST /roleManagement/directory/roleDefinitions
	POST /roleManagement/directory/roleEligibilityScheduleRequests
	POST /roleManagement/directory/roleEligibilityScheduleRequests/{unifiedRoleEligibilityScheduleRequestId}/cancel

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /administrativeUnits/{id}/scopedRoleMembers/{id}
	DELETE /directoryRoles(roleTemplateId='{roleTemplateId}')/members/{id}/$ref
	DELETE /directoryRoles/{role-id}/members/{id}/$ref
	DELETE /roleManagement/deviceManagement/roleDefinitions/{id}
	DELETE /roleManagement/directory/roleAssignments/{id}
	GET /administrativeUnits/{id}/scopedRoleMembers
	GET /administrativeUnits/{id}/scopedRoleMembers/{id}
	GET /directoryRoles
	GET /directoryRoles(roleTemplateId='{roleTemplateId}')
	GET /directoryRoles(roleTemplateId='{roleTemplateId}')/members
	GET /directoryRoles(roleTemplateId='{roleTemplateId}')/scopedMembers
	GET /directoryRoles/{role-id}
	GET /directoryRoles/{role-id}/members
	GET /directoryroles/{role-id}/scopedMembers
	GET /directoryRoles/delta
	GET /directoryRoleTemplates
	GET /directoryRoleTemplates/{id}
	GET /policies/roleManagementPolicies?$filter=scopeId eq '/' and scopeType eq 'DirectoryRole'
	GET /policies/roleManagementPolicies/{unifiedRoleManagementPolicyId}
	GET /policies/roleManagementPolicies/{unifiedRoleManagementPolicyId}/effectiveRules
	GET /policies/roleManagementPolicies/{unifiedRoleManagementPolicyId}/rules
	GET /policies/roleManagementPolicies/{unifiedRoleManagementPolicyId}/rules/{unifiedRoleManagementPolicyRuleId}
	GET /policies/roleManagementPolicyAssignments?$filter=scopeId eq '/' and scopeType eq 'DirectoryRole'
	GET /policies/roleManagementPolicyAssignments/{unifiedRoleManagementPolicyAssignmentId}
	GET /roleManagement/cloudPC/roleDefinitions
	GET /roleManagement/cloudPC/roleDefinitions/{id}
	GET /roleManagement/directory/resourceNamespaces
	GET /roleManagement/directory/resourceNamespaces/{unifiedRbacResourceNamespaceId}
	GET /roleManagement/directory/resourceNamespaces/{unifiedRbacResourceNamespaceId}/resourceActions
	GET /roleManagement/directory/resourceNamespaces/{unifiedRbacResourceNamespaceId}/resourceActions/{unifiedRbacResourceActionId}
	GET /roleManagement/directory/roleAssignments
	GET /roleManagement/directory/roleAssignments/{id}
	GET /roleManagement/directory/roleAssignmentScheduleInstances
	GET /roleManagement/directory/roleAssignmentScheduleInstances/{unifiedRoleAssignmentScheduleInstancesId}
	GET /roleManagement/directory/roleAssignmentScheduleInstances/filterByCurrentUser(on='principal')
	GET /roleManagement/directory/roleAssignmentScheduleRequests
	GET /roleManagement/directory/roleAssignmentScheduleRequests/{unifiedRoleAssignmentScheduleRequestsId}
	GET /roleManagement/directory/roleAssignmentScheduleRequests/filterByCurrentUser(on='principal')
	GET /roleManagement/directory/roleAssignmentSchedules
	GET /roleManagement/directory/roleAssignmentSchedules/{unifiedRoleAssignmentSchedulesId}
	GET /roleManagement/directory/roleAssignmentSchedules/filterByCurrentUser(on='principal')
	GET /roleManagement/directory/roleDefinitions/{unifiedRoleDefinitionId}/assignedPrincipals(transitive=@transitive,directoryScopeType='@directoryScopeType',directoryScopeId='@directoryScopeId')
	GET /roleManagement/directory/roleEligibilityScheduleInstances
	GET /roleManagement/directory/roleEligibilityScheduleInstances/{unifiedRoleEligibilityScheduleInstancesId}
	GET /roleManagement/directory/roleEligibilityScheduleInstances/filterByCurrentUser(on='principal')
	GET /roleManagement/directory/roleEligibilityScheduleRequests
	GET /roleManagement/directory/roleEligibilityScheduleRequests/{unifiedRoleEligibilityScheduleRequestsId}
	GET /roleManagement/directory/RoleEligibilityScheduleRequests/filterByCurrentUser(on='principal')
	GET /roleManagement/directory/roleEligibilitySchedules
	GET /roleManagement/directory/roleEligibilitySchedules/{unifiedRoleEligibilitySchedulesId}
	GET /roleManagement/directory/transitiveRoleAssignments?$filter=principalId eq '{principalId}'
	GET roleManagement/directory/roleEligibilitySchedules/filterByCurrentUser(on='principal')
	PATCH /policies/roleManagementPolicies/{unifiedRoleManagementPolicyId}
	PATCH /policies/roleManagementPolicies/{unifiedRoleManagementPolicyId}/rules/{unifiedRoleManagementPolicyRuleId}
	PATCH /roleManagement/deviceManagement/roleDefinitions/{id}
	POST /administrativeUnits/{id}/scopedRoleMembers
	POST /directoryRoles
	POST /directoryRoles/{role-id}/members/$ref
	POST /directoryRoles/roleTemplateId={roleTemplateId}/members/$ref
	POST /roleManagement/deviceManagement/roleDefinitions
	POST /roleManagement/directory/roleAssignments
	POST /roleManagement/directory/roleAssignmentScheduleRequests
	POST /roleManagement/directory/roleAssignmentScheduleRequests/{unifiedRoleAssignmentScheduleRequestsId}/cancel
	POST /roleManagement/directory/roleEligibilityScheduleRequests
	POST /roleManagement/directory/roleEligibilityScheduleRequests/{unifiedRoleEligibilityScheduleRequestsId}/cancel

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaPolicyRoleManagementPolicyAssignment
	Get-MgDirectoryAdministrativeUnitScopedRoleMember
	Get-MgDirectoryRole
	Get-MgDirectoryRoleDelta
	Get-MgDirectoryRoleMember
	Get-MgDirectoryRoleScopedMember
	Get-MgDirectoryRoleTemplate
	Get-MgPolicyRoleManagementPolicy
	Get-MgPolicyRoleManagementPolicyAssignment
	Get-MgPolicyRoleManagementPolicyRule
	Get-MgRoleManagementDirectoryRoleAssignment
	Get-MgRoleManagementDirectoryRoleAssignmentSchedule
	Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance
	Get-MgRoleManagementDirectoryRoleAssignmentScheduleRequest
	Get-MgRoleManagementDirectoryRoleDefinition
	Get-MgRoleManagementDirectoryRoleEligibilitySchedule
	Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance
	Get-MgRoleManagementDirectoryRoleEligibilityScheduleRequest
	Get-MgRoleManagementEntitlementManagementRoleAssignment
	Get-MgRoleManagementEntitlementManagementRoleDefinition
	Invoke-MgFilterRoleManagementDirectoryRoleAssignmentScheduleByCurrentUser
	Invoke-MgFilterRoleManagementDirectoryRoleAssignmentScheduleInstanceByCurrentUser
	Invoke-MgFilterRoleManagementDirectoryRoleAssignmentScheduleRequestByCurrentUser
	Invoke-MgFilterRoleManagementDirectoryRoleEligibilityScheduleByCurrentUser
	Invoke-MgFilterRoleManagementDirectoryRoleEligibilityScheduleInstanceByCurrentUser
	Invoke-MgFilterRoleManagementDirectoryRoleEligibilityScheduleRequestByCurrentUser
	New-MgDirectoryAdministrativeUnitScopedRoleMember
	New-MgDirectoryRole
	New-MgDirectoryRoleMemberByRef
	New-MgRoleManagementDirectoryRoleAssignmentScheduleRequest
	New-MgRoleManagementDirectoryRoleDefinition
	New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest
	New-MgRoleManagementEntitlementManagementRoleAssignment
	Remove-MgDirectoryAdministrativeUnitScopedRoleMember
	Remove-MgDirectoryRoleMemberDirectoryObjectByRef
	Remove-MgRoleManagementDirectoryRoleAssignment
	Remove-MgRoleManagementDirectoryRoleDefinition
	Stop-MgRoleManagementDirectoryRoleAssignmentScheduleRequest
	Stop-MgRoleManagementDirectoryRoleEligibilityScheduleRequest
	Update-MgPolicyRoleManagementPolicy
	Update-MgPolicyRoleManagementPolicyRule
	Update-MgRoleManagementDirectoryRoleDefinition

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaAdministrativeUnitScopedRoleMember
	Get-MgBetaDirectoryRole
	Get-MgBetaDirectoryRoleByRoleTemplateId
	Get-MgBetaDirectoryRoleDelta
	Get-MgBetaDirectoryRoleMember
	Get-MgBetaDirectoryRoleScopedMember
	Get-MgBetaDirectoryRoleTemplate
	Get-MgBetaPolicyRoleManagementPolicy
	Get-MgBetaPolicyRoleManagementPolicyAssignment
	Get-MgBetaPolicyRoleManagementPolicyEffectiveRule
	Get-MgBetaPolicyRoleManagementPolicyRule
	Get-MgBetaRoleManagementDirectoryResourceNamespace
	Get-MgBetaRoleManagementDirectoryResourceNamespaceResourceAction
	Get-MgBetaRoleManagementDirectoryRoleAssignment
	Get-MgBetaRoleManagementDirectoryRoleAssignmentSchedule
	Get-MgBetaRoleManagementDirectoryRoleAssignmentScheduleInstance
	Get-MgBetaRoleManagementDirectoryRoleAssignmentScheduleRequest
	Get-MgBetaRoleManagementDirectoryRoleDefinition
	Get-MgBetaRoleManagementDirectoryRoleEligibilitySchedule
	Get-MgBetaRoleManagementDirectoryRoleEligibilityScheduleInstance
	Get-MgBetaRoleManagementDirectoryRoleEligibilityScheduleRequest
	Get-MgBetaRoleManagementDirectoryTransitiveRoleAssignment
	Get-MgBetaRoleManagementExchangeRoleAssignment
	Get-MgBetaRoleManagementExchangeRoleDefinition
	Invoke-MgBetaAssignedRoleManagementCloudPcRoleDefinitionInheritPermissionFromPrincipal
	Invoke-MgBetaAssignedRoleManagementCloudPcRoleDefinitionPrincipal
	Invoke-MgBetaAssignedRoleManagementDefenderRoleDefinitionInheritPermissionFromPrincipal
	Invoke-MgBetaAssignedRoleManagementDefenderRoleDefinitionPrincipal
	Invoke-MgBetaAssignedRoleManagementDeviceManagementRoleDefinitionInheritPermissionFromPrincipal
	Invoke-MgBetaAssignedRoleManagementDeviceManagementRoleDefinitionPrincipal
	Invoke-MgBetaAssignedRoleManagementDirectoryRoleDefinitionInheritPermissionFromPrincipal
	Invoke-MgBetaAssignedRoleManagementDirectoryRoleDefinitionPrincipal
	Invoke-MgBetaAssignedRoleManagementEnterpriseAppRoleDefinitionInheritPermissionFromPrincipal
	Invoke-MgBetaAssignedRoleManagementEnterpriseAppRoleDefinitionPrincipal
	Invoke-MgBetaAssignedRoleManagementEntitlementManagementRoleDefinitionInheritPermissionFromPrincipal
	Invoke-MgBetaAssignedRoleManagementEntitlementManagementRoleDefinitionPrincipal
	Invoke-MgBetaAssignedRoleManagementExchangeRoleDefinitionInheritPermissionFromPrincipal
	Invoke-MgBetaAssignedRoleManagementExchangeRoleDefinitionPrincipal
	Invoke-MgBetaFilterRoleManagementDirectoryRoleAssignmentScheduleByCurrentUser
	Invoke-MgBetaFilterRoleManagementDirectoryRoleAssignmentScheduleInstanceByCurrentUser
	Invoke-MgBetaFilterRoleManagementDirectoryRoleAssignmentScheduleRequestByCurrentUser
	Invoke-MgBetaFilterRoleManagementDirectoryRoleEligibilityScheduleByCurrentUser
	Invoke-MgBetaFilterRoleManagementDirectoryRoleEligibilityScheduleInstanceByCurrentUser
	Invoke-MgBetaFilterRoleManagementDirectoryRoleEligibilityScheduleRequestByCurrentUser
	New-MgBetaAdministrativeUnitScopedRoleMember
	New-MgBetaDirectoryRole
	New-MgBetaDirectoryRoleMemberByRef
	New-MgBetaRoleManagementCloudPcRoleDefinition
	New-MgBetaRoleManagementDirectoryRoleAssignmentScheduleRequest
	New-MgBetaRoleManagementDirectoryRoleEligibilityScheduleRequest
	New-MgBetaRoleManagementExchangeRoleAssignment
	Remove-MgBetaAdministrativeUnitScopedRoleMember
	Remove-MgBetaDirectoryRoleMemberDirectoryObjectByRef
	Remove-MgBetaRoleManagementCloudPcRoleDefinition
	Remove-MgBetaRoleManagementExchangeRoleAssignment
	Stop-MgBetaRoleManagementDirectoryRoleAssignmentScheduleRequest
	Stop-MgBetaRoleManagementDirectoryRoleEligibilityScheduleRequest
	Update-MgBetaPolicyRoleManagementPolicy
	Update-MgBetaPolicyRoleManagementPolicyRule
	Update-MgBetaRoleManagementCloudPcRoleDefinition

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: approvalSettings

Property	Type	Description
approvalMode	String	One of `SingleStage`, `Serial`, `Parallel`, `NoApproval` (default). `NoApproval` is used when `isApprovalRequired` is `false`.
approvalStages	unifiedApprovalStage collection	If approval is required, the one or two elements of this collection define each of the stages of approval. An empty array if no approval is required.
isApprovalRequired	Boolean	Indicates whether approval is required for requests in this policy.
isApprovalRequiredForExtension	Boolean	Indicates whether approval is required for a user to extend their assignment.
isRequestorJustificationRequired	Boolean	Indicates whether the requestor is required to supply a justification in their request.

Graph reference: directoryObject

Property	Type	Description
deletedDateTime	DateTimeOffset	Date and time when this object was deleted. Always `null` when the object hasn't been deleted.
id	String	The unique identifier for the object. For example, `12345678-9abc-def0-1234-56789abcde`. The value of the **i

Graph reference: directoryRole

Property	Type	Description
description	String	The description for the directory role. Read-only. Supports `$filter` (`eq`), `$search`, `$select`.
displayName	String	The display name for the directory role. Read-only. Supports `$filter` (`eq`), `$search`, `$select`.
id	String	The unique identifier for the directory role. Inherited from directoryObject. Key, Not nullable, Read-only. Supports `$filter` (`eq`), `$select`.
roleTemplateId	String	The **i

Graph reference: directoryRoleTemplate

Property	Type	Description
description	String	The description to set for the directory role. Read-only.
displayName	String	The display name to set for the directory role. Read-only.
id	String	The unique identifier for the template. Inherited from directoryObject. You specify the **i

Graph reference: requestSchedule

Property	Type	Description
expiration	expirationPattern	When the eligible or active assignment expires.
recurrence	patternedRecurrence	The frequency of the eligible or active assignment. This property is currently unsupported in PIM.
startDateTime	DateTimeOffset	When the eligible or active assignment becomes active.

Graph reference: scopedRoleMembership

Property	Type	Description
administrativeUnitId	string	Unique identifier for the administrative unit that the directory role is scoped to
ID	string	Unique identifier for the scoped-role membership. Read-only.
roleId	string	Unique identifier for the directory role that the member is in.
roleMemberInfo	identity	Role member identity information. Represents the user that is a member of this scoped-role.

Property	Type	Description
ticketNumber	String	The ticket number.
ticketSystem	String	The description of the ticket system.

Graph reference: unifiedRbacResourceAction

Property	Type	Description
actionVerb	String	HTTP method for the action, such as `DELETE`, `GET`, `PATCH`, `POST`, `PUT`, or `null`. Supports `$filter` (`eq`) but not for `null` values.
description	String	Description for the action. Supports `$filter` (`eq`).
id	String	Unique identifier for an action within the resource namespace, such as `microsoft.insights-programs-update-patch`. can't include slash character (`/`). Case insensitive. Required. Supports `$filter` (`eq`).
isPrivileged	Boolean	Flag indicating if the action is a sensitive resource action. Applies only for actions in the `microsoft.directory` resource namespace. Read-only. Supports `$filter` (`eq`).
name	String	Name for the action within the resource namespace, such as `microsoft.insights/programs/update`. Can include slash character (`/`). Case insensitive. Required. Supports `$filter` (`eq`).
resourceScopeId	String	Not implemented.

Graph reference: unifiedRbacResourceNamespace

Property	Type	Description
id	String	Unique identifier of the resource namespace that defines permissions, such as `microsoft.aad.b2c`. Required.
name	String	Name of the resource namespace. Typically, the same name as the **i

Graph reference: unifiedRoleAssignment

Property	Type	Description
appScopeId	String	Identifier of the app specific scope when the assignment scope is app specific. The scope of an assignment determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by a resource application only. For the entitlement management provider, use this property to specify a catalog. For example, `/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997`. Supports `$filter` (`eq`, `in`). For example, `/roleManagement/entitlementManagement/roleAssignments?$filter=appScopeId eq '/AccessPackageCatalog/{catalog id}'`.
directoryScopeId	String	Identifier of the directory object representing the scope of the assignment. The scope of an assignment determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications, unlike app scopes that are defined and understood by a resource application only. Supports `$filter` (`eq`, `in`).
id	String	The unique identifier for the unifiedRoleAssignment. Key, not nullable, Read-only.
principalId	String	Identifier of the principal to which the assignment is granted. Supported principals are users, role-assignable groups, and service principals. Supports `$filter` (`eq`, `in`).
roleDefinitionId	String	Identifier of the unifiedRoleDefinition the assignment is for. Read-only. Supports `$filter` (`eq`, `in`).

Graph reference: unifiedRoleAssignmentSchedule

Property	Type	Description
appScopeId	String	Identifier of the app-specific scope when the assignment is scoped to an app. The scope of an assignment determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by this application only. Use `/` for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units. Supports `$filter` (`eq`, `ne`, and on `null` values). Inherited from unifiedRoleScheduleBase.
assignmentType	String	The type of the assignment that can either be `Assigned` or `Activated`. Supports `$filter` (`eq`, `ne`).
createdDateTime	DateTimeOffset	When the schedule was created. Inherited from unifiedRoleScheduleBase.
createdUsing	String	Identifier of the unifiedRoleAssignmentScheduleRequest object through which this schedule was created. Nullable. Inherited from unifiedRoleScheduleBase. Supports `$filter` (`eq`, `ne`, and on `null` values).
directoryScopeId	String	Identifier of the directory object representing the scope of the assignment. The scope of an assignment determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use `/` for tenant-wide scope. Use appScopeId to limit the scope to an application only. Supports `$filter` (`eq`, `ne`, and on `null` values). Inherited from unifiedRoleScheduleBase.
id	String	The unique identifier for the unifiedRoleAssignmentScheduleRequest object. Supports `$filter` (`eq`). Inherited from entity.
memberType	String	How the assignment is inherited. It can either be `Inherited`, `Direct`, or `Group`. It can further imply whether the unifiedRoleAssignmentSchedule can be managed by the caller. Supports `$filter` (`eq`, `ne`).
modifiedDateTime	DateTimeOffset	When the schedule was last modified. Inherited from unifiedRoleScheduleBase.
principalId	String	Identifier of the principal that has been granted the role assignment. Inherited from unifiedRoleScheduleBase. Supports `$filter` (`eq`, `ne`).
roleDefinitionId	String	Identifier of the unifiedRoleDefinition object that is being assigned to the principal. Inherited from unifiedRoleScheduleBase. Supports `$filter` (`eq`, `ne`).
scheduleInfo	requestSchedule	The period of the role assignment. It can represent a single occurrence or multiple recurrences.
status	String	The status of the **u

Graph reference: unifiedRoleAssignmentScheduleInstance

Property	Type	Description
appScopeId	String	Identifier of the app-specific scope when the assignment is scoped to an app. The scope of an assignment determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by this application only. Use `/` for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units. Supports `$filter` (`eq`, `ne`, and on `null` values). Inherited from unifiedRoleScheduleInstanceBase.
assignmentType	String	The type of the assignment that can either be `Assigned` or `Activated`. Supports `$filter` (`eq`, `ne`).
directoryScopeId	String	Identifier of the directory object representing the scope of the assignment. The scope of an assignment determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use `/` for tenant-wide scope. Use appScopeId to limit the scope to an application only. Supports `$filter` (`eq`, `ne`, and on `null` values). Inherited from unifiedRoleScheduleInstanceBase.
endDateTime	DateTimeOffset	The end date of the schedule instance.
id	String	The unique identifier for the unifiedRoleAssignmentScheduleInstance object. Inherited from entity.
memberType	String	How the assignment is inherited. It can either be `Inherited`, `Direct`, or `Group`. It can further imply whether the unifiedRoleAssignmentSchedule can be managed by the caller. Supports `$filter` (`eq`, `ne`).
principalId	String	Identifier of the principal that has been granted the role assignment. Inherited from unifiedRoleScheduleInstanceBase. Supports `$filter` (`eq`, `ne`).
roleAssignmentOriginId	String	The identifier of the role assignment in Microsoft Entra. Supports `$filter` (`eq`, `ne`).
roleAssignmentScheduleId	String	The identifier of the unifiedRoleAssignmentSchedule object from which this instance was created. Supports `$filter` (`eq`, `ne`).
roleDefinitionId	String	The identifier of the unifiedRoleDefinition object that is being assigned to the principal. Inherited from unifiedRoleScheduleInstanceBase. Supports `$filter` (`eq`, `ne`).
startDateTime	DateTimeOffset	When this instance starts.

Graph reference: unifiedRoleAssignmentScheduleRequest

Property	Type	Description
action	String	Represents the type of the operation on the role assignment request. The possible values are: `adminAssign`, `adminUpdate`, `adminRemove`, `selfActivate`, `selfDeactivate`, `adminExtend`, `adminRenew`, `selfExtend`, `selfRenew`, `unknownFutureValue`. `adminAssign`: For administrators to assign roles to principals. `adminRemove`: For administrators to remove principals from roles. `adminUpdate`: For administrators to change existing role assignments. `adminExtend`: For administrators to extend expiring assignments. `adminRenew`: For administrators to renew expired assignments. `selfActivate`: For principals to activate their assignments. `selfDeactivate`: For principals to deactivate their active assignments. `selfExtend`: For principals to request to extend their expiring assignments. `selfRenew`: For principals to request to renew their expired assignments.
approvalId	String	The identifier of the approval of the request. Inherited from request.
appScopeId	String	Identifier of the app-specific scope when the assignment is scoped to an app. The scope of an assignment determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by this application only. Use `/` for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units. Supports `$filter` (`eq`, `ne`, and on `null` values).
completedDateTime	DateTimeOffset	The request completion date time. Inherited from request.
createdBy	identitySet	The principal that created this request. Inherited from request. Read-only. Supports `$filter` (`eq`, `ne`, and on `null` values).
createdDateTime	DateTimeOffset	The request creation date time. Inherited from request. Read-only.
customData	String	Free text field to define any custom data for the request. Not used. Inherited from request.
directoryScopeId	String	Identifier of the directory object representing the scope of the assignment. The scope of an assignment determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use `/` for tenant-wide scope. Use appScopeId to limit the scope to an application only. Supports `$filter` (`eq`, `ne`, and on `null` values).
id	String	The unique identifier for the unifiedRoleAssignmentScheduleRequest object. Key, not nullable, Read-only. Inherited from entity. Supports `$filter` (`eq`, `ne`).
isValidationOnly	Boolean	Determines whether the call is a validation or an actual call. Only set this property if you want to check whether an activation is subject to additional rules like MFA before actually submitting the request.
justification	String	A message provided by users and administrators when create they create the unifiedRoleAssignmentScheduleRequest object.
principalId	String	Identifier of the principal that has been granted the assignment. Can be a user, role-assignable group, or a service principal. Supports `$filter` (`eq`, `ne`).
roleDefinitionId	String	Identifier of the unifiedRoleDefinition object that is being assigned to the principal. Supports `$filter` (`eq`, `ne`).
scheduleInfo	requestSchedule	The period of the role assignment. Recurring schedules are currently unsupported.
status	String	The status of the role assignment request. Inherited from request. Read-only. Supports `$filter` (`eq`, `ne`).
targetScheduleId	String	Identifier of the schedule object that's linked to the assignment request. Supports `$filter` (`eq`, `ne`).
ticketInfo	ticketInfo	Ticket details linked to the role assignment request including details of the ticket number and ticket system.

Graph reference: unifiedRoleDefinition

Property	Type	Description
description	String	The description for the unifiedRoleDefinition. Read-only when isBuiltIn is `true`.
displayName	String	The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is `true`. Required. Supports $filter (`eq`, `in`).
id	String	The unique identifier for the role definition. Key, not nullable, Read-only. Inherited from entity. Supports $filter (`eq`, `in`).
isBuiltIn	Boolean	Flag indicating whether the role definition is part of the default set included in Microsoft Entra or a custom definition. Read-only. Supports $filter (`eq`, `in`).
isEnabled	Boolean	Flag indicating whether the role is enabled for assignment. If `false` the role is not available for assignment. Read-only when isBuiltIn is true.
resourceScopes	String collection	List of the scopes or permissions the role definition applies to. Currently only `/` is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment.
rolePermissions	unifiedRolePermission collection	List of permissions included in the role. Read-only when isBuiltIn is `true`. Required.
templateId	String	Custom template identifier that can be set when isBuiltIn is `false` but is read-only when isBuiltIn is `true`. This identifier is typically used if one needs an identifier to be the same across different directories.
version	String	Indicates version of the role definition. Read-only when **i

Graph reference: unifiedRoleEligibilitySchedule

Property	Type	Description
appScopeId	String	Identifier of the app-specific scope when the role eligibility is scoped to an app. The scope of a role eligibility determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by this application only. Use `/` for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units. Inherited from unifiedRoleScheduleBase. Supports `$filter` (`eq`, `ne`, and on `null` values).
createdDateTime	DateTimeOffset	When the schedule was created. Inherited from unifiedRoleScheduleBase.
createdUsing	String	Identifier of the object through which this schedule was created. Inherited from unifiedRoleScheduleBase. Supports `$filter` (`eq`, `ne`, and on `null` values).
directoryScopeId	String	Identifier of the directory object representing the scope of the role eligibility. The scope of a role eligibility determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use `/` for tenant-wide scope. Use appScopeId to limit the scope to an application only. Inherited from unifiedRoleScheduleBase. Supports `$filter` (`eq`, `ne`, and on `null` values).
id	String	The unique identifier for the schedule object. Inherited from entity. Supports `$filter` (`eq`).
memberType	String	How the role eligibility is inherited. It can either be `Inherited`, `Direct`, or `Group`. It can further imply whether the unifiedRoleEligibilitySchedule can be managed by the caller. Supports `$filter` (`eq`, `ne`).
modifiedDateTime	DateTimeOffset	When the schedule was last modified. Inherited from unifiedRoleScheduleBase.
principalId	String	Identifier of the principal that is eligible for a role.Inherited from unifiedRoleScheduleBase. Supports `$filter` (`eq`, `ne`).
roleDefinitionId	String	Identifier of the unifiedRoleDefinition object that a principal is eligible for. Inherited from unifiedRoleScheduleBase.
scheduleInfo	requestSchedule	The period of the role eligibility.
status	String	The status of the role eligibility request. Inherited from unifiedRoleScheduleBase. The possible values are: `Canceled`, `Denied`, `Failed`, `Granted`, `PendingAdminDecision`, `PendingApproval`, `PendingProvisioning`, `PendingScheduleCreation`, `Provisioned`, `Revoked`, and `ScheduleCreated`. Not nullable. Supports `$filter` (`eq`, `ne`).

Graph reference: unifiedRoleEligibilityScheduleInstance

Property	Type	Description
appScopeId	String	Identifier of the app-specific scope when the role eligibility is scoped to an app. The scope of the role eligibility determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by this application only. Use `/` for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units. Inherited from unifiedRoleScheduleInstanceBase. Supports `$filter` (`eq`, `ne`, and on `null` values).
directoryScopeId	String	Identifier of the directory object representing the scope of the role eligibility. The scope of the role eligibility determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use `/` for tenant-wide scope. Use appScopeId to limit the scope to an application only. Inherited from unifiedRoleScheduleInstanceBase. Supports `$filter` (`eq`, `ne`, and on `null` values).
endDateTime	DateTimeOffset	The end date of the schedule instance.
id	String	The unique identifier for the schedule object. Inherited from entity.
memberType	String	How the role eligibility is inherited. It can either be `Inherited`, `Direct`, or `Group`. It can further imply whether the unifiedRoleEligibilitySchedule can be managed by the caller. Supports `$filter` (`eq`, `ne`).
principalId	String	Identifier of the principal that's eligible for a role. Inherited from unifiedRoleScheduleInstanceBase. Supports `$filter` (`eq`, `ne`).
roleDefinitionId	String	Identifier of the unifiedRoleDefinition object that the principal is eligible for. Inherited from unifiedRoleScheduleInstanceBase. Supports `$filter` (`eq`, `ne`).
roleEligibilityScheduleId	String	The identifier of the unifiedRoleEligibilitySchedule object from which this instance was created. Supports `$filter` (`eq`, `ne`).
startDateTime	DateTimeOffset	When this instance starts.

Graph reference: unifiedRoleEligibilityScheduleRequest

Property	Type	Description
action	unifiedRoleScheduleRequestActions	Represents the type of operation on the role eligibility request. The possible values are: `adminAssign`, `adminUpdate`, `adminRemove`, `selfActivate`, `selfDeactivate`, `adminExtend`, `adminRenew`, `selfExtend`, `selfRenew`, `unknownFutureValue`. `adminAssign`: For administrators to assign eligible roles to principals. `adminRemove`: For administrators to remove eligible roles from principals. `adminUpdate`: For administrators to change existing role eligibilities. `adminExtend`: For administrators to extend expiring role eligibilities. `adminRenew`: For administrators to renew expired eligibilities. `selfActivate`: For users to activate their assignments. `selfDeactivate`: For users to deactivate their active assignments. `selfExtend`: For users to request to extend their expiring assignments. `selfRenew`: For users to request to renew their expired assignments.
approvalId	String	The identifier of the approval of the request. Inherited from request.
appScopeId	String	Identifier of the app-specific scope when the role eligibility is scoped to an app. The scope of a role eligibility determines the set of resources for which the principal is eligible to access. App scopes are scopes that are defined and understood by this application only. Use `/` for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units. Supports `$filter` (`eq`, `ne`, and on `null` values).
completedDateTime	DateTimeOffset	The request completion date time. Inherited from request.
createdBy	identitySet	The principal that created this request. Inherited from request.
createdDateTime	DateTimeOffset	The request creation date time. Inherited from request.
customData	String	Free text field to define any custom data for the request. Not used. Inherited from request.
directoryScopeId	String	Identifier of the directory object representing the scope of the role eligibility. The scope of a role eligibility determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use `/` for tenant-wide scope. Use appScopeId to limit the scope to an application only. Supports `$filter` (`eq`, `ne`, and on `null` values).
id	String	The unique identifier for the unifiedRoleEligibilityScheduleRequest object. Key, not nullable, Read-only. Inherited from entity.
isValidationOnly	Boolean	Determines whether the call is a validation or an actual call. Only set this property if you want to check whether an activation is subject to additional rules like MFA before actually submitting the request.
justification	String	A message provided by users and administrators when create they create the unifiedRoleEligibilityScheduleRequest object.
principalId	String	Identifier of the principal that has been granted the role eligibility. Can be a user or a role-assignable group. You can grant only active assignments service principals.Supports `$filter` (`eq`, `ne`).
roleDefinitionId	String	Identifier of the unifiedRoleDefinition object that is being assigned to the principal. Supports `$filter` (`eq`, `ne`).
scheduleInfo	requestSchedule	The period of the role eligibility. Recurring schedules are currently unsupported.
status	String	The status of the role eligibility request. Inherited from request. Read-only. Supports `$filter` (`eq`, `ne`).
targetScheduleId	String	Identifier of the schedule object that's linked to the eligibility request. Supports `$filter` (`eq`, `ne`).
ticketInfo	ticketInfo	Ticket details linked to the role eligibility request including details of the ticket number and ticket system. Optional.

Graph reference: unifiedRoleManagementPolicy

Property	Type	Description
description	String	Description for the policy.
displayName	String	Display name for the policy.
id	String	Unique identifier for the policy.
isOrganizationDefault	Boolean	This can only be set to `true` for a single tenant-wide policy which will apply to all scopes and roles. Set the scopeId to `/` and scopeType to `Directory`. Supports `$filter` (`eq`, `ne`).
lastModifiedBy	identity	The identity who last modified the role setting.
lastModifiedDateTime	DateTimeOffset	The time when the role setting was last modified.
scopeId	String	The identifier of the scope where the policy is created. Can be `/` for the tenant or a group ID. Required.
scopeType	String	The type of the scope where the policy is created. One of `Directory`, `DirectoryRole`, `Group`. Required.

Graph reference: unifiedRoleManagementPolicyApprovalRule

Property	Type	Description
id	String	Identifier for the rule. Inherited from entity.
setting	approvalSettings	The settings for approval of the role assignment.
target	unifiedRoleManagementPolicyRuleTarget	Defines details of the scope that's targeted by the approval rule. The details can include the principal type, the role assignment type, and actions affecting a role. Inherited from unifiedRoleManagementPolicyRule. Supports `$filter` (`eq`, `ne`).

Graph reference: unifiedRoleManagementPolicyAssignment

Property	Type	Description
id	String	Unique identifier for the policy assignment. The ID is typically a concatenation of the unifiedRoleManagementPolicy ID and the roleDefinitionId separated by an underscore.
policyId	String	The id of the policy. Inherited from entity.
roleDefinitionId	String	For Microsoft Entra roles policy, it's the identifier of the role definition object where the policy applies. For PIM for groups membership and ownership, it's either `member` or `owner`. Supports $filter (`eq`).
scopeId	String	The identifier of the scope where the policy is assigned. Can be `/` for the tenant or a group ID. Required.
scopeType	String	The type of the scope where the policy is assigned. One of `Directory`, `DirectoryRole`, `Group`. Required.

Graph reference: unifiedRoleManagementPolicyAuthenticationContextRule

Property	Type	Description
claimValue	String	The value of the authentication context claim.
id	String	Identifier for the rule. Inherited from entity.
isEnabled	Boolean	Determines whether this rule is enabled.
target	unifiedRoleManagementPolicyRuleTarget	Defines details of the scope that the enablement rule targets. The details can include the principal type, the role assignment type, and actions affecting a role. Inherited from unifiedRoleManagementPolicyRule. Supports `$filter` (`eq`, `ne`).

Graph reference: unifiedRoleManagementPolicyEnablementRule

Property	Type	Description
enabledRules	String collection	The collection of rules that are enabled for this policy rule. For example, `MultiFactorAuthentication`, `Ticketing`, and `Justification`.
id	String	Identifier for the rule. Inherited from entity.
target	unifiedRoleManagementPolicyRuleTarget	Defines details of the scope that's targeted by the enablement rule. The details can include the principal type, the role assignment type, and actions affecting a role. Inherited from unifiedRoleManagementPolicyRule. Supports `$filter` (`eq`, `ne`).

Graph reference: unifiedRoleManagementPolicyExpirationRule

Property	Type	Description
id	String	Identifier for the rule. Inherited from entity.
isExpirationRequired	Boolean	Indicates whether expiration is required or if it's a permanently active assignment or eligibility.
maximumDuration	Duration	The maximum duration allowed for eligibility or assignment that isn't permanent. Required when isExpirationRequired is `true`.
target	unifiedRoleManagementPolicyRuleTarget	Defines details of the scope that's targeted by the expiration rule. The details can include the principal type, the role assignment type, and actions affecting a role. Inherited from unifiedRoleManagementPolicyRule. Supports `$filter` (`eq`, `ne`).

Graph reference: unifiedRoleManagementPolicyNotificationRule

Property	Type	Description
id	String	Identifier for the rule. Inherited from entity.
isDefaultRecipientsEnabled	Boolean	Indicates whether a default recipient will receive the notification email.
notificationLevel	String	The level of notification. The possible values are `None`, `Critical`, `All`.
notificationRecipients	String collection	The list of recipients of the email notifications.
notificationType	String	The type of notification. Only `Email` is supported.
recipientType	String	The type of recipient of the notification. The possible values are `Requestor`, `Approver`, `Admin`.
target	unifiedRoleManagementPolicyRuleTarget	Defines details of the scope that's targeted by the notification rule. The details can include the principal type, the role assignment type, and actions affecting a role. Inherited from unifiedRoleManagementPolicyRule. Supports `$filter` (`eq`, `ne`).

Graph reference: unifiedRoleManagementPolicyRule

Property	Type	Description
id	String	Identifier for the rule. Inherited from entity. Read-only.
target	unifiedRoleManagementPolicyRuleTarget	Defines details of scope that's targeted by role management policy rule. The details can include the principal type, the role assignment type, and actions affecting a role. Supports `$filter` (`eq`, `ne`).

Graph reference: unifiedRoleManagementPolicyRuleTarget

Property	Type	Description
caller	String	The type of caller that's the target of the policy rule. Allowed values are: `None`, `Admin`, `EndUser`.
enforcedSettings	String collection	The list of role settings that are enforced and cannot be overridden by child scopes. Use `All` for all settings.
inheritableSettings	String collection	The list of role settings that can be inherited by child scopes. Use `All` for all settings.
level	String	The role assignment type that's the target of policy rule. Allowed values are: `Eligibility`, `Assignment`.
operations	String collection	The role management operations that are the target of the policy rule. Allowed values are: `All`, `Activate`, `Deactivate`, `Assign`, `Update`, `Remove`, `Extend`, `Renew`.

Graph reference: unifiedRolePermission

Property	Type	Description
allowedResourceActions	String collection	Set of tasks that can be performed on a resource. Required.
condition	String	Optional constraints that must be met for the permission to be effective. Not supported for custom roles.
excludedResourceActions	String collection	Set of tasks that may not be performed on a resource. Not yet supported.

Graph reference: user

Property	Type	Description
aboutMe	String	A freeform text entry field for the user to describe themselves. Returned only on `$select`.
accountEnabled	Boolean	`true` if the account is enabled; otherwise, `false`. This property is required when a user is created. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, and `in`).
ageGroup	ageGroup	Sets the age group of the user. Allowed values: `null`, `Minor`, `NotAdult`, and `Adult`. For more information, see legal age group property definitions. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, and `in`).
assignedLicenses	assignedLicense collection	The licenses that are assigned to the user, including inherited (group-based) licenses. This property doesn't differentiate between directly assigned and inherited licenses. Use the licenseAssignmentStates property to identify the directly assigned and inherited licenses. Not nullable. Returned only on `$select`. Supports `$filter` (`eq`, `not`, `/$count eq 0`, `/$count ne 0`).
assignedPlans	assignedPlan collection	The plans that are assigned to the user. Read-only. Not nullable. Returned only on `$select`. Supports `$filter` (`eq` and `not`).
birthday	DateTimeOffset	The birthday of the user. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is `2014-01-01T00:00:00Z`. Returned only on `$select`.
businessPhones	String collection	The telephone numbers for the user. NOTE: Although it's a string collection, only one number can be set for this property. Read-only for users synced from the on-premises directory. Returned by default. Supports `$filter` (`eq`, `not`, `ge`, `le`, `startsWith`).
city	String	The city where the user is located. Maximum length is 128 characters. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
companyName	String	The name of the company that the user is associated with. This property can be useful for describing the company that a guest comes from. The maximum length is 64 characters. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
consentProvidedForMinor	consentProvidedForMinor	Sets whether consent was obtained for minors. Allowed values: `null`, `Granted`, `Denied`, and `NotRequired`. For more information, see legal age group property definitions. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, and `in`).
country	String	The country/region where the user is located; for example, `US` or `UK`. Maximum length is 128 characters. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
createdDateTime	DateTimeOffset	The date and time the user was created, in ISO 8601 format and UTC. The value can't be modified and is automatically populated when the entity is created. Nullable. For on-premises users, the value represents when they were first created in Microsoft Entra ID. Property is `null` for some users created before June 2018 and on-premises users that were synced to Microsoft Entra ID before June 2018. Read-only. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not` , `ge`, `le`, `in`).
creationType	String	Indicates whether the user account was created through one of the following methods: As a regular school or work account (`null`). As an external account (`Invitation`). As a local account for an Azure Active Directory B2C tenant (`LocalAccount`). Through self-service sign-up by an internal user using email verification (`EmailVerified`). Through self-service sign-up by a guest signing up through a link that is part of a user flow (`SelfServiceSignUp`). Read-only. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `in`).
customSecurityAttributes	customSecurityAttributeValue	An open complex type that holds the value of a custom security attribute that is assigned to a directory object. Nullable. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `startsWith`). The filter value is case-sensitive. To read this property, the calling app must be assigned the CustomSecAttributeAssignment.Read.All permission. To write this property, the calling app must be assigned the CustomSecAttributeAssignment.ReadWrite.All permissions. To read or write this property in delegated scenarios, the admin must be assigned the Attribute Assignment Administrator role.
deletedDateTime	DateTimeOffset	The date and time the user was deleted. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`).
department	String	The name of the department in which the user works. Maximum length is 64 characters. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not` , `ge`, `le`, `in`, and `eq` on `null` values).
displayName	String	The name displayed in the address book for the user. This value is usually the combination of the user's first name, middle initial, and family name. This property is required when a user is created and it can't be cleared during updates. Maximum length is 256 characters. Returned by default. Supports `$filter` (`eq`, `ne`, `not` , `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values), `$orderby`, and `$search`.
employeeHireDate	DateTimeOffset	The date and time when the user was hired or will start work in a future hire. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not` , `ge`, `le`, `in`).
employeeLeaveDateTime	DateTimeOffset	The date and time when the user left or will leave the organization. To read this property, the calling app must be assigned the User-LifeCycleInfo.Read.All permission. To write this property, the calling app must be assigned the User.Read.All and User-LifeCycleInfo.ReadWrite.All permissions. To read this property in delegated scenarios, the admin needs at least one of the following Microsoft Entra roles: Lifecycle Workflows Administrator (least privilege), Global Reader. To write this property in delegated scenarios, the admin needs the Global Administrator role. Supports `$filter` (`eq`, `ne`, `not` , `ge`, `le`, `in`). For more information, see Configure the employeeLeaveDateTime property for a user.
employeeId	String	The employee identifier assigned to the user by the organization. The maximum length is 16 characters. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not` , `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
employeeOrgData	employeeOrgData	Represents organization data (for example, division and costCenter) associated with a user. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not` , `ge`, `le`, `in`).
employeeType	String	Captures enterprise worker type. For example, `Employee`, `Contractor`, `Consultant`, or `Vendor`. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not` , `ge`, `le`, `in`, `startsWith`).
externalUserState	String	For a guest invited to the tenant using the invitation API, this property represents the invited user's invitation status. For invited users, the state can be `PendingAcceptance` or `Accepted`, or `null` for all other users. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not` , `in`).
externalUserStateChangeDateTime	DateTimeOffset	Shows the timestamp for the latest change to the externalUserState property. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not` , `in`).
faxNumber	String	The fax number of the user. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not` , `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
givenName	String	The given name (first name) of the user. Maximum length is 64 characters. Returned by default. Supports `$filter` (`eq`, `ne`, `not` , `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
hireDate	DateTimeOffset	The hire date of the user. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014, is `2014-01-01T00:00:00Z`. Returned only on `$select`. Note: This property is specific to SharePoint in Microsoft 365. We recommend using the native employeeHireDate property to set and update hire date values using Microsoft Graph APIs.
id	String	The unique identifier for the user. Should be treated as an opaque identifier. Inherited from directoryObject. Key. Not nullable. Read-only. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `in`).
identities	objectIdentity collection	Represents the identities that can be used to sign in to this user account. Microsoft (also known as a local account), organizations, or social identity providers such as Facebook, Google, and Microsoft can provide identity and tie it to a user account. It might contain multiple items with the same signInType value. Returned only on `$select`. Supports `$filter` (`eq`) with limitations.
imAddresses	String collection	The instant message voice-over IP (VOIP) session initiation protocol (SIP) addresses for the user. Read-only. Returned only on `$select`. Supports `$filter` (`eq`, `not`, `ge`, `le`, `startsWith`).
interests	String collection	A list for the user to describe their interests. Returned only on `$select`.
isResourceAccount	Boolean	Don't use – reserved for future use.
jobTitle	String	The user's job title. Maximum length is 128 characters. Returned by default. Supports `$filter` (`eq`, `ne`, `not` , `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
lastPasswordChangeDateTime	DateTimeOffset	The time when this Microsoft Entra user last changed their password or when their password was created, whichever date the latest action was performed. The date and time information uses ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Returned only on `$select`.
legalAgeGroupClassification	legalAgeGroupClassification	Used by enterprise applications to determine the legal age group of the user. This property is read-only and calculated based on ageGroup and consentProvidedForMinor properties. Allowed values: `null`, `MinorWithOutParentalConsent`, `MinorWithParentalConsent`, `MinorNoParentalConsentRequired`, `NotAdult`, and `Adult`. For more information, see legal age group property definitions. Returned only on `$select`.
licenseAssignmentStates	licenseAssignmentState collection	State of license assignments for this user. Also indicates licenses that are directly assigned or the user inherited through group memberships. Read-only. Returned only on `$select`.
mail	String	The SMTP address for the user, for example, `[email protected]`. Changes to this property update the user's proxyAddresses collection to include the value as an SMTP address. This property can't contain accent characters. NOTE: We don't recommend updating this property for Azure AD B2C user profiles. Use the otherMails property instead. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, `endsWith`, and `eq` on `null` values).
mailboxSettings	mailboxSettings	Settings for the primary mailbox of the signed-in user. You can get or update settings for sending automatic replies to incoming messages, locale, and time zone. Returned only on `$select`.
mailNickname	String	The mail alias for the user. This property must be specified when a user is created. Maximum length is 64 characters. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
mobilePhone	String	The primary cellular telephone number for the user. Read-only for users synced from the on-premises directory. Maximum length is 64 characters. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values) and `$search`.
mySite	String	The URL for the user's site. Returned only on `$select`.
officeLocation	String	The office location in the user's place of business. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
onPremisesDistinguishedName	String	Contains the on-premises Active Directory `distinguished name` or `DN`. The property is only populated for customers who are synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Read-only. Returned only on `$select`.
onPremisesDomainName	String	Contains the on-premises `domainFQDN`, also called dnsDomainName synchronized from the on-premises directory. The property is only populated for customers who are synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Read-only. Returned only on `$select`.
onPremisesExtensionAttributes	onPremisesExtensionAttributes	Contains extensionAttributes1-15 for the user. These extension attributes are also known as Exchange custom attributes 1-15. Each attribute can store up to 1024 characters. For an onPremisesSyncEnabled user, the source of authority for this set of properties is the on-premises and is read-only. For a cloud-only user (where onPremisesSyncEnabled is `false`), these properties can be set during the creation or update of a user object. For a cloud-only user previously synced from on-premises Active Directory, these properties are read-only in Microsoft Graph but can be fully managed through the Exchange Admin Center or the Exchange Online V2 module in PowerShell. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `in`).
onPremisesImmutableId	String	This property is used to associate an on-premises Active Directory user account to their Microsoft Entra user object. This property must be specified when creating a new user account in the Graph if you're using a federated domain for the user's userPrincipalName (UPN) property. NOTE: The $ and _ characters can't be used when specifying this property. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`).
onPremisesLastSyncDateTime	DateTimeOffset	Indicates the last time at which the object was synced with the on-premises directory; for example: `2013-02-16T03:04:54Z`. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`).
onPremisesProvisioningErrors	onPremisesProvisioningError collection	Errors when using Microsoft synchronization product during provisioning. Returned only on `$select`. Supports `$filter` (`eq`, `not`, `ge`, `le`).
onPremisesSamAccountName	String	Contains the on-premises `samAccountName` synchronized from the on-premises directory. The property is only populated for customers who are synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Read-only. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`).
onPremisesSecurityIdentifier	String	Contains the on-premises security identifier (SID) for the user that was synchronized from on-premises to the cloud. Read-only. Returned only on `$select`. Supports `$filter` (`eq` including on `null` values).
onPremisesSyncEnabled	Boolean	`true` if this user object is currently being synced from an on-premises Active Directory (AD); otherwise the user isn't being synced and can be managed in Microsoft Entra ID. Read-only. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `in`, and `eq` on `null` values).
onPremisesUserPrincipalName	String	Contains the on-premises `userPrincipalName` synchronized from the on-premises directory. The property is only populated for customers who are synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Read-only. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`).
otherMails	String collection	A list of other email addresses for the user; for example: `["[email protected]", "[email protected]"]`. NOTE: This property can't contain accent characters. Returned only on `$select`. Supports `$filter` (`eq`, `not`, `ge`, `le`, `in`, `startsWith`, `endsWith`, `/$count eq 0`, `/$count ne 0`).
passwordPolicies	String	Specifies password policies for the user. This value is an enumeration with one possible value being `DisableStrongPassword`, which allows weaker passwords than the default policy to be specified. `DisablePasswordExpiration` can also be specified. The two might be specified together; for example: `DisablePasswordExpiration, DisableStrongPassword`. Returned only on `$select`. For more information on the default password policies, see Microsoft Entra password policies. Supports `$filter` (`ne`, `not`, and `eq` on `null` values).
passwordProfile	passwordProfile	Specifies the password profile for the user. The profile contains the user's password. This property is required when a user is created. The password in the profile must satisfy minimum requirements as specified by the passwordPolicies property. By default, a strong password is required. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `in`, and `eq` on `null` values). To update this property: In delegated access, the calling app must be assigned the User-PasswordProfile.ReadWrite.All delegated permission on behalf of the signed-in user. In application-only access, the calling app must be assigned the User-PasswordProfile.ReadWrite.All application permission and at least the User Administrator Microsoft Entra role.
pastProjects	String collection	A list for the user to enumerate their past projects. Returned only on `$select`.
postalCode	String	The postal code for the user's postal address. The postal code is specific to the user's country/region. In the United States of America, this attribute contains the ZIP code. Maximum length is 40 characters. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
preferredDataLocation	String	The preferred data location for the user. For more information, see OneDrive Online Multi-Geo.
preferredLanguage	String	The preferred language for the user. The preferred language format is based on RFC 4646. The name is a combination of an ISO 639 two-letter lowercase culture code associated with the language, and an ISO 3166 two-letter uppercase subculture code associated with the country or region. Example: "en-US", or "es-ES". Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values)
preferredName	String	The preferred name for the user. Not Supported. This attribute returns an empty string. Returned only on `$select`.
provisionedPlans	provisionedPlan collection	The plans that are provisioned for the user. Read-only. Not nullable. Returned only on `$select`. Supports `$filter` (`eq`, `not`, `ge`, `le`).
proxyAddresses	String collection	For example: `"SMTP: [email protected]", "smtp: [email protected]"]`. Changes to the mail property update this collection to include the value as an SMTP address. For more information, see [mail and proxyAddresses properties. The proxy address prefixed with `SMTP` (capitalized) is the primary proxy address, while those addresses prefixed with `smtp` are the secondary proxy addresses. For Azure AD B2C accounts, this property has a limit of 10 unique addresses. Read-only in Microsoft Graph; you can update this property only through the Microsoft 365 admin center. Not nullable. Returned only on `$select`. Supports `$filter` (`eq`, `not`, `ge`, `le`, `startsWith`, `endsWith`, `/$count eq 0`, `/$count ne 0`).
refreshTokensValidFromDateTime	DateTimeOffset	Any refresh tokens or session tokens (session cookies) issued before this time are invalid. Applications get an error when using an invalid refresh or session token to acquire a delegated access token (to access APIs such as Microsoft Graph). If this happens, the application needs to acquire a new refresh token by requesting the authorized endpoint. Returned only on `$select`. Read-only.
responsibilities	String collection	A list for the user to enumerate their responsibilities. Returned only on `$select`.
serviceProvisioningErrors	serviceProvisioningError collection	Errors published by a federated service describing a nontransient, service-specific error regarding the properties or link from a user object. Supports `$filter` (`eq`, `not`, for isResolved and serviceInstance).
schools	String collection	A list for the user to enumerate the schools they attended. Returned only on `$select`.
securityIdentifier	String	Security identifier (SID) of the user, used in Windows scenarios. Read-only. Returned by default. Supports `$select` and `$filter` (`eq`, `not`, `ge`, `le`, `startsWith`).
showInAddressList	Boolean	Do not use in Microsoft Graph. Manage this property through the Microsoft 365 admin center instead. Represents whether the user should be included in the Outlook global address list. See Known issue.
signInActivity	signInActivity	Get the last signed-in date and request ID of the sign-in for a given user. Read-only. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`) but not with any other filterable properties. Note: Details for this property require a Microsoft Entra ID P1 or P2 license and the AuditLog.Read.All permission. This property isn't returned for a user who never signed in or last signed in before April 2020.
signInSessionsValidFromDateTime	DateTimeOffset	Any refresh tokens or session tokens (session cookies) issued before this time are invalid. Applications get an error when using an invalid refresh or session token to acquire a delegated access token (to access APIs such as Microsoft Graph). If this happens, the application needs to acquire a new refresh token by requesting the authorized endpoint. Read-only. Use revokeSignInSessions to reset. Returned only on `$select`.
skills	String collection	A list for the user to enumerate their skills. Returned only on `$select`.
state	String	The state or province in the user's address. Maximum length is 128 characters. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
streetAddress	String	The street address of the user's place of business. Maximum length is 1,024 characters. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
surname	String	The user's surname (family name or last name). Maximum length is 64 characters. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
usageLocation	String	A two-letter country code (ISO standard 3166). Required for users that are assigned licenses due to legal requirements to check for availability of services in countries. Examples include: `US`, `JP`, and `GB`. Not nullable. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
userPrincipalName	String	The user principal name (UPN) of the user. The UPN is an Internet-style sign-in name for the user based on the Internet standard RFC 822. By convention, this value should map to the user's email name. The general format is alias@domain, where the domain must be present in the tenant's collection of verified domains. This property is required when a user is created. The verified domains for the tenant can be accessed from the verifiedDomains property of organization. NOTE: This property can't contain accent characters. Only the following characters are allowed `A - Z`, `a - z`, `0 - 9`, `' . - _ ! # ^ ~`. For the complete list of allowed characters, see username policies. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, `endsWith`) and `$orderby`.
userType	String	A string value that can be used to classify user types in your directory. The possible values are `Member` and `Guest`. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `in`, and `eq` on `null` values). **N

Table of Contents

RoleManagement.ReadWrite.Directory

Caution

Graph Methods

Resources