privilegedRole: selfActivate

Namespace: microsoft.graph


APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported.

Activate the role that is assigned to the requester.

Note: Effective December 2018, this API will no longer be supported and should not be used. Use the Create PrivilegedRoleAssignmentRequest instead.


One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.

The requestor can only call selfActivate for the role that is assigned to him.

Permission type Permissions (from least to most privileged)
Delegated (work or school account) Directory.AccessAsUser.All
Delegated (personal Microsoft account) Not supported.
Application Not supported.

HTTP request

POST /privilegedRoles/{id}/selfActivate

Note that {id} is the target role ID.

Request headers

Name Description
Authorization Bearer {token}. Required.

Request body

In the request body, provide a JSON object with the following parameters.

Parameter Type Description
reason string Optional. Description about the reason for this role activation.
duration string Optional. Valid values could be min (minimal activation duration), default (default activation duration for the role), or a double value to specify how many hours is the activation. The specified duration cannot be longer than the role's activation duration from the role setting.
ticketNumber string Optional. The ticket number that is used to tracking this role activation.
ticketSystem string Optional. The ticket system.


If successful, this method returns a 200 OK response code and a privilegedRoleAssignment object in the response body.

Note that the tenant needs to be registered to PIM. Otherwise, the HTTP 403 Forbidden status code will be returned.


The following example shows how to call this API.


Here is an example of the request.

Content-type: application/json
Content-length: 142

  "reason": "reason-value",
  "duration": "duration-value",
  "ticketNumber": "ticketNumber-value",
  "ticketSystem": "ticketSystem-value"

Here is an example of the response.

Note: The response object shown here might be shortened for readability. All the properties will be returned from an actual call.

HTTP/1.1 200 OK
Content-type: application/json
Content-length: 184

  "id": "id-value",
  "userId": "userId-value",
  "roleId": "roleId-value",
  "isElevated": true,
  "expirationDateTime": "2016-10-19T10:37:00Z",
  "resultMessage": "resultMessage-value"