Update unifiedRoleDefinition

Namespace: microsoft.graph

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported.

Update the properties of a unifiedRoleDefinition object.

Permissions

One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.

Permission type Permissions (from least to most privileged)
Delegated (work or school account) RoleManagement.Read.Directory, RoleManagement.ReadWrite.Directory
Delegated (personal Microsoft account) Not supported.
Application RoleManagement.Read.Directory, RoleManagement.ReadWrite.Directory

HTTP request

PATCH /roleManagement/directory/roleDefinitions/{id}

Request headers

Name Description
Authorization Bearer {token}

Request body

In the request body, supply the values for relevant fields that should be updated. Existing properties that are not included in the request body will maintain their previous values or be recalculated based on changes to other property values. For best performance, don't include existing values that haven't changed.

Property Type Description
description String The description for the role definition. Read-only when isBuiltIn is true.
displayName String The display name for the role definition. Read-only when isBuiltIn is true. Required.
id String The unique identifier for the role definition. Key, not nullable, Read-only.
isBuiltIn Boolean Flag indicating if the role definition is part of the default set included with the product or custom. Read-only.
isEnabled Boolean Flag indicating if the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true.
resourceScopes String collection List of scopes permissions granted by the role definition apply to. Currently only "/" is supported. Read-only when isBuiltIn is true.
rolePermissions unifiedRolePermission collection List of permissions included in the role. Read-only when isBuiltIn is true. Required.
templateId String Custom template identifier that can be set when isBuiltIn is false. This identifier is typically used if one needs an identifier to be the same across different directories. Read-only when isBuiltIn is true.
version String Indicates version of the role definition. Read-only when isBuiltIn is true.

Response

If successful, this method returns a 200 OK response code and an updated unifiedRoleDefinition object in the response body.

Example

Request

The following is an example of the request.

PATCH https://graph.microsoft.com/beta/roleManagement/directory/roleDefinitions/0d55728d-3e24-4309-9b1b-5ac09921475a
Content-type: application/json

{
  "description": "Update basic properties of application registrations",
  "displayName": "Application Registration Support Administrator",
  "rolePermissions":
    [
        {
            "allowedResourceActions": 
            [
                "microsoft.directory/applications/basic/read"
            ]
        }
    ]
}

Response

The following is an example of the response.

Note: The response object shown here might be shortened for readability. All the properties will be returned from an actual call.

HTTP/1.1 204 OK
Content-type: application/json