Set user roles for a customer

Applies To

  • Partner Center

Within a customer account, there's a set of directory roles. You can assign user accounts to those roles.


  • Credentials as described in Partner Center authentication. This scenario supports authentication with App+User credentials only.
  • A customer ID (customer-tenant-id). If you do not have a customer's ID, you can look up the ID in Partner Center by choosing the customer from the customers list, selecting Account, then saving their Microsoft ID.


To assign a directory role to a customer user, create a new UserMember with the relevant user details. Then, call the IAggregatePartner.Customers.ById method with the specified customer ID to identify the customer. From there, use the DirectoryRoles.ById method with the directory role ID to specify the role. Then, access the UserMembers collection, and use the Create method to add the new user member to the collection of user members assigned to that role.

// UserMember createdUser;
// IAggregatePartner partnerOperations;
// Customer selectedCustomer;
// IDirectoryRole selectedRole;

// Create the new user member.
UserMember userMemberToAdd = new UserMember()
    UserPrincipalName = createdUser.UserPrincipalName,
    DisplayName = createdUser.DisplayName,
    Id = createdUser.Id

// Add the new user member to the role.
var userMemberAdded = partnerOperations.Customers.ById(selectedCustomer.Id).DirectoryRoles.ById(selectedRole.Id).UserMembers.Create(userMemberToAdd);

Sample: Console test app. Project: Partner Center SDK Samples Class: AddUserMemberToDirectoryRole.cs

REST Request

Request syntax

Method Request URI
POST {baseURL}/v1/customers/{customer-tenant-id}/directoryroles/{role-ID}/usermembers HTTP/1.1

URI parameter

Use the following URI parameters to identify the correct customer and role. To identify the user to whom to assign the role, supply the identifying information in the request body.

Name Type Required Description
customer-tenant-id guid Y The value is a GUID formatted customer-tenant-id that allows the reseller to filter the results for a given customer that belongs to the reseller.
role-id guid Y The value is a GUID formatted role-id that identifies the role to assign to the user.

Request headers

Request body

This table describes the required properties in the request body.

Name Type Required Description
Id string Y The Id of the user to add to the role.
DisplayName string Y The friendly display name of the user.
UserPrincipalName string Y The name of the user principal.
Attributes object Y Contains "ObjectType":"UserMember"

Request example

Authorization: Bearer <token>
Accept: application/json
MS-RequestId: a56cb2e5-a156-4f68-9155-57ffe2b93d18
MS-CorrelationId: 90bda268-7929-4ad6-be01-89c5af5fc504
X-Locale: en-US
Content-Type: application/json
Content-Length: 180
Expect: 100-continue

    "Id": "a9ef48bb-8758-4590-a312-d4a47bfaded4",
    "DisplayName": "Daniel Tsai",
    "UserPrincipalName": "",
    "Attributes": {
        "ObjectType": "UserMember"

REST Response

This method returns the user account with the role id attached when the user is successfully assigned the role.

Response success and error codes

Each response comes with an HTTP status code that indicates success or failure and additional debugging information. Use a network trace tool to read this code, error type, and additional parameters. For the full list, see Partner Center REST error codes.

Response example

HTTP/1.1 201 Created
Content-Length: 231
Content-Type: application/json; charset=utf-8
MS-CorrelationId: 90bda268-7929-4ad6-be01-89c5af5fc504
MS-RequestId: a56cb2e5-a156-4f68-9155-57ffe2b93d18
MS-CV: aia94+gnrEeQqkGr.0
MS-ServerId: 101112202
Date: Tue, 20 Dec 2016 23:36:55 GMT

    "displayName": "Daniel Tsai",
    "userPrincipalName": "",
    "roleId": "f023fd81-a637-4b56-95fd-791ac0226033",
    "id": "a9ef48bb-8758-4590-a312-d4a47bfaded4",
    "attributes": {
        "objectType": "UserMember"