ESC
Type to search...
↑↓ Navigate ↵ Open ESC Close

AppRoleAssignment.ReadWrite.All

Export JSON
Export CSV
Copy URL
Print
ApplicationDelegated Read/Write All Resources

Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.

Permission data: April 6, 2026 at 4:06 AM UTC
Delegated Access App-Only Access

Permission Details

Application Permission

Manage app permission grants and app role assignments

Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.

Permission ID: 06b708a9-e830-4db3-a914-8e69da51d44f
Delegated Permission Admin consent required

Manage app permission grants and app role assignments

Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.

User sees: Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on your behalf.
Permission ID: 84bccea3-f856-4a8a-967b-dbe0a3d53a64

Properties

Microsoft Graph v1.0 exact-category-docs

Properties is shown from stable Microsoft Graph v1.0 metadata.

Property Type Description
appRoleId Guid The identifier (id) for the app role that's assigned to the principal. This app role must be exposed in the appRoles property on the resource application's service principal (resourceId). If the resource application hasn't declared any app roles, a default app role ID of 00000000-0000-0000-0000-000000000000 can be specified to signal that the principal is assigned to the resource app without any specific app roles. Required on create.
createdDateTime DateTimeOffsetNullable The time when the app role assignment was created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.
deletedDateTime DateTimeOffsetNullable The date and time when the app role assignment was deleted. Always null for an appRoleAssignment object that hasn't been deleted. Inherited from directoryObject.
id String A unique identifier for the appRoleAssignment key. Not nullable. Read-only. Supports $filter (eq only).
principalDisplayName StringNullable The display name of the user, group, or service principal that was granted the app role assignment. Maximum length is 256 characters. Read-only. Supports $filter (eq and startswith).
principalId GuidNullable The unique identifier (id) for the user, security group, or service principal being granted the app role. Security groups with dynamic memberships are supported. Required on create.
principalType StringNullable The type of the assigned principal. This can either be User, Group, or ServicePrincipal. Read-only.
resourceDisplayName StringNullable The display name of the resource app's service principal to which the assignment is made. Maximum length is 256 characters.
resourceId GuidNullable The unique identifier (id) for the resource service principal for which the assignment is made. Required on create. Supports $filter (eq only).

JSON Representation

Microsoft Graph v1.0 exact-category-docs

JSON representation is shown from stable Microsoft Graph v1.0 metadata.

JSON representation 
{
  "appRoleId": "Guid",
  "createdDateTime": "String (timestamp)",
  "deletedDateTime": "String (timestamp)",
  "id": "String",
  "principalDisplayName": "String",
  "principalId": "Guid",
  "principalType": "String",
  "resourceDisplayName": "String",
  "resourceId": "Guid"
}

Relationships

Microsoft Graph v1.0 schema-derived

Relationships is shown from stable Microsoft Graph v1.0 metadata.

Relationship Type Description
appRoleId uuid The identifier (id) for the app role that's assigned to the principal. This app role must be exposed in the appRoles property on the resource application's service principal (resourceId). If the resource application hasn't declared any app roles, a default app role ID of 00000000-0000-0000-0000-000000000000 can be specified to signal that the principal is assigned to the resource app without any specific app roles. Required on create.
principalId uuid The unique identifier (id) for the user, security group, or service principal being granted the app role. Security groups with dynamic memberships are supported. Required on create.
resourceId uuid The unique identifier (id) for the resource service principal for which the assignment is made. Required on create. Supports $filter (eq only).

Graph Methods

Delegated access App-only access
Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET /groups/{id}/appRoleAssignments
GET /me/appRoleAssignments
GET /users/{id | userPrincipalName}/appRoleAssignments
POST /groups/{groupId}/appRoleAssignments
POST /servicePrincipals(appId='{appId}')/appRoleAssignedTo
POST /servicePrincipals(appId='{appId}')/appRoleAssignments
POST /servicePrincipals/{id}/appRoleAssignedTo
POST /servicePrincipals/{id}/appRoleAssignments
POST /users/{id | userPrincipalName}/appRoleAssignments
DELETE /groups/{id}/appRoleAssignments/{id}
DELETE /servicePrincipals(appId='{appId}')/appRoleAssignedTo/{appRoleAssignment-id}
DELETE /servicePrincipals(appId='{appId}')/appRoleAssignments/{appRoleAssignment-id}
DELETE /servicePrincipals/{id}/appRoleAssignedTo/{appRoleAssignment-id}
DELETE /servicePrincipals/{servicePrincipal-id}/appRoleAssignments/{appRoleAssignment-id}
DELETE /users/{id}/appRoleAssignments/{id}
Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET /groups/{id}/appRoleAssignments
GET /me/appRoleAssignedResources
GET /me/appRoleAssignments
GET /users/{id | userPrincipalName}/appRoleAssignments
GET /users/{userId}/appRoleAssignedResources
GET /users/{usersId}/appRoleAssignments
POST /groups/{groupId}/appRoleAssignments
POST /servicePrincipals(appId='{appId}')/appRoleAssignedTo
POST /servicePrincipals(appId='{appId}')/appRoleAssignments
POST /servicePrincipals/{id}/appRoleAssignedTo
POST /servicePrincipals/{id}/appRoleAssignments
POST /users/{id | userPrincipalName}/appRoleAssignments
POST /users/{usersId}/appRoleAssignments
DELETE /groups/{id}/appRoleAssignments/{id}
DELETE /servicePrincipals/{resource-SP-id}/appRoleAssignedTo/{appRoleAssignment-id}
DELETE /servicePrincipals/{servicePrincipal-id}/appRoleAssignments/{appRoleAssignment-id}
DELETE /users/{id}/appRoleAssignments/{id}
Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
Get-MgGroupAppRoleAssignment /groups/{id}/appRoleAssignments
List appRoleAssignments granted to a group
Get-MgUserAppRoleAssignment /users/{id | userPrincipalName}/appRoleAssignments
List appRoleAssignments granted to a user
New-MgGroupAppRoleAssignment /groups/{groupId}/appRoleAssignments
Grant an appRoleAssignment to a group
New-MgServicePrincipalAppRoleAssignedTo /servicePrincipals/{id}/appRoleAssignedTo
Grant an appRoleAssignment for a service principal
New-MgServicePrincipalAppRoleAssignment /servicePrincipals/{id}/appRoleAssignments
Grant an appRoleAssignment to a service principal
New-MgUserAppRoleAssignment /users/{id | userPrincipalName}/appRoleAssignments
Grant an appRoleAssignment to a user
Remove-MgGroupAppRoleAssignment /groups/{id}/appRoleAssignments/{id}
Delete appRoleAssignment
Remove-MgServicePrincipalAppRoleAssignedTo /servicePrincipals/{id}/appRoleAssignedTo/{appRoleAssignment-id}
Delete appRoleAssignedTo
Remove-MgServicePrincipalAppRoleAssignment /servicePrincipals/{servicePrincipal-id}/appRoleAssignments/{appRoleAssignment-id}
Delete appRoleAssignment
Remove-MgUserAppRoleAssignment /users/{id}/appRoleAssignments/{id}
Delete appRoleAssignment
Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
Get-MgBetaGroupAppRoleAssignment /groups/{id}/appRoleAssignments
List appRoleAssignments granted to a group
Get-MgBetaUserAppRoleAssignedResource /me/appRoleAssignedResources
List appRoleAssignedResources
Get-MgBetaUserAppRoleAssignment /users/{id | userPrincipalName}/appRoleAssignments
List appRoleAssignments granted to a user
Get-MgBetaUserAppRoleAssignment /users/{usersId}/appRoleAssignments
List appRoleAssignments (for agentUser)
New-MgBetaGroupAppRoleAssignment /groups/{groupId}/appRoleAssignments
Grant an appRoleAssignment to a group
New-MgBetaServicePrincipalAppRoleAssignedTo /servicePrincipals/{id}/appRoleAssignedTo
Grant an appRoleAssignment for a service principal
New-MgBetaServicePrincipalAppRoleAssignment /servicePrincipals/{id}/appRoleAssignments
Grant an appRoleAssignment to a service principal
New-MgBetaUserAppRoleAssignment /users/{id | userPrincipalName}/appRoleAssignments
Grant an appRoleAssignment to a user
New-MgBetaUserAppRoleAssignment /users/{usersId}/appRoleAssignments
Create appRoleAssignment (for agentUser)
Remove-MgBetaGroupAppRoleAssignment /groups/{id}/appRoleAssignments/{id}
Delete appRoleAssignment
Remove-MgBetaServicePrincipalAppRoleAssignedTo /servicePrincipals/{resource-SP-id}/appRoleAssignedTo/{appRoleAssignment-id}
Delete appRoleAssignedTo
Remove-MgBetaServicePrincipalAppRoleAssignment /servicePrincipals/{servicePrincipal-id}/appRoleAssignments/{appRoleAssignment-id}
Delete appRoleAssignment
Remove-MgBetaUserAppRoleAssignment /users/{id}/appRoleAssignments/{id}
Delete appRoleAssignment

Code Examples

C# / .NET SDK
Delete appRoleAssignedTo
View official example on Microsoft Learn
// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
await graphClient.ServicePrincipals["{servicePrincipal-id}"].AppRoleAssignedTo["{appRoleAssignment-id}"].DeleteAsync();
JavaScript
Delete appRoleAssignedTo
View official example on Microsoft Learn
const options = {
	authProvider,
};

const client = Client.init(options);

await client.api('/servicePrincipals/{resource-SP-id}/appRoleAssignedTo/{appRoleAssignment-id}')
	.delete();
PowerShell
Delete appRoleAssignedTo
View official example on Microsoft Learn
Import-Module Microsoft.Graph.Applications

Remove-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $servicePrincipalId -AppRoleAssignmentId $appRoleAssignmentId
Python
Delete appRoleAssignedTo
View official example on Microsoft Learn
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python

await graph_client.service_principals.by_service_principal_id('servicePrincipal-id').app_role_assigned_to.by_app_role_assignment_id('appRoleAssignment-id').delete()

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or delegated permissions and search for AppRoleAssignment.ReadWrite.All

4

Grant Admin Consent

Application permissions always require admin consent.