Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, without a signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.
Permission data: April 6, 2026 at 4:06 AM UTC
Delegated Access
App-Only Access
Permission Details
Application Permission
Read and write all directory RBAC settings
Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, without a signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.
Delegated Permission
Admin consent required
Read and write directory RBAC settings
Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.
User sees: Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, on your behalf. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.
Properties
Microsoft Graph v1.0exact-category-docs
Properties is shown from stable Microsoft Graph v1.0 metadata.
Property
Type
Description
directory
object
entitlementManagement
object
Container for roles and assignments for entitlement management resources.
JSON Representation
Microsoft Graph v1.0exact-category-docs
JSON representation is shown from stable Microsoft Graph v1.0 metadata.
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Models;
var requestBody = new DirectoryRole
{
RoleTemplateId = "fe930be7-5e62-47db-91af-98c3a49a38b1",
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.DirectoryRoles.PostAsync(requestBody);
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.directory_role import DirectoryRole
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = DirectoryRole(
role_template_id = "fe930be7-5e62-47db-91af-98c3a49a38b1",
)
result = await graph_client.directory_roles.post(request_body)