title | description | ms.localizationpriority | author | ms.reviewer | ms.subservice | doc_type |
---|---|---|---|---|---|---|
List roleDefinitions |
Get a list of unifiedRoleDefinition objects. |
medium |
DougKirschner |
msodsrbac |
entra-directory-management |
apiPageType |
Namespace: microsoft.graph
[!INCLUDE beta-disclaimer]
Get a list of unifiedRoleDefinition objects for an RBAC provider.
The following RBAC providers are currently supported:
- Cloud PC
- device management (Intune)
- directory (Microsoft Entra ID)
- entitlement management (Microsoft Entra ID)
- Exchange Online
[!INCLUDE national-cloud-support]
Depending on the RBAC provider and the permission type (delegated or application) that is needed, choose from the following tables the least privileged permission required to call this API. To learn more, including taking caution before choosing more privileged permissions, see Permissions.
Permission type | Permissions (from least to most privileged) |
---|---|
Delegated (work or school account) | RoleManagement.Read.CloudPC, CloudPC.Read.All, RoleManagement.ReadWrite.CloudPC, CloudPC.ReadWrite.All, RoleManagement.Read.All |
Delegated (personal Microsoft account) | Not supported. |
Application | RoleManagement.Read.CloudPC, CloudPC.Read.All, RoleManagement.ReadWrite.CloudPC, CloudPC.ReadWrite.All, RoleManagement.Read.All |
Permission type | Permissions (from least to most privileged) |
---|---|
Delegated (work or school account) | DeviceManagementRBAC.Read.All, DeviceManagementRBAC.ReadWrite.All |
Delegated (personal Microsoft account) | Not supported. |
Application | DeviceManagementRBAC.Read.All, DeviceManagementRBAC.ReadWrite.All |
Permission type | Permissions (from least to most privileged) |
---|---|
Delegated (work or school account) | RoleManagement.Read.Directory, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All |
Delegated (personal Microsoft account) | Not supported. |
Application | RoleManagement.Read.Directory, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All |
Permission type | Permissions (from least to most privileged) |
---|---|
Delegated (work or school account) | EntitlementManagement.Read.All, EntitlementManagement.ReadWrite.All |
Delegated (personal Microsoft account) | Not supported. |
Application | Not supported. |
Permission type | Permissions (from least to most privileged) |
---|---|
Delegated (work or school account) | RoleManagement.Read.Exchange, RoleManagement.Read.All, RoleManagement.ReadWrite.Exchange |
Delegated (personal Microsoft account) | Not supported. |
Application | RoleManagement.Read.Exchange, RoleManagement.Read.All, RoleManagement.ReadWrite.Exchange |
To list role definitions for a Cloud PC provider:
GET /roleManagement/cloudPC/roleDefinitions
To list role definitions for a device management provider:
GET /roleManagement/deviceManagement/roleDefinitions
To list role definitions for a directory provider:
GET /roleManagement/directory/roleDefinitions
To list role definitions for the entitlement management provider:
GET /roleManagement/entitlementManagement/roleDefinitions
To list role definitions for the Exchange Online provider:
GET /roleManagement/exchange/roleDefinitions
This method supports the $filter
query parameter to help customize the response. For general information, see OData query parameters.
Name | Description |
---|---|
Authorization | Bearer {token}. Required. Learn more about authentication and authorization. |
Don't supply a request body for this method.
If successful, this method returns a 200 OK
response code and a collection of unifiedRoleDefinition objects in the response body.
The following example shows a request.
GET https://graph.microsoft.com/beta/roleManagement/directory/roleDefinitions
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleDefinitions",
"value": [
{
"id": "729827e3-9c14-49f7-bb1b-9608f156bbb8",
"description": "Can reset passwords for non-administrators and Helpdesk Administrators.",
"displayName": "Helpdesk Administrator",
"isBuiltIn": true,
"isEnabled": true,
"isPrivileged": true,
"templateId": "729827e3-9c14-49f7-bb1b-9608f156bbb8",
"version": "1",
"rolePermissions": [
{
"allowedResourceActions": [
"microsoft.directory/users/invalidateAllRefreshTokens",
"microsoft.directory/users/bitLockerRecoveryKeys/read",
"microsoft.directory/users/password/update",
"microsoft.azure.serviceHealth/allEntities/allTasks",
"microsoft.azure.supportTickets/allEntities/allTasks",
"microsoft.office365.webPortal/allEntities/standard/read",
"microsoft.office365.serviceHealth/allEntities/allTasks",
"microsoft.office365.supportTickets/allEntities/allTasks"
],
"condition": null
}
],
"inheritsPermissionsFrom": [
{
"id": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b"
}
]
},
{
"id": "f023fd81-a637-4b56-95fd-791ac0226033",
"description": "Can read service health information and manage support tickets.",
"displayName": "Service Support Administrator",
"isBuiltIn": true,
"isEnabled": true,
"isPrivileged": false,
"templateId": "f023fd81-a637-4b56-95fd-791ac0226033",
"version": "1",
"rolePermissions": [
{
"allowedResourceActions": [
"microsoft.azure.serviceHealth/allEntities/allTasks",
"microsoft.azure.supportTickets/allEntities/allTasks",
"microsoft.office365.webPortal/allEntities/standard/read",
"microsoft.office365.serviceHealth/allEntities/allTasks",
"microsoft.office365.supportTickets/allEntities/allTasks"
],
"condition": null
}
],
"inheritsPermissionsFrom": [
{
"id": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b"
}
]
},
{
"id": "b0f54661-2d74-4c50-afa3-1ec803f12efe",
"description": "Can perform common billing related tasks like updating payment information.",
"displayName": "Billing Administrator",
"isBuiltIn": true,
"isEnabled": true,
"isPrivileged": false,
"templateId": "b0f54661-2d74-4c50-afa3-1ec803f12efe",
"version": "1",
"rolePermissions": [
{
"allowedResourceActions": [
"microsoft.directory/organization/basic/update",
"microsoft.azure.serviceHealth/allEntities/allTasks",
"microsoft.azure.supportTickets/allEntities/allTasks",
"microsoft.commerce.billing/allEntities/allTasks",
"microsoft.office365.webPortal/allEntities/standard/read",
"microsoft.office365.serviceHealth/allEntities/allTasks",
"microsoft.office365.supportTickets/allEntities/allTasks"
],
"condition": null
}
],
"inheritsPermissionsFrom": [
{
"id": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b"
}
]
}
]
}
The following example shows a request.
GET https://graph.microsoft.com/beta/roleManagement/cloudPC/roleDefinitions
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/cloudPC/roleDefinitions",
"value": [
{
"id": "b5c08161-a7af-481c-ace2-a20a69a48fb1",
"description": "Cloud PC Administrator has read and write access to all Cloud PC features located within the Cloud PC blade.",
"displayName": "Cloud PC Administrator",
"isBuiltIn": true,
"isEnabled": true,
"resourceScopes": [
"/"
],
"templateId": "b5c08161-a7af-481c-ace2-a20a69a48fb1",
"version": null,
"rolePermissions": [
{
"allowedResourceActions": [
"Microsoft.CloudPC/CloudPCs/Read",
"Microsoft.CloudPC/CloudPCs/Reprovision",
"Microsoft.CloudPC/DeviceImages/Create",
"Microsoft.CloudPC/DeviceImages/Delete",
"Microsoft.CloudPC/DeviceImages/Read",
"Microsoft.CloudPC/OnPremisesConnections/Create",
"Microsoft.CloudPC/OnPremisesConnections/Delete",
"Microsoft.CloudPC/OnPremisesConnections/Read",
"Microsoft.CloudPC/OnPremisesConnections/Update",
"Microsoft.CloudPC/OnPremisesConnections/RunHealthChecks",
"Microsoft.CloudPC/OnPremisesConnections/UpdateAdDomainPassword",
"Microsoft.CloudPC/ProvisioningPolicies/Assign",
"Microsoft.CloudPC/ProvisioningPolicies/Create",
"Microsoft.CloudPC/ProvisioningPolicies/Delete",
"Microsoft.CloudPC/ProvisioningPolicies/Read",
"Microsoft.CloudPC/ProvisioningPolicies/Update",
"Microsoft.CloudPC/RoleAssignments/Create",
"Microsoft.CloudPC/RoleAssignments/Update",
"Microsoft.CloudPC/RoleAssignments/Delete",
"Microsoft.CloudPC/Roles/Read"
],
"condition": null
}
]
},
{
"id": "d40368cb-fbf4-4965-bbc1-f17b3a78e510",
"description": "Cloud PC Reader has read access to all Cloud PC features located within the Cloud PC blade.",
"displayName": "Cloud PC Reader",
"isBuiltIn": true,
"isEnabled": true,
"resourceScopes": [
"/"
],
"templateId": "d40368cb-fbf4-4965-bbc1-f17b3a78e510",
"version": null,
"rolePermissions": [
{
"allowedResourceActions": [
"Microsoft.CloudPC/CloudPCs/Read",
"Microsoft.CloudPC/DeviceImages/Read",
"Microsoft.CloudPC/OnPremisesConnections/Read",
"Microsoft.CloudPC/ProvisioningPolicies/Read",
"Microsoft.CloudPC/Roles/Read"
],
"condition": null
}
]
}
]
}
The following example shows a request.
GET https://graph.microsoft.com/beta/roleManagement/entitlementManagement/roleDefinitions
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/entitlementManagement/roleDefinitions",
"value": [
{
"id": "ae79f266-94d4-4dab-b730-feca7e132178",
"displayName": "Catalog owner",
"description": "Catalog owner",
"isBuiltIn": true,
"isEnabled": true,
"templateId": "ae79f266-94d4-4dab-b730-feca7e132178",
"version": "1.0",
"rolePermissions": [
{
"allowedResourceActions": [
"microsoft.entitlementManagement/allEntities/allTasks"
]
}
]
},
{
"id": "44272f93-9762-48e8-af59-1b5351b1d6b3",
"displayName": "Catalog reader",
"description": "Catalog reader",
"isBuiltIn": true,
"isEnabled": true,
"templateId": "44272f93-9762-48e8-af59-1b5351b1d6b3",
"version": "1.0",
"rolePermissions": [
{
"allowedResourceActions": [
"microsoft.entitlementManagement/allEntities/Read"
]
}
]
}
]
}
The following example shows a request.
GET https://graph.microsoft.com/beta/roleManagement/exchange/roleDefinitions
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/exchange/roleDefinitions",
"value": [
{
"id": "7224da60-d8e2-4f45-9380-8e4fda64e133",
"description": "This role enables administrators to manage address lists, global address lists, and offline address lists in an organization.",
"displayName": "Address Lists",
"isEnabled": true,
"version": "0.12 (14.0.451.0)",
"isBuiltIn": true,
"templateId": null,
"allowedPrincipalTypes": "user,group",
"rolePermissions": [
{
"allowedResourceActions": [
"(Microsoft.Exchange.Management.PowerShell.E2010) Get-AddressBookPolicy -ErrorAction -ErrorVariable -Identity -OutBuffer -OutVariable -WarningAction -WarningVariable"
],
"excludedResourceActions": [],
"condition": null
}
]
},
{
"id": "435bdc29-5ab0-454e-906e-afb7d563bd98",
"description": "This role enables applications to impersonate users in an organization in order to perform tasks on behalf of the user.",
"displayName": "ApplicationImpersonation",
"isEnabled": true,
"version": "0.12 (14.0.451.0)",
"isBuiltIn": true,
"templateId": null,
"allowedPrincipalTypes": "user,group",
"rolePermissions": [
{
"allowedResourceActions": [
"Impersonate-ExchangeUser"
],
"excludedResourceActions": [],
"condition": null
}
]
}
]
}
The following example shows a request.
GET https://graph.microsoft.com/beta/roleManagement/directory/roleDefinitions?$filter=isPrivileged eq true
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleDefinitions",
"value": [
{
"id": "aaf43236-0c0d-4d5f-883a-6955382ac081",
"description": "Can manage secrets for federation and encryption in the Identity Experience Framework (IEF).",
"displayName": "B2C IEF Keyset Administrator",
"isBuiltIn": true,
"isEnabled": true,
"isPrivileged": true,
"resourceScopes": [
"/"
],
"templateId": "aaf43236-0c0d-4d5f-883a-6955382ac081",
"version": "1",
"rolePermissions": [
{
"allowedResourceActions": [
"microsoft.directory/b2cTrustFrameworkKeySet/allProperties/allTasks"
],
"condition": null
}
],
"inheritsPermissionsFrom@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleDefinitions('aaf43236-0c0d-4d5f-883a-6955382ac081')/inheritsPermissionsFrom",
"inheritsPermissionsFrom": [
{
"id": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b"
}
]
},
{
"id": "be2f45a1-457d-42af-a067-6ec1fa63bc45",
"description": "Can configure identity providers for use in direct federation.",
"displayName": "External Identity Provider Administrator",
"isBuiltIn": true,
"isEnabled": true,
"isPrivileged": true,
"resourceScopes": [
"/"
],
"templateId": "be2f45a1-457d-42af-a067-6ec1fa63bc45",
"version": "1",
"rolePermissions": [
{
"allowedResourceActions": [
"microsoft.directory/domains/federation/update",
"microsoft.directory/identityProviders/allProperties/allTasks"
],
"condition": null
}
],
"inheritsPermissionsFrom@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleDefinitions('be2f45a1-457d-42af-a067-6ec1fa63bc45')/inheritsPermissionsFrom",
"inheritsPermissionsFrom": [
{
"id": "88d8e3e3-8f55-4a1e-953a-9b9898b8876b"
}
]
}
]
}