Impossible to create RoleAssignment with api graph

Question

Impossible to create RoleAssignment with api graph

JUFO 81

Impossible to create RoleAssignment with api graph
It always return:

{
    "error": {
        "code": "No method match route template",
        "message": "No OData route exists that match template ~/singleton/navigation/key/navigation with http verb POST for request /StatelessRoleAdministrationFEService/deviceManagement/roleDefinitions('cabf128f-d8c0-4c6e-bc5d-02aa3e32ceaa')/roleAssignments.",
        "innerError": {
            "date": "2023-02-01T13:24:49",
            "request-id": "41124d63-85bd-4e74-b6a2-cce037e63f20",
            "client-request-id": "xxxx"
        }
    }
}

I've tried v1.0 and beta. I can see RoleAssignments with GET, but POST doesn't work.
The url: https://graph.microsoft.com/beta/deviceManagement/roleDefinitions/cabf128f-d8c0-4c6e-bc5d-02aa3e32ceaa/roleAssignments

My json

{
    "@odata.type": "#microsoft.graph.deviceAndAppManagementRoleAssignment",
    "displayName": "test",
    "description": "",
    "resourceScopes": [],
    "members": []
}

or even

{
  "@odata.type": "#microsoft.graph.roleAssignment",
  "displayName": "Test",
  "description": "Description test",
  "resourceScopes": []
}

It should work because it is as it appears in the documentation. I've tried everything...

Accepted answer

2 additional answers

Your answer

Answer 1

@JUFO, Thanks for posting in Q&A.

Based on my test, I find we can use the following method to create RoleAssignment:

Request Method: POST

Request URL: https://graph.microsoft.com/beta/deviceManagement/roleAssignments

Request body: (displayname is the name of the assignment. enter the id of the admin group under members. enter id of the Scope group under resourceScopes.

{
    "id": "",
    "description": "",
    "displayName": "test2",
    "members": [
        "5bc76640-a6e4-XXXXXXX-2b0e15371ec4"
    ],
    "resourceScopes": [
        "4ee993ea-16e2-XXXX8-0617424475c7"
    ],
    "******@odata.bind": "https://graph.microsoft.com/beta/deviceManagement/roleDefinitions('abe1ef62-3XXXXXXX-95ce-cc93d74782fe')"
}

User's image

Then the roleassignment is created under Intune.

User's image

Hope the above information can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

JUFO 81 Reputation points

2023-02-03T13:50:25.8433333+00:00

Thanks a lot.

And if I want to DELETE te assingment?

I've tried:

https://graph.microsoft.com/beta/deviceManagement/roleAssignments/85ce198b-567a-xxxx-b3a9-c3625094ba69

But it doesn't work

Answer 2

JUFO 81

Thanks a lot, it is different in documentation.

And if I want to DELETE that assignment?

I've tried:

DELETE https://graph.microsoft.com/beta/deviceManagement/roleAssignments/85ce198b-567a-4923-xxx-c3625094ba69

But it shows an error.

JUFO 81 Reputation points

2023-02-03T14:10:20.3866667+00:00

I deleted the roleDefinitions and now I don't see how to delete this orphan object.

Is it possible to delete orphan objects in this scenario?
Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2023-02-06T05:05:29.62+00:00

@JUFO, Thanks for the reply. Based on my testing, after removing the roledefinition, the roleassignment can still be seen when I get it from "https://graph.microsoft.com/beta/deviceManagement/roleAssignments".

To remove it, you can use Get option to find out all the assignments under the deleted roledefinition.

https://graph.microsoft.com/beta/deviceManagement/roleDefinitions/<roleDefinitionid>/roleAssignments

Then delete it using delete https://graph.microsoft.com/beta/deviceManagement/roleAssignments/<roleassignmentid>

Hope it can help.

JUFO 81

It works when roleDefinition exists. In that case I can DELETE by

https://graph.microsoft.com/beta/deviceManagement/roleAssignments/2222f48b-70aa-4867-9be9-1140011234cb

But if I delete its asociated roleDefinition and try to delete associated roleAssignments it gives me this:

{
    "error": {
        "code": "ResourceNotFound",
        "message": "{  \"_version\": 3,  \"Message\": \"An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 8c10480d-036d-7fbe-9203-b43717e34b5e - Url: https://fef.msub06.manage.microsoft.com/StatelessRoleAdministrationFEService/deviceManagement/roleAssignments('2222f48b-70aa-4867-9be9-1140011234cb')?api-version=5021-08-02 - CustomApiErrorPhrase: ResourceNotFound\",  \"CustomApiErrorPhrase\": \"ResourceNotFound\",  \"RetryAfter\": null,  \"ErrorSourceService\": \"\",  \"HttpHeaders\": \"{}\"}",
        "innerError": {
            "date": "2023-02-07T12:48:21",
            "request-id": "7a6fd481-df3d-412a-8847-e48b87431c18",
            "client-request-id": "8c10480d-036d-7fbe-9203-b43717e34b5e"
        }
    }
}

It is curious because the same url works with GET, but not with DELETE

Answer 3

Stijn Soens 0

Been troubleshooting the 'No method match route template' issue for a couple of hours until I found this thread. Updated my json slightly but I can't seem to fix it. Could you help me out?

{
    "id": "",
    "description": "Test Descr",
    "displayName": "Test Name",
    "members": [
        "6d25f39a-51bf-XXXXXXX-10fc5fea6f5f"
    ],
    "resourceScopes": [],
    "******@odata.bind": "https://graph.microsoft.com/v1.0/deviceManagement/roleDefinitions('486d327f-4cd6-XXXXXXX-93e2fa32b814')"
}

Share via

Impossible to create RoleAssignment with api graph

2 additional answers

Your answer