This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 25%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAY%3C/text%3E%3C/svg%3E)
I can query from https://graph.microsoft.com/beta/privilegedAccess/aadRoles/resources/{tenantID}/roleAssignments
But these are for Service Principal and Users in Scope of Directory
But there are users and groups show in the Authentication Administrator from Privileged Identity Management
Their Type show as User, but Scope show as Administrative unit, how do I get a list of these?
https://graph.microsoft.com/v1.0/directory/administrativeUnits/{AdminUnitID}/scopedRoleMembers
If I using this, I get a perfect JSON, but have no idea what roleId for, as I have list from https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions?$select=id,displayName" none of them matching roleId
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#scopedRoleMemberships",
"value": [
{
"id": "{String}",
"roleId": "63d4a4a1-4bb1-4814-815a-f571528af638",
"administrativeUnitId": "{administrativeUnitId}",
"roleMemberInfo": {
"id": "{Omitted}",
"displayName": "{Omitted}",
"userPrincipalName": "{Omitted}"
}
},
{
"id": "{String}",
"roleId": "63d4a4a1-4bb1-4814-815a-f571528af638",
"administrativeUnitId": "{administrativeUnitId}",
"roleMemberInfo": {
"id": "{Omitted}",
"displayName": "{Omitted}",
"userPrincipalName": "{Omitted}"
}
}
}
You can use the /roleManagement/directory/roleEligibilityScheduleRequests endpoint (or the corresponding Get-MgRoleManagementDirectoryRoleEligibilitySchedule cmdlet) to list them: https://learn.microsoft.com/en-us/graph/api/rbacapplication-list-roleeligibilityschedulerequests?view=graph-rest-beta&tabs=http
Scoped assignments will show up with /administrativeUnits/blabla value for the DirectoryScopeId property.