Where is microsoft.directory/users/create parameter in custom role?

Question

Hello,

I have created a custom role in the past and now I would like to add the capability to create new users in AAD to this role. I checked the User Administrator (predefined) role in AAD and I found this permission: 'microsoft.directory/users/create' which I assume is responsible for the above-mentioned capability.

However, no matter what I do I can not find this permission when I try to edit a custom role. Where should I look for this? Is there anything I must enable for example to assign this permission to my custom role?

Thank you very much

Gregor

Answer 1

There is no support for delegating the microsoft.directory/users/create permission currently. Only built-in roles can include it. You can refer to the official documentation for list of all supported permissions for custom roles.

Answer 2

It's not in the custom role list nor via the UI but this does work.

Connect-MgGraph -Scopes RoleManagement.ReadWrite.Directory

$params = @{

displayName = "User Creation Administrator"

description = "Can create users"

isEnabled = $true

rolePermissions = @(

    @{

        allowedResourceActions = @(

            "microsoft.directory/users/create"

        )

    }

)

}

New-MgRoleManagementDirectoryRoleDefinition -BodyParameter $params