Update unifiedRoleDefinition

Namespace: microsoft.graph

Update the properties of a unifiedRoleDefinition object. You cannot update built-in roles. This feature requires an Azure AD Premium P1 or P2 license.


One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.

Permission type Permissions (from least to most privileged)
Delegated (work or school account) RoleManagement.ReadWrite.Directory
Delegated (personal Microsoft account) Not supported.
Application RoleManagement.ReadWrite.Directory

HTTP request

PATCH /roleManagement/directory/roleDefinitions/{id}

Request headers

Name Description
Authorization Bearer {token}
Content-Type application/json. Required.

Request body

In the request body, supply the values for relevant fields that should be updated. Existing properties that are not included in the request body will maintain their previous values or be recalculated based on changes to other property values. For the best performance, don't include existing values that haven't changed.

The following table shows the properties that are required when you update the unifiedRoleDefinition.

Property Type Description
description String The description for the role definition. Read-only when isBuiltIn is true.
displayName String The display name for the role definition. Read-only when isBuiltIn is true. Required.
isEnabled Boolean Flag indicating if the role is enabled for assignment. If false, the role is not available for assignment. Read-only when isBuiltIn is true.
resourceScopes String collection List of scopes and permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This property will be deprecated soon. Attach scope to role assignment.
rolePermissions unifiedRolePermission collection List of permissions included in the role. Read-only when isBuiltIn is true. Required.
templateId String Custom template identifier that can be set when isBuiltIn is false. This identifier is typically used if one needs an identifier to be the same across different directories. Read-only when isBuiltIn is true.
version String Indicates version of the role definition. Read-only when isBuiltIn is true.


If successful, this method returns a 204 No Content response code. It does not return anything in the response body.



The following is an example of the request.

PATCH https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions/0d55728d-3e24-4309-9b1b-5ac09921475a
Content-type: application/json

  "description": "Update basic properties of application registrations",
  "displayName": "Application Registration Support Administrator",


The following is an example of the response.

HTTP/1.1 204 OK
Content-type: application/json