New-MgRoleManagementDirectoryRoleDefinition

Create a new custom unifiedRoleDefinition object.

Syntax

New-MgRoleManagementDirectoryRoleDefinition
   [-AdditionalProperties <Hashtable>]
   [-Description <String>]
   [-DisplayName <String>]
   [-Id <String>]
   [-InheritsPermissionsFrom <IMicrosoftGraphUnifiedRoleDefinition1[]>]
   [-IsBuiltIn]
   [-IsEnabled]
   [-ResourceScopes <String[]>]
   [-RolePermissions <IMicrosoftGraphUnifiedRolePermission[]>]
   [-TemplateId <String>]
   [-Version <String>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]
New-MgRoleManagementDirectoryRoleDefinition
   -BodyParameter <IMicrosoftGraphUnifiedRoleDefinition1>
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Description

Create a new custom unifiedRoleDefinition object.

Examples

Example 1: Using the New-MgRoleManagementDirectoryRoleDefinition Cmdlet

Import-Module Microsoft.Graph.DeviceManagement.Enrolment
$params = @{
	Description = "Update basic properties of application registrations"
	DisplayName = "Application Registration Support Administrator"
	RolePermissions = @(
		@{
			AllowedResourceActions = @(
				"microsoft.directory/applications/basic/read"
			)
		}
	)
	IsEnabled = $true
}
New-MgRoleManagementDirectoryRoleDefinition -BodyParameter $params

This example shows how to use the New-MgRoleManagementDirectoryRoleDefinition Cmdlet. To learn about permissions for this resource, see the permissions reference.

Parameters

-AdditionalProperties

Additional Parameters

Type:Hashtable
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

-BodyParameter

unifiedRoleDefinition To construct, please use Get-Help -Online and see NOTES section for BODYPARAMETER properties and create a hash table.

Type:IMicrosoftGraphUnifiedRoleDefinition1
Position:Named
Default value:None
Accept pipeline input:True
Accept wildcard characters:False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type:SwitchParameter
Aliases:cf
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

-Description

The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true.

Type:String
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

-DisplayName

The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required. Supports $filter (eq, in).

Type:String
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

-Id

The unique idenfier for an entity. Read-only.

Type:String
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

-InheritsPermissionsFrom

Read-only collection of role definitions that the given role definition inherits from. Only Azure AD built-in roles (isBuiltIn is true) support this attribute. Supports $expand. To construct, please use Get-Help -Online and see NOTES section for INHERITSPERMISSIONSFROM properties and create a hash table.

Type:IMicrosoftGraphUnifiedRoleDefinition1[]
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

-IsBuiltIn

Flag indicating whether the role definition is part of the default set included in Azure Active Directory (Azure AD) or a custom definition. Read-only. Supports $filter (eq, in).

Type:SwitchParameter
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

-IsEnabled

Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true.

Type:SwitchParameter
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

-ResourceScopes

List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment.

Type:String[]
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

-RolePermissions

List of permissions included in the role. Read-only when isBuiltIn is true. Required. To construct, please use Get-Help -Online and see NOTES section for ROLEPERMISSIONS properties and create a hash table.

Type:IMicrosoftGraphUnifiedRolePermission[]
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

-TemplateId

Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories.

Type:String
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

-Version

Indicates version of the role definition. Read-only when isBuiltIn is true.

Type:String
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type:SwitchParameter
Aliases:wi
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

Inputs

Microsoft.Graph.PowerShell.Models.IMicrosoftGraphUnifiedRoleDefinition1

Outputs

Microsoft.Graph.PowerShell.Models.IMicrosoftGraphUnifiedRoleDefinition1

Notes

ALIASES

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

BODYPARAMETER <IMicrosoftGraphUnifiedRoleDefinition1>: unifiedRoleDefinition

  • [(Any) <Object>]: This indicates any property can be added to this object.
  • [Id <String>]: The unique idenfier for an entity. Read-only.
  • [Description <String>]: The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true.
  • [DisplayName <String>]: The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required. Supports $filter (eq, in).
  • [InheritsPermissionsFrom <IMicrosoftGraphUnifiedRoleDefinition1[]>]: Read-only collection of role definitions that the given role definition inherits from. Only Azure AD built-in roles (isBuiltIn is true) support this attribute. Supports $expand.
  • [IsBuiltIn <Boolean?>]: Flag indicating whether the role definition is part of the default set included in Azure Active Directory (Azure AD) or a custom definition. Read-only. Supports $filter (eq, in).
  • [IsEnabled <Boolean?>]: Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true.
  • [ResourceScopes <String[]>]: List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment.
  • [RolePermissions <IMicrosoftGraphUnifiedRolePermission[]>]: List of permissions included in the role. Read-only when isBuiltIn is true. Required.
    • [AllowedResourceActions <String[]>]: Set of tasks that can be performed on a resource. Required.
    • [Condition <String>]: Optional constraints that must be met for the permission to be effective.
    • [ExcludedResourceActions <String[]>]: Set of tasks that may not be performed on a resource. Not yet supported.
  • [TemplateId <String>]: Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories.
  • [Version <String>]: Indicates version of the role definition. Read-only when isBuiltIn is true.

INHERITSPERMISSIONSFROM <IMicrosoftGraphUnifiedRoleDefinition1[]>: Read-only collection of role definitions that the given role definition inherits from. Only Azure AD built-in roles (isBuiltIn is true) support this attribute. Supports $expand.

  • [Id <String>]: The unique idenfier for an entity. Read-only.
  • [Description <String>]: The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true.
  • [DisplayName <String>]: The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required. Supports $filter (eq, in).
  • [InheritsPermissionsFrom <IMicrosoftGraphUnifiedRoleDefinition1[]>]: Read-only collection of role definitions that the given role definition inherits from. Only Azure AD built-in roles (isBuiltIn is true) support this attribute. Supports $expand.
  • [IsBuiltIn <Boolean?>]: Flag indicating whether the role definition is part of the default set included in Azure Active Directory (Azure AD) or a custom definition. Read-only. Supports $filter (eq, in).
  • [IsEnabled <Boolean?>]: Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true.
  • [ResourceScopes <String[]>]: List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment.
  • [RolePermissions <IMicrosoftGraphUnifiedRolePermission[]>]: List of permissions included in the role. Read-only when isBuiltIn is true. Required.
    • [AllowedResourceActions <String[]>]: Set of tasks that can be performed on a resource. Required.
    • [Condition <String>]: Optional constraints that must be met for the permission to be effective.
    • [ExcludedResourceActions <String[]>]: Set of tasks that may not be performed on a resource. Not yet supported.
  • [TemplateId <String>]: Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories.
  • [Version <String>]: Indicates version of the role definition. Read-only when isBuiltIn is true.

ROLEPERMISSIONS <IMicrosoftGraphUnifiedRolePermission[]>: List of permissions included in the role. Read-only when isBuiltIn is true. Required.

  • [AllowedResourceActions <String[]>]: Set of tasks that can be performed on a resource. Required.
  • [Condition <String>]: Optional constraints that must be met for the permission to be effective.
  • [ExcludedResourceActions <String[]>]: Set of tasks that may not be performed on a resource. Not yet supported.