pac authorization

(Preview) Manage Power Platform RBAC role definitions and scoped role assignments.

Commands

Command	Description
pac authorization create-environment-group-role-assignment	(Preview) Creates a new role assignment for the specified environment group. Preview.
pac authorization create-environment-role-assignment	(Preview) Creates a new role assignment for the specified environment. Preview.
pac authorization create-role-assignment	(Preview) Creates a new role assignment. Preview.
pac authorization delete-environment-group-role-assignment	(Preview) Deletes a role assignment by ID for the specified environment group. Preview.
pac authorization delete-environment-role-assignment	(Preview) Deletes a role assignment by ID for the specified environment. Preview.
pac authorization delete-role-assignment	(Preview) Deletes a role assignment by ID. Preview.
pac authorization list-environment-group-role-assignments	(Preview) Retrieves a list of role assignments for the specified environment group. Preview.
pac authorization list-environment-role-assignments	(Preview) Retrieves a list of role assignments for the specified environment. Preview.
pac authorization list-role-assignments	(Preview) Retrieves a list of role assignments. Preview.
pac authorization list-role-definitions	(Preview) Retrieves a list of role definitions. Preview.
pac authorization search-environment-role-assignments	(Preview) Searches role assignments for the specified environment, with optional transitive lookup up to parent scopes or down into nested scopes. Preview.
pac authorization search-role-assignments	(Preview) Searches role assignments by scope, principal, and permission, with optional transitive lookup up to parent scopes or down into nested scopes. Preview.

pac authorization create-environment-group-role-assignment

(Preview) Creates a new role assignment for the specified environment group. Preview.

Required Parameters for authorization create-environment-group-role-assignment

--environment-group-id

The unique identifier of the environment group.

Optional Parameters for authorization create-environment-group-role-assignment

--principal-object-id

The Id of the principal to assign

--principal-type

The type of the principal

--role-definition-id

The Id of the role definition

--scope

The assignment scope

create-environment-group-role-assignment remarks

You can also invoke this command using the Power Platform REST API Role Based Access Control - Create Environment Group Role Assignment.

pac authorization create-environment-role-assignment

(Preview) Creates a new role assignment for the specified environment. Preview.

Optional Parameters for authorization create-environment-role-assignment

--environment -env

Specifies the target Dataverse. The value may be a Guid or absolute https URL. When not specified, the active organization selected for the current auth profile will be used.

--principal-object-id

The Id of the principal to assign

--principal-type

The type of the principal

--role-definition-id

The Id of the role definition

--scope

The assignment scope

create-environment-role-assignment remarks

You can also invoke this command using the Power Platform REST API Role Based Access Control - Create Environment Role Assignment.

pac authorization create-role-assignment

(Preview) Creates a new role assignment. Preview.

Optional Parameters for authorization create-role-assignment

--principal-object-id

The Id of the principal to assign

--principal-type

The type of the principal

--role-definition-id

The Id of the role definition

--scope

The assignment scope

create-role-assignment remarks

You can also invoke this command using the Power Platform REST API Role Based Access Control - Create Role Assignment.

pac authorization delete-environment-group-role-assignment

(Preview) Deletes a role assignment by ID for the specified environment group. Preview.

Required Parameters for authorization delete-environment-group-role-assignment

--environment-group-id

The unique identifier of the environment group.

--role-assignment-id

The unique identifier of the role assignment.

delete-environment-group-role-assignment remarks

You can also invoke this command using the Power Platform REST API Role Based Access Control - Delete Environment Group Role Assignment.

pac authorization delete-environment-role-assignment

(Preview) Deletes a role assignment by ID for the specified environment. Preview.

Required Parameters for authorization delete-environment-role-assignment

--role-assignment-id

The unique identifier of the role assignment.

Optional Parameters for authorization delete-environment-role-assignment

--environment -env

Specifies the target Dataverse. The value may be a Guid or absolute https URL. When not specified, the active organization selected for the current auth profile will be used.

delete-environment-role-assignment remarks

You can also invoke this command using the Power Platform REST API Role Based Access Control - Delete Environment Role Assignment.

pac authorization delete-role-assignment

(Preview) Deletes a role assignment by ID. Preview.

Required Parameters for authorization delete-role-assignment

--role-assignment-id

The unique identifier of the role assignment.

delete-role-assignment remarks

You can also invoke this command using the Power Platform REST API Role Based Access Control - Delete Role Assignment.

pac authorization list-environment-group-role-assignments

(Preview) Retrieves a list of role assignments for the specified environment group. Preview.

Required Parameters for authorization list-environment-group-role-assignments

--environment-group-id

The unique identifier of the environment group.

Optional Parameters for authorization list-environment-group-role-assignments

--columns

Comma-separated list of response properties to include in table output. Use --json for the complete response.

list-environment-group-role-assignments remarks

You can also invoke this command using the Power Platform REST API Role Based Access Control - List Environment Group Role Assignments.

pac authorization list-environment-role-assignments

(Preview) Retrieves a list of role assignments for the specified environment. Preview.

Optional Parameters for authorization list-environment-role-assignments

--columns

Comma-separated list of response properties to include in table output. Use --json for the complete response.

--environment -env

Specifies the target Dataverse. The value may be a Guid or absolute https URL. When not specified, the active organization selected for the current auth profile will be used.

list-environment-role-assignments remarks

You can also invoke this command using the Power Platform REST API Role Based Access Control - List Environment Role Assignments.

pac authorization list-role-assignments

(Preview) Retrieves a list of role assignments. Preview.

Optional Parameters for authorization list-role-assignments

--columns

Comma-separated list of response properties to include in table output. Use --json for the complete response.

list-role-assignments remarks

You can also invoke this command using the Power Platform REST API Role Based Access Control - List Role Assignments.

pac authorization list-role-definitions

(Preview) Retrieves a list of role definitions. Preview.

Optional Parameters for authorization list-role-definitions

--columns

Comma-separated list of response properties to include in table output. Use --json for the complete response.

list-role-definitions remarks

You can also invoke this command using the Power Platform REST API Role Based Access Control - List Role Definitions.

pac authorization search-environment-role-assignments

(Preview) Searches role assignments for the specified environment, with optional transitive lookup up to parent scopes or down into nested scopes. Preview.

Required Parameters for authorization search-environment-role-assignments

--scope

The scope to filter role assignments by

Optional Parameters for authorization search-environment-role-assignments

--continuation-token

The continuation token from a previous response, used to retrieve the next page of results.

--environment -env

Specifies the target Dataverse. The value may be a Guid or absolute https URL. When not specified, the active organization selected for the current auth profile will be used.

--expand-environment-clusters

Whether to include role assignments inherited from the environment cluster an environment belongs to

--expand-environment-groups

Whether to include role assignments inherited from the environment groups an environment belongs to

--expand-security-groups

Whether to include role assignments inherited from the security groups the principal belongs to

--include-nested-scopes

Whether to include role assignments from scopes nested under the provided scope

--include-parent-scopes

Whether to include role assignments from parent scopes up to the tenant

--include-virtual-entra-role-assignments

Whether to include virtual role assignments granted through an Entra directory role

--permission

The permission to filter by

--principal-object-id

The Id of the principal to filter by

--principal-type

The type of the principal to filter by

search-environment-role-assignments remarks

You can also invoke this command using the Power Platform REST API Role Based Access Control - Search Environment Role Assignments.

pac authorization search-role-assignments

(Preview) Searches role assignments by scope, principal, and permission, with optional transitive lookup up to parent scopes or down into nested scopes. Preview.

Required Parameters for authorization search-role-assignments

--scope

The scope to filter role assignments by

Optional Parameters for authorization search-role-assignments

--continuation-token

The continuation token from a previous response, used to retrieve the next page of results.

--expand-environment-clusters

Whether to include role assignments inherited from the environment cluster an environment belongs to

--expand-environment-groups

Whether to include role assignments inherited from the environment groups an environment belongs to

--expand-security-groups

Whether to include role assignments inherited from the security groups the principal belongs to

--include-nested-scopes

Whether to include role assignments from scopes nested under the provided scope

--include-parent-scopes

Whether to include role assignments from parent scopes up to the tenant

--include-virtual-entra-role-assignments

Whether to include virtual role assignments granted through an Entra directory role

--permission

The permission to filter by

--principal-object-id

The Id of the principal to filter by

--principal-type

The type of the principal to filter by

search-role-assignments remarks

You can also invoke this command using the Power Platform REST API Role Based Access Control - Search Role Assignments.

See also

Microsoft Power Platform CLI Command Groups
Microsoft Power Platform CLI overview