APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.
Use this API to assign an app role to a user, creating an appRoleAssignment object. To grant an app role assignment to a user, you need three identifiers:
principalId: The id of the user to whom you are assigning the app role.
resourceId: The id of the resource servicePrincipal that has defined the app role.
appRoleId: The id of the appRole (defined on the resource service principal) to assign to the user.
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.
Permission type
Least privileged permissions
Higher privileged permissions
Delegated (work or school account)
AppRoleAssignment.ReadWrite.All
Not available.
Delegated (personal Microsoft account)
Not supported.
Not supported.
Application
AppRoleAssignment.ReadWrite.All
Not available.
HTTP request
POST /users/{id | userPrincipalName}/appRoleAssignments
Note
As a best practice, we recommend creating app role assignments through the appRoleAssignedTo relationship of the resource service principal, instead of the appRoleAssignments relationship of the assigned user, group, or service principal.
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new AppRoleAssignment
{
PrincipalId = Guid.Parse("cde330e5-2150-4c11-9c5b-14bfdc948c79"),
ResourceId = Guid.Parse("8e881353-1735-45af-af21-ee1344582a4d"),
AppRoleId = Guid.Parse("00000000-0000-0000-0000-000000000000"),
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Users["{user-id}"].AppRoleAssignments.PostAsync(requestBody);
Important
Microsoft Graph SDKs use the v1.0 version of the API by default, and do not support all the types, properties, and APIs available in the beta version. For details about accessing the beta API with the SDK, see Use the Microsoft Graph SDKs with the beta API.
Microsoft Graph SDKs use the v1.0 version of the API by default, and do not support all the types, properties, and APIs available in the beta version. For details about accessing the beta API with the SDK, see Use the Microsoft Graph SDKs with the beta API.
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
"github.com/google/uuid"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewAppRoleAssignment()
principalId := uuid.MustParse("cde330e5-2150-4c11-9c5b-14bfdc948c79")
requestBody.SetPrincipalId(&principalId)
resourceId := uuid.MustParse("8e881353-1735-45af-af21-ee1344582a4d")
requestBody.SetResourceId(&resourceId)
appRoleId := uuid.MustParse("00000000-0000-0000-0000-000000000000")
requestBody.SetAppRoleId(&appRoleId)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
appRoleAssignments, err := graphClient.Users().ByUserId("user-id").AppRoleAssignments().Post(context.Background(), requestBody, nil)
Important
Microsoft Graph SDKs use the v1.0 version of the API by default, and do not support all the types, properties, and APIs available in the beta version. For details about accessing the beta API with the SDK, see Use the Microsoft Graph SDKs with the beta API.
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
AppRoleAssignment appRoleAssignment = new AppRoleAssignment();
appRoleAssignment.setPrincipalId(UUID.fromString("cde330e5-2150-4c11-9c5b-14bfdc948c79"));
appRoleAssignment.setResourceId(UUID.fromString("8e881353-1735-45af-af21-ee1344582a4d"));
appRoleAssignment.setAppRoleId(UUID.fromString("00000000-0000-0000-0000-000000000000"));
AppRoleAssignment result = graphClient.users().byUserId("{user-id}").appRoleAssignments().post(appRoleAssignment);
Important
Microsoft Graph SDKs use the v1.0 version of the API by default, and do not support all the types, properties, and APIs available in the beta version. For details about accessing the beta API with the SDK, see Use the Microsoft Graph SDKs with the beta API.
Microsoft Graph SDKs use the v1.0 version of the API by default, and do not support all the types, properties, and APIs available in the beta version. For details about accessing the beta API with the SDK, see Use the Microsoft Graph SDKs with the beta API.
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\AppRoleAssignment;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new AppRoleAssignment();
$requestBody->setPrincipalId('cde330e5-2150-4c11-9c5b-14bfdc948c79');
$requestBody->setResourceId('8e881353-1735-45af-af21-ee1344582a4d');
$requestBody->setAppRoleId('00000000-0000-0000-0000-000000000000');
$result = $graphServiceClient->users()->byUserId('user-id')->appRoleAssignments()->post($requestBody)->wait();
Important
Microsoft Graph SDKs use the v1.0 version of the API by default, and do not support all the types, properties, and APIs available in the beta version. For details about accessing the beta API with the SDK, see Use the Microsoft Graph SDKs with the beta API.
Microsoft Graph SDKs use the v1.0 version of the API by default, and do not support all the types, properties, and APIs available in the beta version. For details about accessing the beta API with the SDK, see Use the Microsoft Graph SDKs with the beta API.
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.app_role_assignment import AppRoleAssignment
graph_client = GraphServiceClient(credentials, scopes)
request_body = AppRoleAssignment(
principal_id = UUID("cde330e5-2150-4c11-9c5b-14bfdc948c79"),
resource_id = UUID("8e881353-1735-45af-af21-ee1344582a4d"),
app_role_id = UUID("00000000-0000-0000-0000-000000000000"),
)
result = await graph_client.users.by_user_id('user-id').app_role_assignments.post(request_body)
Important
Microsoft Graph SDKs use the v1.0 version of the API by default, and do not support all the types, properties, and APIs available in the beta version. For details about accessing the beta API with the SDK, see Use the Microsoft Graph SDKs with the beta API.
In this example, note that the value used as the user id in the request URL (cde330e5-2150-4c11-9c5b-14bfdc948c79) is the same as the principalId property in the body.
Response
The following example shows the response.
Note: The response object shown here might be shortened for readability.