What API permission do I need in order to assign role to a user

Question

I'm doing a (@POST) request the role assignment endpoint

https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments

with this payload:

{
    "@odata.type": "#microsoft.graph.unifiedRoleAssignment",
    "roleDefinitionId": "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxx",
    "principalId": "aaaaa-cccc-bbbb-bddd-eeeeee",
    "directoryScopeId": "/"
}

and I'm getting this error message:

{
    "error": {
        "code": "Authorization_RequestDenied",
        "message": "Insufficient privileges to complete the operation.",
        "innerError": {
            "date": "2024-12-19T08:49:21",
            "request-id": "aaaaaa-aaaa-aa-aaa-aaaaaa",
            "client-request-id": "aaaaaa-aaaaa-aaaaaaa-aaaa-aaaaaaaaaa"
        }
    }
}

Answer 1

Hi @MIRIAM GRAHAM • Thank you for reaching out.

It looks like you are looking for the permission requirements for a specific API call, these are usually documented in the Graph API documentation itself.

You can find the permissions required for your particular scenario here: Create unifiedRoleAssignment

For the directory (Microsoft Entra ID) provider:

Permission type	Permissions (from least to most privileged)
Delegated (work or school account)	RoleManagement.ReadWrite.Directory
Delegated (work or school account)	RoleManagement.ReadWrite.Directory
Delegated (personal Microsoft account)	Not supported.
Application	RoleManagement.ReadWrite.Directory

And For the entitlement management provider:

Permission type	Permissions (from least to most privileged)
Delegated (work or school account)	EntitlementManagement.ReadWrite.All
Delegated (work or school account)	EntitlementManagement.ReadWrite.All
Delegated (personal Microsoft account)	Not supported.
Application	EntitlementManagement.ReadWrite.All

---

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.