Edit

Share via

Add-EntraScopedRoleMembership

  • Reference
Module:
Microsoft.Graph.Entra

Assign a Microsoft Entra role with an administrative unit scope.

Syntax

Add-EntraScopedRoleMembership
   -AdministrativeUnitId <String>
   [-RoleObjectId <String>]
   [-RoleMemberInfo <RoleMemberInfo>]
   [<CommonParameters>]

Description

The Add-EntraScopedRoleMembership cmdlet adds a scoped role membership to an administrative unit. Specify AdministrativeUnitId parameter to add a scoped role membership.

For delegated scenarios, the calling user needs at least the Privileged Role Administrator Microsoft Entra role.

Examples

Example 1: Add a scoped role membership to an administrative unit

Connect-Entra -Scopes 'RoleManagement.ReadWrite.Directory'
$user = Get-EntraUser -UserId 'SawyerM@contoso.com'
$role = Get-EntraDirectoryRole -Filter "DisplayName eq 'Helpdesk Administrator'" 
$administrativeUnit = Get-EntraAdministrativeUnit -Filter "DisplayName eq 'Pacific Administrative Unit'"
$roleMember = New-Object -TypeName Microsoft.Open.MSGraph.Model.MsRoleMemberInfo
$roleMember.Id = $user.Id
Add-EntraScopedRoleMembership -AdministrativeUnitId $administrativeUnit.Id -RoleObjectId $role.Id -RoleMemberInfo $roleMember

Id                                                                AdministrativeUnitId                 RoleId
--                                                                --------------------                 ------
dddddddddddd-bbbb-aaaa-bbbb-cccccccccccc aaaaaaaa-bbbb-aaaa-bbbb-cccccccccccc bbbbbbbb-1111-2222-3333-cccccccccccc

The example shows how to add a user to the specified role within the specified administrative unit.

  • -AdministrativeUnitId Parameter specifies the ID of an administrative unit.
  • -RoleObjectId Parameter specifies the ID of a directory role.
  • -RoleMemberInfo Parameter specifies a RoleMemberInfo object.

Parameters

-AdministrativeUnitId

Specifies the ID of an administrative unit.

Type:System.String
Aliases:ObjectId
Position:Named
Default value:None
Required:True
Accept pipeline input:True
Accept wildcard characters:False

-RoleMemberInfo

Specifies a RoleMemberInfo object.

Type:System.RoleMemberInfo
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-RoleObjectId

Specifies the ID of a directory role.

Type:System.String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False