Изменить

Поделиться через

Remove-EntraDirectoryRoleAssignment

  • Reference
Module:
Microsoft.Entra

Delete a Microsoft Entra ID roleAssignment.

Syntax

Remove-EntraDirectoryRoleAssignment
      -UnifiedRoleAssignmentId <String>
      [<CommonParameters>]

Description

The Remove-EntraDirectoryRoleAssignment cmdlet removes a role assignment from Microsoft Entra ID.

In delegated scenarios, the signed-in user must have either a supported Microsoft Entra role or a custom role with the necessary permissions. The minimum roles required for this operation are:

  • Privileged Role Administrator

Examples

Example 1: Remove a role assignment

Connect-Entra -Scopes 'RoleManagement.ReadWrite.Directory', 'EntitlementManagement.ReadWrite.All'1
$user = Get-EntraUser -UserId 'SawyerM@contoso.com'
$role = Get-EntraDirectoryRoleDefinition -Filter "DisplayName eq 'Helpdesk Administrator'"
$assignment = Get-EntraDirectoryRoleAssignment -All | Where-Object { $_.principalId -eq $user.Id -AND $_.RoleDefinitionId -eq $role.Id }
Remove-EntraDirectoryRoleAssignment -UnifiedRoleAssignmentId $assignment.Id

This example removes the specified role assignment from Microsoft Entra ID.

  • -Id parameter specifies the role assignment ID.

Parameters

-UnifiedRoleAssignmentId

The unique identifier of an object in Microsoft Entra ID.

Type:System.String
Aliases:Id
Position:0
Default value:None
Required:True
Accept pipeline input:True
Accept wildcard characters:False

Inputs

System.String

Outputs

System.Object

Notes

Remove-EntraRoleAssignment is an alias for Remove-EntraDirectoryRoleAssignment.