How to create a directory role assignment in Entra ID using Microsoft Graph PowerShell

The New-MgRoleManagementDirectoryRoleAssignment cmdlet creates a new directory role assignment in Microsoft Entra ID (previously Azure AD). This allows you to programmatically assign administrative roles to users or service principals.

Create directory role assignments using Microsoft Graph PowerShell

Prerequisites

• Before using the cmdlet, ensure that the Microsoft Graph PowerShell module is installed. If not, install it using this PowerShell command:
  Copy Install-Module Microsoft.Graph -Scope CurrentUser
• Also, use the following PowerShell command to connect to Microsoft Graph with the required permissions (e.g., RoleManagement.ReadWrite.Directory):
  Copy Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

Using the New-MgRoleManagementDirectoryRoleAssignment cmdlet

Run the Graph PowerShell command below to create a new role assignment. Replace <role-id> with the role you want to assign, and <user-or-sp-id> with the user or service principal ID:

Examples

Example 1: Assign the Global Administrator role to a user

This Graph PowerShell command assigns the Global Administrator role to a user:

Example 2: Assign a custom role to a service principal

This Graph PowerShell command assigns a custom administrative role to a service principal:

Example 3: Assign a role with a custom description

This Graph PowerShell command assigns a role and includes a description for the assignment:

Supported parameters

The following are some essential parameters that can be used along with the New-MgRoleManagementDirectoryRoleAssignment command:

Limitations of using Microsoft Graph PowerShell to create directory role assignments

• PowerShell commands can get complicated with different use cases and scenarios.
• IT admins can spend a lot of time debugging errors, which in turn negatively impacts productivity.
• Delegation can get tricky since technicians require elevated permissions.