How to remove directory role assignments using Microsoft Graph PowerShell

Removing directory role assignments is essential for enforcing least privilege in Microsoft Entra ID. The Remove-MgRoleManagementDirectoryRoleAssignment cmdlet allows administrators to revoke custom or built-in role assignments from users, service principals, or groups, helping organizations maintain tighter access controls, support compliance requirements, and minimize insider risk by occasionally auditing and cleaning up unnecessary access.

This article shows you how to remove directory role assignments using both the Microsoft Entra admin center and Microsoft Graph PowerShell:

Remove directory role assignments using Microsoft Graph PowerShell

Prerequisites

• You must have permissions like RoleManagement.ReadWrite.Directory assigned.
• Install the Microsoft Graph PowerShell module and connect to the tenant by running the script below
  Copy Install-Module Microsoft.Graph -Scope CurrentUser Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

Using the Remove-MgRoleManagementDirectoryRoleAssignment cmdlet

Run the script below by adding the assigment's unique ID:

Examples

Example 1: Remove a role assignment with confirmation prompt

Example 2: Simulate removal with WhatIf parameter

Supported parameters

The following essential parameters can be used along with the Remove-MgRoleManagementDirectoryRoleAssignment cmdlet:

Limitations of using native tools to remove directory role assignments

• PowerShell commands can get complex with different use cases and scenarios.
• IT admins can spend a lot of time troubleshooting errors, which negatively impacts productivity.
• Delegation can get tricky since technicians require elevated permissions.