Set-EntraDirectoryRoleDefinition

Set-EntraDirectoryRoleDefinition

    [-TemplateId <String>]
    [-DisplayName <String>]
    [-RolePermissions <System.Collections.Generic.List`1[Microsoft.Open.MSGraph.Model.RolePermission]>]
    -UnifiedRoleDefinitionId <String>
    [-Description <String>]
    [-Version <String>]
    [-IsEnabled <Boolean>]
    [-ResourceScopes <System.Collections.Generic.List`1[System.String]>]
    [<CommonParameters>]

Updates a Microsoft Entra roleDefinition object identified by ID. You can't update built-in roles. This feature requires a Microsoft Entra ID P1 or P2 license.

In delegated scenarios, the signed-in user must have either a supported Microsoft Entra role or a custom role with the necessary permissions. The minimum roles required for this operation are:

• Privileged Role Administrator

Connect-Entra -Scopes 'RoleManagement.ReadWrite.Directory'
$roleDefinition = Get-EntraDirectoryRoleDefinition -Filter "DisplayName eq '<Role-Definition-Name>'"
Set-EntraDirectoryRoleDefinition -UnifiedRoleDefinitionId $roleDefinition.Id -DisplayName 'UpdatedDisplayName'

This example updates the specified role definition in Microsoft Entra ID.

• -UnifiedRoleDefinitionId parameter specifies the roleDefinition object ID.
• -DisplayName parameter specifies the display name for the role definition.

Connect-Entra -Scopes 'RoleManagement.ReadWrite.Directory'
$roleDefinition = Get-EntraDirectoryRoleDefinition -Filter "DisplayName eq '<Role-Definition-Name>'"
Set-EntraDirectoryRoleDefinition -UnifiedRoleDefinitionId $roleDefinition.Id -Description 'MYROLEUPDATE1S'

This example updates the Description of specified role definition in Microsoft Entra ID.

• -UnifiedRoleDefinitionId parameter specifies the roleDefinition object ID.
• -Description parameter specifies the description for the role definition.

Connect-Entra -Scopes 'RoleManagement.ReadWrite.Directory'
$roleDefinition = Get-EntraDirectoryRoleDefinition -Filter "DisplayName eq '<Role-Definition-Name>'"
Set-EntraDirectoryRoleDefinition -UnifiedRoleDefinitionId $roleDefinition.Id -IsEnabled $true

This example updates the IsEnabled of specified role definition in Microsoft Entra ID.

• -UnifiedRoleDefinitionId parameter specifies the roleDefinition object ID.
• -IsEnabled parameter specifies whether the role definition is enabled.

Connect-Entra -Scopes 'RoleManagement.ReadWrite.Directory'
$roleDefinition = Get-EntraDirectoryRoleDefinition -Filter "DisplayName eq '<Role-Definition-Name>'"
$rolePermissions = New-object Microsoft.Open.MSGraph.Model.RolePermission
$rolePermissions.AllowedResourceActions = @("microsoft.directory/applications/standard/read")
$params = @{
    UnifiedRoleDefinitionId = $roleDefinition.Id
    Description             = 'Update'
    DisplayName             = 'Update'
    ResourceScopes          = '/'
    IsEnabled               = $false
    RolePermissions         = $rolePermissions
    TemplateId              = 'f2ef992c-3afb-46b9-b7cf-a126ee74c451'
    Version                 = 2
}
Set-EntraDirectoryRoleDefinition @params

This example updates the RolePermissions, TemplateId, TemplateId, ResourceScopes of specified role definition in Microsoft Entra ID.

• -UnifiedRoleDefinitionId parameter specifies the roleDefinition object ID.
• -RolePermissions parameter specifies the permissions for the role definition.
• -IsEnabled parameter specifies whether the role definition is enabled.
• -DisplayName parameter specifies the display name for the role definition.
• -Description parameter specifies the description for the role definition.
• -ResourceScopes parameter specifies the resource scopes for the role definition.
• -TemplateId parameter specifies the template ID for the role definition.
• -Version parameter specifies the version for the role definition.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Set-EntraRoleDefinition is an alias for Set-EntraDirectoryRoleDefintion.