Microsoft Entra ID (formerly Azure AD)

Microsoft Entra ID (formerly Azure AD) Directory Roles.directory Object API

The directoryRoles.directoryObject API from Microsoft Entra ID (formerly Azure AD) — 22 operation(s) for directoryroles.directoryobject.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 24

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /directoryRoles/{directoryRole-id}/members List members of a directory role · List members of a directory role #
Ask an LLM
“Who is assigned to the Global Administrator role in my Entra tenant?”
“Can I list a directory role's members using its template ID instead of its object ID?”
Tell an agent
List all members of directory role {role} with their full objects.
Show every principal assigned to role {role}.
DELETE /directoryRoles/{directoryRole-id}/members/{directoryObject-id}/$ref Remove a member from a directory role by id · Remove directory role member #
Ask an LLM
“How do I take a user out of an admin role in Entra ID?”
“Can I unassign one principal from a directory role by addressing it in the URL path?”
Tell an agent destructive · confirm first
Remove member {member} from directory role {role}.
Unassign principal {member} from role {role} using its path id.
GET /directoryRoles/{directoryRole-id}/members/{directoryObject-id}/microsoft.graph.application Get a directory role member as an application · Get the item of type microsoft.graph.directoryObject as… #
Ask an LLM
“How do I read a role member cast as an application object?”
“Is a particular member of this directory role an app registration?”
Tell an agent
Get member {member} of role {role} as an application.
Fetch the application details of role {role} member {member}.
GET /directoryRoles/{directoryRole-id}/members/{directoryObject-id}/microsoft.graph.device Get a directory role member as a device · Get the item of type microsoft.graph.directoryObject as microsoft.graph.device #
Ask an LLM
“How do I read a directory role member cast as a device?”
“Is one of this role's members actually a device object?”
Tell an agent
Get member {member} of role {role} as a device.
Fetch the device details of role {role} member {member}.
GET /directoryRoles/{directoryRole-id}/members/{directoryObject-id}/microsoft.graph.group Get a directory role member as a group · Get the item of type microsoft.graph.directoryObject as microsoft.graph.group #
Ask an LLM
“How do I read a role member cast as a group, for a role-assignable group?”
“Is a given member of this admin role a group rather than a person?”
Tell an agent
Get member {member} of role {role} as a group.
Fetch the group details of role {role} member {member}.
GET /directoryRoles/{directoryRole-id}/members/{directoryObject-id}/microsoft.graph.orgContact Get a directory role member as an org contact · Get the item of type microsoft.graph.directoryObject as… #
Ask an LLM
“How do I read a role member cast as an organizational contact?”
“Is a particular member of this role an org contact?”
Tell an agent
Get member {member} of role {role} as an organizational contact.
Fetch the org contact details of role {role} member {member}.
GET /directoryRoles/{directoryRole-id}/members/{directoryObject-id}/microsoft.graph.servicePrincipal Get a directory role member as a service principal · Get the item of type microsoft.graph.directoryObject as… #
Ask an LLM
“How do I read a role member cast as a service principal?”
“Which enterprise app is this particular directory role member?”
Tell an agent
Get member {member} of role {role} as a service principal.
Fetch the service principal details of role {role} member {member}.
GET /directoryRoles/{directoryRole-id}/members/{directoryObject-id}/microsoft.graph.user Get a directory role member as a user · Get the item of type microsoft.graph.directoryObject as microsoft.graph.user #
Ask an LLM
“How do I read one role member's user profile directly?”
“Is a particular member of this admin role a user account?”
Tell an agent
Get member {member} of role {role} as a user.
Fetch the user profile of role {role} member {member}.
GET /directoryRoles/{directoryRole-id}/members/$count Count all members of a directory role · Get the number of the resource #
Ask an LLM
“How many principals of any type hold a given directory role?”
“What's the total number of members across all types in an admin role?”
Tell an agent
Count all members of directory role {role}.
Tell me how many principals are assigned to role {role} in total.
GET /directoryRoles/{directoryRole-id}/members/$ref List references to a directory role's members · List members of a directory role #
Ask an LLM
“Can I get just the reference links for a role's members instead of the full objects?”
“Which member ids and @odata.id links does a directory role hold?”
Tell an agent
List the member references ($ref) of directory role {role}.
Return only the @odata.id links for members of role {role}.
POST /directoryRoles/{directoryRole-id}/members/$ref Add a member to a directory role · Add directory role member #
Ask an LLM
“How do I assign a user to an Entra admin role through the Graph API?”
“Can I add a service principal to a directory role by its @odata.id reference?”
Tell an agent
Add {member_ref} as a member of directory role {role}.
Assign the principal at {member_ref} to role {role}.
DELETE /directoryRoles/{directoryRole-id}/members/$ref Remove a role member by reference query · Remove directory role member #
Ask an LLM
“Can I remove a directory role member by passing its @id as a query parameter?”
“What is the collection-level way to unassign someone from a directory role?”
Tell an agent destructive · confirm first
Remove the member referenced by {member_ref} from role {role} via the @id query.
Unassign {member_ref} from directory role {role} using the members $ref collection.
GET /directoryRoles/{directoryRole-id}/members/microsoft.graph.application List a directory role's application members · Get the items of type microsoft.graph.application in the… #
Ask an LLM
“Which applications hold a given directory role?”
“Can I filter a role's members down to app registrations only?”
Tell an agent
List only the application members of role {role}.
Show the apps assigned to directory role {role}.
GET /directoryRoles/{directoryRole-id}/members/microsoft.graph.application/$count Count a directory role's application members · Get the number of the resource #
Ask an LLM
“How many applications are assigned to a directory role?”
“What's the number of app members in an admin role?”
Tell an agent
Count the application members of role {role}.
Tell me how many apps hold directory role {role}.
GET /directoryRoles/{directoryRole-id}/members/microsoft.graph.device List a directory role's device members · Get the items of type microsoft.graph.device in the… #
Ask an LLM
“Which devices are members of a given directory role?”
“Can I narrow a role's member list to device objects?”
Tell an agent
List only the device members of role {role}.
Show the devices assigned to directory role {role}.
GET /directoryRoles/{directoryRole-id}/members/microsoft.graph.device/$count Count a directory role's device members · Get the number of the resource #
Ask an LLM
“How many devices are members of a directory role?”
“What's the device member count for an admin role?”
Tell an agent
Count the device members of role {role}.
Tell me how many devices hold directory role {role}.
GET /directoryRoles/{directoryRole-id}/members/microsoft.graph.group List a directory role's group members · Get the items of type microsoft.graph.group in the… #
Ask an LLM
“Which role-assignable groups are members of an admin role?”
“Can I see only the groups assigned to a directory role?”
Tell an agent
List only the group members of role {role}.
Show the groups assigned to directory role {role}.
GET /directoryRoles/{directoryRole-id}/members/microsoft.graph.group/$count Count a directory role's group members · Get the number of the resource #
Ask an LLM
“How many groups are assigned to a directory role?”
“What's the group member count for an admin role?”
Tell an agent
Count the group members of role {role}.
Tell me how many groups hold directory role {role}.
GET /directoryRoles/{directoryRole-id}/members/microsoft.graph.orgContact List a directory role's org contact members · Get the items of type microsoft.graph.orgContact in the… #
Ask an LLM
“Which organizational contacts appear as members of a directory role?”
“Can I filter a role's members to org contacts only?”
Tell an agent
List only the org contact members of role {role}.
Show the organizational contacts in directory role {role}.
GET /directoryRoles/{directoryRole-id}/members/microsoft.graph.orgContact/$count Count a directory role's org contact members · Get the number of the resource #
Ask an LLM
“How many org contacts are members of a directory role?”
“What's the organizational contact count for an admin role?”
Tell an agent
Count the org contact members of role {role}.
Tell me how many organizational contacts hold directory role {role}.
GET /directoryRoles/{directoryRole-id}/members/microsoft.graph.servicePrincipal List a directory role's service principal members · Get the items of type microsoft.graph.servicePrincipal in the… #
Ask an LLM
“Which service principals have been granted a given admin role?”
“Can I see just the enterprise apps holding a directory role?”
Tell an agent
List only the service principal members of role {role}.
Show the service principals assigned to directory role {role}.
GET /directoryRoles/{directoryRole-id}/members/microsoft.graph.servicePrincipal/$count Count a directory role's service principal members · Get the number of the resource #
Ask an LLM
“How many service principals hold a directory role?”
“What's the service principal member count for an admin role?”
Tell an agent
Count the service principal members of role {role}.
Tell me how many service principals hold directory role {role}.
GET /directoryRoles/{directoryRole-id}/members/microsoft.graph.user List a directory role's user members · Get the items of type microsoft.graph.user in the… #
Ask an LLM
“Which people are Global Administrators in my tenant, excluding apps and groups?”
“Can I list just the user accounts assigned to a directory role?”
Tell an agent
List only the user members of role {role}.
Show the users assigned to directory role {role}.
GET /directoryRoles/{directoryRole-id}/members/microsoft.graph.user/$count Count a directory role's user members · Get the number of the resource #
Ask an LLM
“How many users hold a particular admin role in Entra ID?”
“What's the user member count for a directory role?”
Tell an agent
Count the user members of role {role}.
Tell me how many users hold directory role {role}.

Documentation

📖
Documentation
https://learn.microsoft.com/en-us/graph/api/overview
📖
Authentication
https://learn.microsoft.com/en-us/graph/auth/
📖
Documentation
https://learn.microsoft.com/en-us/graph/change-notifications-overview

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-directoryroles-directoryobject-api-openapi.yml

Other Resources

🔗
SDKs
https://learn.microsoft.com/en-us/graph/sdks/sdks-overview
🔗
ChangeLog
https://developer.microsoft.com/en-us/graph/changelog
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/asyncapi/azure-ad-change-notifications-webhooks.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/azure-ad:azure-ad-directoryroles-directoryobject-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

azure-ad-directoryroles-directoryobject-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Identity.DirectoryManagement Directory Roles.directory…
  version: v1.0
servers:
- url: https://graph.microsoft.com/v1.0/
  description: Core
security:
- azureaadv2: []
tags:


# --- truncated at 32 KB (891 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-directoryroles-directoryobject-api-openapi.yml