microsoft.graph.unifiedRoleDefinition

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-unified-role-definition-schema.json",
  "title": "microsoft.graph.unifiedRoleDefinition",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ad-rolemanagement-rbacapplication-api-openapi.yml#/components/schemas/microsoft.graph.unifiedRoleDefinition",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "unifiedRoleDefinition",
      "type": "object",
      "properties": {
        "description": {
          "type": [
            "string",
            "null"
          ],
          "description": "The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true."
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ],
          "description": "The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required.  Supports $filter (eq, in)."
        },
        "isBuiltIn": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Flag indicating whether the role definition is part of the default set included in Microsoft Entra or a custom definition. Read-only. Supports $filter (eq, in)."
        },
        "isEnabled": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true."
        },
        "resourceScopes": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment."
        },
        "rolePermissions": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.unifiedRolePermission"
          },
          "description": "List of permissions included in the role. Read-only when isBuiltIn is true. Required."
        },
        "templateId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories."
        },
        "version": {
          "type": [
            "string",
            "null"
          ],
          "description": "Indicates version of the role definition. Read-only when isBuiltIn is true."
        },
        "inheritsPermissionsFrom": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.unifiedRoleDefinition"
          },
          "description": "Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand.",
          "x-ms-navigationProperty": true
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  ],
  "$defs": {
    "microsoft.graph.entity": {
      "title": "entity",
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.unifiedRoleDefinition": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "unifiedRoleDefinition",
          "type": "object",
          "properties": {
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "The description for the unifiedRoleDefinition. Read-only when isBuiltIn is true."
            },
            "displayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is true. Required.  Supports $filter (eq, in)."
            },
            "isBuiltIn": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "Flag indicating whether the role definition is part of the default set included in Microsoft Entra or a custom definition. Read-only. Supports $filter (eq, in)."
            },
            "isEnabled": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "Flag indicating whether the role is enabled for assignment. If false the role is not available for assignment. Read-only when isBuiltIn is true."
            },
            "resourceScopes": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "description": "List of the scopes or permissions the role definition applies to. Currently only / is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment."
            },
            "rolePermissions": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.unifiedRolePermission"
              },
              "description": "List of permissions included in the role. Read-only when isBuiltIn is true. Required."
            },
            "templateId": {
              "type": [
                "string",
                "null"
              ],
              "description": "Custom template identifier that can be set when isBuiltIn is false but is read-only when isBuiltIn is true. This identifier is typically used if one needs an identifier to be the same across different directories."
            },
            "version": {
              "type": [
                "string",
                "null"
              ],
              "description": "Indicates version of the role definition. Read-only when isBuiltIn is true."
            },
            "inheritsPermissionsFrom": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.unifiedRoleDefinition"
              },
              "description": "Read-only collection of role definitions that the given role definition inherits from. Only Microsoft Entra built-in roles (isBuiltIn is true) support this attribute. Supports $expand.",
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.unifiedRolePermission": {
      "title": "unifiedRolePermission",
      "type": "object",
      "properties": {
        "allowedResourceActions": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Set of tasks that can be performed on a resource. Required."
        },
        "condition": {
          "type": [
            "string",
            "null"
          ],
          "description": "Optional constraints that must be met for the permission to be effective. Not supported for custom roles."
        },
        "excludedResourceActions": {
          "type": "array",
          "items": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "Set of tasks that may not be performed on a resource. Not yet supported."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  }
}