microsoft-graph-apimicrosoft-partner-center

How to find the roleDefinitionId of Unified roles in Microsoft graph API when creating delegated admin relationship POST


I intend to integrate PHP CRM with Microsoft graph and partner center so that i can be able create delegated admin relationship from CRM for customers i manage. This is the Microsoft article that is illustrating the create admin relationship object.

I need assistance to know how to get roleDefinitionId for a specific administrative role in the tenant so i can pass it in the body of the POST request or how i can list the unified roles and get the roleDefinitionId programmatically. thanks.

On POST request body we have roleDefinitionId and it's required which translates to a unified role being requested. The unified role is administrative role being requested for example Global admin, User administrator etc.. from the customer tenant.

Below its Microsoft POST request body, i just dont know how they know the 'roleDefinitionIdin the body stands for whichadministrative role`

POST https://graph.microsoft.com/v1.0/tenantRelationships/delegatedAdminRelationships
Content-Type: application/json

{
  "displayName": "Contoso admin relationship",
  "duration": "P730D",
  "customer": {
    "tenantId": "4b827261-d21f-4aa9-b7db-7fa1f56fb163",
    "displayName": "Contoso subsidiary Inc"
  },
  "accessDetails": {
    "unifiedRoles": [
      {
        "roleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de"
      },
      {
        "roleDefinitionId": "3a2c62db-5318-420d-8d74-23affee5d9d5"
      }
    ]
  },
  "autoExtendDuration": "P180D"
}

In my html form of course i need to have user select administrative role based on its name eg global admin, then backend to have ability to translate to its roleDefinitionId just as how to it works partner center GUI. At the moment in my form i need to input the roleDefinitionId.

My design flow enter image description here


Solution

  • You can use the /v1.0/roleManagement/directory/roleDefinitions endpoint to list all administrative role.

    If you want to filter a specific role like the Global Administrator or the User Administrator:

    /v1.0/roleManagement/directory/roleDefinitions?$filter=displayName eq 'Global Administrator'&$select=id,displayName