Add-EntraBetaScopedRoleMembership

Add-EntraBetaScopedRoleMembership

    -AdministrativeUnitId <String>
    [-RoleMemberInfo <RoleMemberInfo>]
    [-RoleObjectId <String>]
    [<CommonParameters>]

The Add-EntraBetaScopedRoleMembership cmdlet adds a scoped role membership to an administrative unit. Specify AdministrativeUnitId parameter to add a scoped role membership.

For delegated scenarios, the calling user needs at least the Privileged Role Administrator Microsoft Entra role.

Connect-Entra -Scopes 'RoleManagement.ReadWrite.Directory'
$user = Get-EntraBetaUser -UserId 'SawyerM@contoso.com'
$role = Get-EntraBetaDirectoryRole -Filter "DisplayName eq 'Helpdesk Administrator'"
$administrativeUnit = Get-EntraBetaAdministrativeUnit -Filter "DisplayName eq 'Pacific Administrative Unit'"
$roleMember = New-Object -TypeName Microsoft.Open.MSGraph.Model.MsRoleMemberInfo
$roleMember.Id = $user.Id
Add-EntraBetaScopedRoleMembership -AdministrativeUnitId $administrativeUnit.Id -RoleObjectId $role.Id -RoleMemberInfo $roleMember

Id                                                                AdministrativeUnitId                 RoleId
--                                                                --------------------                 ------
dddddddddddd-bbbb-aaaa-bbbb-cccccccccccc aaaaaaaa-bbbb-aaaa-bbbb-cccccccccccc bbbbbbbb-1111-2222-3333-cccccccccccc

The example shows how to add a user to the specified role within the specified administrative unit.

• -AdministrativeUnitId Parameter specifies the ID of an administrative unit.
• -RoleObjectId Parameter specifies the ID of a directory role.
• -RoleMemberInfo Parameter specifies a RoleMemberInfo object.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.