Remove-EntraDirectoryRoleMember

Remove-EntraDirectoryRoleMember

    -DirectoryRoleId <String>
    -MemberId <String>
    [<CommonParameters>]

The Remove-EntraDirectoryRoleMember cmdlet removes a member from a directory role in Microsoft Entra ID.

In delegated scenarios, the signed-in user must have either a supported Microsoft Entra role or a custom role with the necessary permissions. The minimum roles required for this operation are:

• Privileged Role Administrator

Connect-Entra -Scopes 'RoleManagement.ReadWrite.Directory'
$directoryRole = Get-EntraDirectoryRole -Filter "displayName eq 'Helpdesk Administrator'"
$member = Get-EntraDirectoryRoleMember -DirectoryRoleId $directoryRole.Id | Select Id, DisplayName, '@odata.type' | Where-Object {$_.DisplayName -eq 'Sawyer Miller'}
Remove-EntraDirectoryRoleMember -DirectoryRoleId $directoryRole.Id -MemberId $member.Id

This example removes the specified member from the specified role.

• -DirectoryRoleId - specifies the unique identifier (ObjectId) of the directory role from which the member will be removed.

• -MemberId - specifies the unique identifier (MemberId) of the member (user, group, or service principal) that is to be removed from the specified directory role.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.