Azure won't show roleDefinition for directory roles

Question

I'm using the following API, it works with regular roles such as "Reader":"acdd72a7-3385-48ef-bd42-f606fba81ae7".

az rest --method get --url 'https://management.azure.com/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7?api-version=2022年04月01日'

However it won't work with directory roles such as this https://www.azadvertizer.net/azentraidroles/e8611ab8-c189-46e8-94e1-60213ab1f814.html

az rest `
 --method get `
 --url "https://management.azure.com/providers/Microsoft.Authorization/roleDefinitions?`$filter=roleName+eq+'Privileged Role Administrator'&api-version=2022年04月01日"
# nothing 
az rest --method get --url 'https://management.azure.com/providers/Microsoft.Authorization/roleDefinitions/e8611ab8-c189-46e8-94e1-60213ab1f814?api-version=2022年04月01日'
# Not Found({"error":{"code":"RoleDefinitionDoesNotExist","message":"The specified role definition with ID 'e8611ab8-c189-46e8-94e1-60213ab1f814' does not exist."}})

The query will always return an empty value. How can I list the roleDefinition and data actions for such a role?

• Sridevi: ARM’s roleDefinitions API only covers Azure RBAC roles, not Azure AD directory roles. Use Microsoft Graph’s /roleManagement/directory/roleDefinitions endpoint to fetch unified directory role definitions and their permissions.

Answer 1

You can only retrieve Azure RBAC roles via ARM’s /roleDefinitions endpoint. Initially, I too got same results:

az rest `
 --method get `
 --url "https://management.azure.com/providers/Microsoft.Authorization/roleDefinitions?`$filter=roleName+eq+'Privileged Role Administrator'&api-version=2022年04月01日"
az rest --method get --url 'https://management.azure.com/providers/Microsoft.Authorization/roleDefinitions/e8611ab8-c189-46e8-94e1-60213ab1f814?api-version=2022年04月01日'

enter image description here

Instead, call Microsoft Graph’s roleManagement/directory API to fetch unified directory roles and their permissions.

To retrieve Privileged Role Administrator role definition, make use of below call:

az rest --method GET --uri 'https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions?$filter=displayName eq ''Privileged Role Administrator'''

enter image description here

Reference:

Get unifiedRoleDefinition - Microsoft Graph