Set-EntraBetaAppRoleToApplicationUser

The Set-EntraBetaAppRoleToApplicationUser command adds existing users (for example, from a Helpdesk or billing application) to Microsoft Entra ID and assigns them app roles like Admin, Audit, or Reports. This enables the application unlock Microsoft Entra ID Governance features like access reviews.

This feature requires a Microsoft Entra ID Governance or Microsoft Entra Suite license, see Microsoft Entra ID Governance licensing fundamentals.

In delegated scenarios, the signed-in user must have either a supported Microsoft Entra role or a custom role with the necessary permissions. The minimum roles required for this operation are:

• User Administrator (create users)
• Application Administrator
• Identity Governance Administrator (manage application role assignments)

Connect-Entra -Scopes 'User.ReadWrite.All', 'Application.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All', 'EntitlementManagement.ReadWrite.All'
Set-EntraBetaAppRoleToApplicationUser -DataSource "Generic" -FilePath "C:\temp\users.csv" -ApplicationName "TestApp"

This example assigns users to app roles. It creates missing users and app roles. If a role assignment doesn't exist, it's created; otherwise, it's skipped.

• -DataSource parameter specifies the source of the data, for example, SAP Identity, database, or directory. The value determines the attribute matching. For example, For SAP Cloud Identity Services, the default mapping is userName (SAP SCIM) to userPrincipalName (Microsoft Entra ID). For databases or directories, the Email column value might match the userPrincipalName in Microsoft Entra ID.
• -FilePath parameter specifies the path to the input file containing users, for example, C:\temp\users.csv.
• -ApplicationName parameter specifies the application name in Microsoft Entra ID.

Connect-Entra -Scopes 'User.ReadWrite.All', 'Application.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All', 'EntitlementManagement.ReadWrite.All'
Set-EntraBetaAppRoleToApplicationUser -DataSource "SAPCloudIdentity" -FilePath "C:\temp\users-exported-from-sap.csv" -ApplicationName "TestApp" -Verbose

This example assigns users to app roles. It creates missing users and app roles. If a role assignment doesn't exist, it's created; otherwise, it's skipped.

• -DataSource parameter specifies the source of the data, for example, SAP Identity, database, or directory. The value determines the attribute matching. For example, For SAP Cloud Identity Services, the default mapping is userName (SAP SCIM) to userPrincipalName (Microsoft Entra ID). For databases or directories, the Email column value might match the userPrincipalName in Microsoft Entra ID.
• -FilePath parameter specifies the path to the input file containing users, for example, C:\temp\users.csv.
• -ApplicationName parameter specifies the application name in Microsoft Entra ID.
• -Verbose common parameter outputs the execution steps during processing.

Connect-Entra -Scopes 'User.ReadWrite.All', 'Application.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All', 'EntitlementManagement.ReadWrite.All'
Set-EntraBetaAppRoleToApplicationUser -DataSource "Generic" -FilePath "C:\temp\users.csv" -ApplicationName "TestApp" -Export -Verbose

This example assigns users to app roles. It creates missing users and app roles. If a role assignment doesn't exist, it's created; otherwise, it's skipped.

• -DataSource parameter specifies the source of the data, for example, SAP Identity, database, or directory. The value determines the attribute matching. For example, For SAP Cloud Identity Services, the default mapping is userName (SAP SCIM) to userPrincipalName (Microsoft Entra ID). For databases or directories, the Email column value might match the userPrincipalName in Microsoft Entra ID.
• -FilePath parameter specifies the path to the input file containing users, for example, C:\temp\users.csv.
• -ApplicationName parameter specifies the application name in Microsoft Entra ID.
• -Export switch parameter enables export of results into a CSV file. If ExportFilePath parameter isn't provided, results are exported in the current location.
• -Verbose common parameter outputs the execution steps during processing.

Connect-Entra -Scopes 'User.ReadWrite.All', 'Application.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All', 'EntitlementManagement.ReadWrite.All'
Set-EntraBetaAppRoleToApplicationUser -DataSource "Generic" -FilePath "C:\temp\users.csv" -ApplicationName "TestApp" -Export -ExportFilePath "C:\temp\EntraAppRoleAssignments_yyyyMMdd.csv" -Verbose

This example assigns users to app roles. It creates missing users and app roles. If a role assignment doesn't exist, it's created; otherwise, it's skipped.

• -DataSource parameter specifies the source of the data, for example, SAP Identity, database, or directory. The value determines the attribute matching. For example, For SAP Cloud Identity Services, the default mapping is userName (SAP SCIM) to userPrincipalName (Microsoft Entra ID). For databases or directories, the Email column value might match the userPrincipalName in Microsoft Entra ID.
• -FilePath parameter specifies the path to the input file containing users, for example, C:\temp\users.csv.
• -ApplicationName parameter specifies the application name in Microsoft Entra ID.
• -Export switch parameter enables export of results into a CSV file. If ExportFilePath parameter isn't provided, results are exported in the current location.
• -ExportFilePath parameter specifies a specific filename and location to export results.
• -Verbose common parameter outputs the execution steps during processing.

System.String

System.Object

How to Govern an application's existing users