Attribute Assignment Administrator

Assign supported custom security attribute values to Microsoft Entra objects.

Least-privilege guidance: Use for operators who populate approved attributes without designing the attribute schema.

Assignment playbook

Grant the role without creating standing risk

Choose the narrowest role, scope, duration, and activation model that still completes the task.

Decision checks

Confirm the operator needs to perform one of the listed tasks, not a broader adjacent task.
Cannot define new attribute sets or definitions unless separately authorized.
Check whether a workload-specific role or administrative-unit scope can narrow access further.

Recommended assignment

Use for operators who populate approved attributes without designing the attribute schema.
Prefer an eligible PIM assignment for occasional administration; use a time-bound active assignment only when the workflow requires it.
Scope the assignment to an administrative unit or application when the role supports that scope.
Require MFA, justification, approval, and a short activation duration for privileged roles where practical.

Verify

Confirm the assignment appears at the expected scope and as eligible or active as designed.
Activate the role if required, then test the smallest intended task and one nearby task that should remain denied.
Review Entra audit logs for the assignment/activation and record the ticket or business justification.

Escalate when

The role documentation lists the action but the activated, correctly scoped assignment still cannot perform it.
The task succeeds only with a broader role; verify whether an additional Graph permission, workload RBAC role, ownership, or license is required.
You can provide the principal, role, assignment scope/type, activation time, target resource, correlation ID, and sanitized audit event.

Role assignment evidence template

Role: Attribute Assignment Administrator
Principal object ID: <guid>
Assignment scope: <tenant | administrative unit | application>
Assignment type: <eligible | active>
UTC activation/test time: <yyyy-mm-dd hh:mm:ssZ>
Correlation ID: <guid>

Template only. Record object IDs in a private ticket; never include credentials or tokens.

Read role assignment schedule instances

GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleInstances?$filter=principalId eq '<object-id>'

Read-only Microsoft Graph request. Requires an appropriately permissioned administrative session.

← Search another role

Common tasks

Assign custom security attributes
Update attribute values
Remove supported attribute assignments

What it cannot do

Cannot define new attribute sets or definitions unless separately authorized.