Directory Writers
Read and write selected basic directory information for supported scenarios.
Least-privilege guidance: Prefer object-specific roles or Graph permissions because Directory Writers is broad and intended for limited supported scenarios.
Assignment playbook
Grant the role without creating standing risk
Choose the narrowest role, scope, duration, and activation model that still completes the task.
Decision checks
- Confirm the operator needs to perform one of the listed tasks, not a broader adjacent task.
- Does not grant every sensitive write operation or privileged role management capability.
- Check whether a workload-specific role or administrative-unit scope can narrow access further.
Recommended assignment
- Prefer object-specific roles or Graph permissions because Directory Writers is broad and intended for limited supported scenarios.
- Prefer an eligible PIM assignment for occasional administration; use a time-bound active assignment only when the workflow requires it.
- Scope the assignment to an administrative unit or application when the role supports that scope.
- Require MFA, justification, approval, and a short activation duration for privileged roles where practical.
Verify
- Confirm the assignment appears at the expected scope and as eligible or active as designed.
- Activate the role if required, then test the smallest intended task and one nearby task that should remain denied.
- Review Entra audit logs for the assignment/activation and record the ticket or business justification.
Escalate when
- The role documentation lists the action but the activated, correctly scoped assignment still cannot perform it.
- The task succeeds only with a broader role; verify whether an additional Graph permission, workload RBAC role, ownership, or license is required.
- You can provide the principal, role, assignment scope/type, activation time, target resource, correlation ID, and sanitized audit event.
Role assignment evidence template
Role: Directory Writers
Principal object ID: <guid>
Assignment scope: <tenant | administrative unit | application>
Assignment type: <eligible | active>
UTC activation/test time: <yyyy-mm-dd hh:mm:ssZ>
Correlation ID: <guid>Template only. Record object IDs in a private ticket; never include credentials or tokens.
Read role assignment schedule instances
GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleInstances?$filter=principalId eq '<object-id>'Read-only Microsoft Graph request. Requires an appropriately permissioned administrative session.
Advertisement
Common tasks
- Update supported directory objects
- Maintain selected directory properties
- Support applications requiring directory writes
What it cannot do
Does not grant every sensitive write operation or privileged role management capability.