Roles & access

8 live and 5 declared entity sets in the Roles & access category. Live entity sets answer requests today; declared ones are in the catalogue with their backing cmdlets and roles and return 501 Not Implemented until they ship.

Live entity sets

Entity set	Label	Routes	Read role	Write role
applicationAccessPolicies	App Mailbox Access Policies	4	Compliance.IPPS.Read.All	read-only
authenticationPolicies	Authentication Policies	5	OrganizationConfig.Read.All	OrganizationConfig.ReadWrite.All
managementRoleAssignments	Role Assignments	5	Rbac.Read.All	Rbac.ReadWrite.All
managementRoles	Management Roles	4	Rbac.Read.All	Rbac.ReadWrite.All
managementScopes	Management Scopes	5	Rbac.Read.All	Rbac.ReadWrite.All
roleAssignmentPolicies	User Mailbox Permissions	5	Rbac.Read.All	Rbac.ReadWrite.All
roleGroups	Admin Role Groups	9	Rbac.Read.All	Rbac.ReadWrite.All
servicePrincipals	App Service Principals	5	Rbac.Read.All	Rbac.ReadWrite.All

Declared, not yet implemented

Entity set	Label	Backing cmdlets	Note
authServers	OAuth Auth Servers	Get-AuthServer, Set-AuthServer, New-AuthServer, Remove-AuthServer	OAuth authorization servers (e.g. EvoSTS)
managementRoleEntries	Role Permissions	Get-ManagementRoleEntry, Set-ManagementRoleEntry, Add-ManagementRoleEntry, Remove-ManagementRoleEntry	Per-role cmdlet entries
partnerApplications	Partner Applications	Get-PartnerApplication, Set-PartnerApplication, New-PartnerApplication, Remove-PartnerApplication	OAuth partner-application registrations
roleGroupMembers	Role Group Members	Get-RoleGroupMember, Add-RoleGroupMember, Remove-RoleGroupMember	Role group memberships
securityPrincipals	Assignable Principals	Get-SecurityPrincipal	Security principals (RBAC pre-resolved subjects)