---
sourceDocument: Australia Workflow Data Fabric
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/integrate-applications

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Workflow Data Fabric

ft:clusterId :

    - crint

bundleId :

    - crint

workflow :

    - Creator


---

# Microsoft Azure RBAC Spoke

# Microsoft Azure RBAC Spoke {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Integrate ServiceNow instance with Microsoft Azure RBAC to manage roles and retrieve details about role assignments for groups and users.

## Request apps on the Store {#azure-rbac-spoke__section_ulm_g1w_zfc}

Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/r/store-release-notes/sn-store-release-notes.html).{#azure-rbac-spoke__inline-send-to-store}

## Integration Hub subscription {#azure-rbac-spoke__section_nsp_g1w_zfc}

This spoke requires an Integration Hub subscription. For more information, see [Legal schedules - IntegrationHub overview](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/legal/snc-addendum-integrationhub.pdf).

## Spoke version {#azure-rbac-spoke__id_n31_c4w_zfc}

Microsoft Azure RBAC Spoke v1.0.2 is the latest version. For version history of the spoke, see [Microsoft Azure RBAC Spoke release notes](https://www.servicenow.com/docs/r/store-release-notes/store-integrationhub-rn-ms-azure-rbac-spoke.html).{#azure-rbac-spoke__ms-azure-rbac-ver}

## Supported versions {#azure-rbac-spoke__section_bs5_g1w_zfc}

This spoke was built for Microsoft Graph REST API v1.0, but may be compatible with later versions.

## Spoke dependencies {#azure-rbac-spoke__section_gs5_g1w_zfc}

If you're having trouble installing the app, ensure that these dependent plugins are installed:

* Complex Object (com.glide.cobject)
* ServiceNow IntegrationHub Runtime (com.glide.hub.integration.runtime)
* ServiceNow IntegrationHub Action Step - REST (com.glide.hub.action_step.rest)
* ServiceNow IntegrationHub Action Template - Data Stream (com.glide.hub.action_type.datastream)
{#azure-rbac-spoke__ul_hs5_g1w_zfc}  
Note:  
Some of these plugins are licensable features and require appropriate licenses, if used outside the spoke implementation.

## Spoke actions {#azure-rbac-spoke__section_ms5_g1w_zfc}

The Microsoft Azure RBAC Spoke provides actions to automate tasks when events occurs in your ServiceNow instance. Available actions include:  
{#azure-rbac-spoke__table_ns5_g1w_zfc__entry__4}

| Category | Action | Description | Permissions Required (from least to most privileged) ||
|-|-|-|-|-|
| Group Management | Look up Groups by Role Stream | Lists all the groups that contains the given role. | Delegated (work or school account) | RoleManagement.Read.Directory, RoleManagement.Read.All, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All |
| Group Management | Look up Groups by Role Stream | Lists all the groups that contains the given role. | Delegated (personal Microsoft account) | Not supported |
| Group Management | Look up Groups by Role Stream | Lists all the groups that contains the given role. | Application | RoleManagement.Read.Directory, RoleManagement.Read.All, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All |
| Role Management | Assign Role to Group | Assigns the required role to a group. | Delegated (work or school account) | RoleManagement.ReadWrite.Directory |
| Role Management | Assign Role to Group | Assigns the required role to a group. | Delegated (personal Microsoft account) | Not supported |
| Role Management | Assign Role to Group | Assigns the required role to a group. | Application | RoleManagement.ReadWrite.Directory |
| Role Management | Assign Role to User | Assign the required role to a user. | Delegated (work or school account) | RoleManagement.ReadWrite.Directory |
| Role Management | Assign Role to User | Assign the required role to a user. | Delegated (personal Microsoft account) | Not supported |
| Role Management | Assign Role to User | Assign the required role to a user. | Application | RoleManagement.ReadWrite.Directory |
| Role Management | Look up Roles | Retrieves details of the required role or retrieves details of all the roles in Entra ID if no inputs are provided. | Delegated (work or school account) | RoleManagement.Read.Directory, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All |
| Role Management | Look up Roles | Retrieves details of the required role or retrieves details of all the roles in Entra ID if no inputs are provided. | Delegated (personal Microsoft account) | Not supported |
| Role Management | Look up Roles | Retrieves details of the required role or retrieves details of all the roles in Entra ID if no inputs are provided. | Application | RoleManagement.Read.Directory, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All |
| Role Management | Look up Roles by Group | Lists details of all roles in a group. | Delegated (work or school account) | RoleManagement.Read.Directory, RoleManagement.Read.All, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All |
| Role Management | Look up Roles by Group | Lists details of all roles in a group. | Delegated (personal Microsoft account) | Not supported |
| Role Management | Look up Roles by Group | Lists details of all roles in a group. | Application | RoleManagement.Read.Directory, RoleManagement.Read.All, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All |
| Role Management | Look up Roles by User | Lists all roles of the user. | Delegated (work or school account) | RoleManagement.Read.Directory, RoleManagement.Read.All, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All |
| Role Management | Look up Roles by User | Lists all roles of the user. | Delegated (personal Microsoft account) | Not supported |
| Role Management | Look up Roles by User | Lists all roles of the user. | Application | RoleManagement.Read.Directory, RoleManagement.Read.All, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All |
| Role Management | Remove Role from a User or Group | Remove the required role for a user or group. | Delegated (work or school account) | RoleManagement.ReadWrite.Directory |
| Role Management | Remove Role from a User or Group | Remove the required role for a user or group. | Delegated (personal Microsoft account) | Not supported |
| Role Management | Remove Role from a User or Group | Remove the required role for a user or group. | Application | RoleManagement.ReadWrite.Directory |
| User Management | Look up Users by Role Stream | Lists details all the users that have the required role. | Delegated (work or school account) | RoleManagement.Read.Directory, RoleManagement.Read.All, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All |
| User Management | Look up Users by Role Stream | Lists details all the users that have the required role. | Delegated (personal Microsoft account) | Not supported |
| User Management | Look up Users by Role Stream | Lists details all the users that have the required role. | Application | RoleManagement.Read.Directory, RoleManagement.Read.All, Directory.Read.All, RoleManagement.ReadWrite.Directory, Directory.ReadWrite.All |
[ ]

{#azure-rbac-spoke__table_ns5_g1w_zfc}

## Connection and credential alias requirements {#azure-rbac-spoke__section_ts5_g1w_zfc}

Integration Hub uses aliases to manage connection and credential information, and OAuth credentials. Using an alias eliminates the need to configure multiple credentials and connection information
profiles when using multiple environments. If the connection or credential information changes, you don't need to update any actions that use the connection.