REST API: roles and members

Custom roles are part of your organization's authorization. Before you create or change a role, list the roles. Use the returned role identifier, not a display name, to assign the role to a member. After you change a role, read it again. This gives your access-management system the correct configuration.

Role changes have stricter requirements than other resource edits. They need an owner-created key and Enterprise entitlement. A valid write key alone is not enough. Design your provisioning to detect FEATURE_NOT_AVAILABLE and scope or permission failures. When the organization lacks Enterprise entitlement, the API returns FEATURE_NOT_AVAILABLE. Do not show a partial role change as successful.

Tie member assignment and removal to your own joiner-mover-leaver controls. A role deletion does not delete the member. Other permission sources stay in place too.

Before you delete a role, move or remove every member that depends on it. Keep a record of the change. Check the response envelope to confirm the result.

For Help Desk routing membership, see the Teams documentation. Help Desk routing membership is separate from custom-role administration.