REST API: roles and members
Manage custom roles with ownership and Enterprise constraints.
Custom roles are an organization authorization concern. List roles before creating or changing one, and use the returned role identifier—not a display name—to assign it to a member. Read a role again after a mutation so your access-management system has the effective configuration it intended to publish.
Role mutations have stricter requirements than ordinary resource edits: they require an owner-created key and Enterprise entitlement. A valid write key alone is not enough. Design provisioning to detect PLAN_UPGRADE_REQUIRED and scope or permission failures explicitly, rather than presenting a partial role change as successful.
Member assignment and removal should be tied to your own joiner/mover/leaver controls. Removing a custom role does not imply deletion of the member or every other permission source. Before deleting a role, move or remove all members that depend on it, preserve a change record, and check the response envelope. Use the Teams documentation for Help Desk routing membership, which is separate from custom-role administration.