title: Assigning custom roles on user creation in Azure AD
body: <p>Azure lets you define custom roles for an AD tenant by modifying the manifest:</p>
  
  <pre><code> "appRoles": [
  {
    "allowedMemberTypes": [
      "User"
    ],
    "description": "Admins can manage roles and perform all actions.",
    "displayName": "Global Admin",
    "id": "some GUID",
    "isEnabled": true,
    "value": "Admin"
  }, ... ],
  </code></pre>
  
  <p>and, according to the <a href="https://msdn.microsoft.com/en-us/library/azure/ad/graph/api/entity-and-complex-type-reference#AppRoleAssignmentEntity" rel="nofollow">msdn azure graph api reference</a>, you can use the graph api to programmatically assign a user to a custom role. But I'm having trouble getting this to work where I'm creating a new user and trying to assign a role using <code>AppRoleAssignment</code>. I think the problem is that I need to define the user's ID, but that is defined by Azure once the user is created, so does that mean it's impossible to assign a user to a role at the point of creation and it can only be done once the user has been added to the directory ? Below is a snippet of the code I'm using to assign the role.</p>
  
  <pre><code>var appRoleAssignment = new AppRoleAssignment();
              appRoleAssignment.Id = Guid.Parse("some-guid-here");
              appRoleAssignment.ResourceId = Guid.Parse(clientId);
              appRoleAssignment.PrincipalId = ??? // what should go here for a user that hasn't been created yet ?
  </code></pre>