Directory Roles and Deleted Items

Two related areas: who holds administrative roles in your directory, and what can still be recovered after deletion.

List Directory Roles

Returns the administrative roles currently activated in your tenant.

Each entry carries a role template identifier, which is what the assignment components need as input. In practice you run this component first and feed its output into an assignment.

Assign Directory Role

Grants an administrative role to a user.

If the role has not been activated in your tenant yet, it is activated as part of the assignment — so you do not need a separate preparation step for roles nobody has held before.

Remove Directory Role

Revokes an administrative role from a user.

List Deleted Items

Shows what is currently in the recycle bin. A selector decides whether you are looking at deleted users, groups or app registrations.

Microsoft keeps deleted objects for 30 days. After that they are purged and no longer recoverable, which makes this component worth checking on a schedule rather than only when something goes missing.

Restore Deleted Item

Restores an object from the recycle bin. The same component works for users, groups and app registrations alike.

This is the safety net behind every delete step in your flows. It is also the reason a staged approach — disable, wait, then delete — costs you very little: for 30 days after the delete, the decision is still reversible.