# App registration default role permissions **URL:** \ **Category:** Application Registrations\ **Created:** [January 8, 2024, 10:26am UTC](https://community.appgovscore.com/t/app-registration-default-role-permissions/48 "2024-01-08T10:26:24Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mattchatt](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.appgovscore.com/mattchatt/32/9_2.png) [@mattchatt](https://community.appgovscore.com/u/mattchatt)\ **Post date:** [January 8, 2024, 10:26am UTC](https://community.appgovscore.com/t/app-registration-default-role-permissions/48/1 "2024-01-08T10:26:25Z")
If I assign a user or group of users “Default Access” in users and groups, what access does that grant to the users? ![image](https://canada1.discourse-cdn.com/flex027/uploads/appgovscore/original/1X/76166f3034abff0de970e77e609733a3a781e190.png) If I don’t assign users, and leave the “Assignment required?” property set to “No”, does that mean that All Users get “Default Access” to the application? ![image](https://canada1.discourse-cdn.com/flex027/uploads/appgovscore/original/1X/e093cf587f4dac0db5feb2c691e2391bca311c4b.png) ---
**Author:** ![ENow\_Thatcher](https://avatars.discourse-cdn.com/v4/letter/e/9f8e36/32.png) [@ENow\_Thatcher](https://community.appgovscore.com/u/ENow_Thatcher)\ **Post date:** [January 8, 2024, 8:16pm UTC](https://community.appgovscore.com/t/app-registration-default-role-permissions/48/2 "2024-01-08T20:16:07Z")
Assigning a user to “Default Access” means only users or groups assigned to a role are granted access to the application. Users not assigned will get a prompt from Entra Id telling them to contact their administrators to gain access. By default when flipping to “Assignment required” the individual flipping that switch is assigned the “default” role and will be the only one available to login to that application until more users or groups are granted access. Roles will be unique to each application. If an application is setting up RBAC they will define the access and role names and will have to provide documentation on the privileges they provide. ---
**Author:** ![mattchatt](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.appgovscore.com/mattchatt/32/9_2.png) [@mattchatt](https://community.appgovscore.com/u/mattchatt)\ **Post date:** [January 9, 2024, 11:59am UTC](https://community.appgovscore.com/t/app-registration-default-role-permissions/48/3 "2024-01-09T11:59:53Z")
Thanks Craig, so if I understand correctly, the Default Access is whatever the App developer defines uses assigned will get if user assignment is required. If not, ALL users get that default access? Access (for assigned users) is different from application/delegation permissions which the app requires consent for potentially to resources in the tenant right? ---
**Author:** ![ENow\_Thatcher](https://avatars.discourse-cdn.com/v4/letter/e/9f8e36/32.png) [@ENow\_Thatcher](https://community.appgovscore.com/u/ENow_Thatcher)\ **Post date:** [January 9, 2024, 9:24pm UTC](https://community.appgovscore.com/t/app-registration-default-role-permissions/48/4 "2024-01-09T21:24:25Z")
You are correct Default Access is whatever the developer defined. If User Assignment is not set to required none of the roles matter. If you dig deeper from a developer perspective when the User Assignment is turned on the assigned role(s) are actually included with the JWT token from Entra Id and are readable for the service. This access is completely independent from API permissions either application or delegated. ---
**Author:** ![mattchatt](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.appgovscore.com/mattchatt/32/9_2.png) [@mattchatt](https://community.appgovscore.com/u/mattchatt)\ **Post date:** [January 10, 2024, 4:45am UTC](https://community.appgovscore.com/t/app-registration-default-role-permissions/48/5 "2024-01-10T04:45:05Z")
I am trying to learn more about app roles that are available, and I guess it depends on the developer of the app. I have found in Entra ID app registrations that I can add custom app roles. I see that a test app registration I created automatically has the “msiam\_access” app role, so would that be the “Default Access” we have been talking about in prior posts? ![image](https://canada1.discourse-cdn.com/flex027/uploads/appgovscore/original/1X/2f14d7e2ff091be69f6689b95aea7c4b2c8226c0.png) I am not an app developer, so want to understand from an IT Administrator’s perspective ---
**Author:** ![ENow\_Thatcher](https://avatars.discourse-cdn.com/v4/letter/e/9f8e36/32.png) [@ENow\_Thatcher](https://community.appgovscore.com/u/ENow_Thatcher)\ **Post date:** [March 18, 2024, 5:30pm UTC](https://community.appgovscore.com/t/app-registration-default-role-permissions/48/6 "2024-03-18T17:30:44Z")
If msiam\_access is the only role then it will be the default when assigning a new user as it’s the only one that exists.