---
title: "Set-VBRUserRoleAssignment"
description: "Modifies a role that is assigned to a user or a user group. If the four-eyes authorization is enabled, you cannot run this cmdlet. For more information, see the Four-Eyes Authorization section in the User Guide for VMware vSphere."
canonical: "https://helpcenter.veeam.com/docs/vbr/powershell/set-vbruserroleassignment.html"
breadcrumb: "Veeam PowerShell Reference > Veeam PowerShell Reference > Backup Infrastructure > Roles and Users > Set-VBRUserRoleAssignment"
dateModified: "2026-08-19"
---

# Set-VBRUserRoleAssignment

## Short Description
Modifies a role that is assigned to a user or a user group.

::: note

If the four-eyes authorization is enabled, you cannot run this cmdlet. For more information, see the [Four-Eyes Authorization](https://helpcenter.veeam.com/docs/vbr/userguide/four_eyes_authorization.html?ver=13) section in the User Guide for VMware vSphere.

:::

**Product Edition**: Standard, Enterprise, Enterprise Plus, Veeam Universal License

## Syntax

This cmdlet provides the following parameter sets:

<ul class="syntax-sets">
  <li>
    <p><code>RoleEntity (Default)</code></p>

```
Set-VBRUserRoleAssignment -Assignment <VBRUserRoleAssignment> [-RoleEntity <VBRRoleEntity>] [<CommonParameters>]
```
  </li>
  <li>
    <p><code>Role</code></p>

```
Set-VBRUserRoleAssignment -Assignment <VBRUserRoleAssignment> [-Role <VBRRole>] [<CommonParameters>]
```
  </li>
</ul>

## Detailed Description
This cmdlet modifies a role assigned to a user or user group.

::: note

Consider the following:

- You cannot change the role of the last administrator. This is to prevent a situation where no administrator remains.
- You cannot assign a custom role and a built-in role to the same user or user group. 
- To modify settings, specify new values for the necessary parameters. The cmdlet will overwrite the previous parameter values with new values. The parameters that you omit will remain unchanged.  

:::

## Parameters

<table style="width:100%;" class="Blue_Table">
      <tr style="vertical-align:top">
        <th style="width:20%;">
          <p>Parameter</p>
        </th>
        <th style="width:20%;">
          <p>Description</p>
        </th>
        <th style="width:20%;">
          <p>Type</p>
        </th>
        <th style="width:10%;">
          <p>Required</p>
        </th>
        <th style="width:10%;">
          <p>Position</p>
        </th>
        <th style="width:10%;">
          <p>Accept Pipeline Input</p>
        </th>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Assignment</span></p>
        </td>
        <td>
          <p>Specifies a user or a user group</p><p>assignment. The cmdlet will modify a role for this user or a user group.</p><p>Accepts the <code>VBRUserRoleAssignment</code> object. To get this object, run the <a href="get-vbruserroleassignment.md"><code>Get-VBRUserRoleAssignment</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbruserroleassignment.md"><code>VBRUserRoleAssignment</code></a></p>
        </td>
        <td style="width:10%;">
          <p>True</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>True (ByPropertyName, ByValue)</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">Role</span></p>
        </td>
        <td>
          <p>Specifies a role that you want to assign to a user. The cmdlet will replace the current role with a new role. You can assign one of the following roles:</p><ul><li><code>BackupOperator</code></li><li><code>RestoreOperator</code></li><li><code>BackupAdmin</code></li><li><code>TapeOperator</code></li><li><code>BackupViewer</code></li><li><code>IncidentApiOperator</code></li><li><code>SecurityAdministrator</code></li><li><code>Custom</code></li></ul>
        </td>
        <td style="width:10%;">
          <p><code>VBRRole</code></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
      <tr style="vertical-align:top">
        <td>
          <p class="Table_Text_Bold"><span class="Table_Text_Bold">RoleEntity</span></p>
        </td>
        <td>
          <p>Specifies a role. The cmdlet will modify the role defined in the custom roles to the user or user group.</p><p>Accepts the <a href="vbrroleentity.md"><code>VBRRoleEntity</code></a> object. To get this object, run the <a href="get-vbrroleentity.md"><code>Get-VBRRoleEntity</code></a> cmdlet.</p>
        </td>
        <td style="width:10%;">
          <p><a href="vbrroleentity.md"><code>VBRRoleEntity</code></a></p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
        <td style="width:10%;">
          <p>Named</p>
        </td>
        <td style="width:10%;">
          <p>False</p>
        </td>
      </tr>
    </table>

`<CommonParameters>`

This cmdlet supports Microsoft PowerShell common parameters. For more information on common parameters, see [ Microsoft Docs](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_commonparameters?view=powershell-7).

## Output Object
The cmdlet returns the `VBRUserRoleAssignment` object that defines a role for a user or a user group.

## Examples

::: example
### Example 1. Modifying Role to a Built-In Role

This example shows how to modify a role that is assigned to the Tech\\BackupAdmin user to a custom role.

```
$user = Get-VBRUserRoleAssignment -Name "Tech\BackupAdmin" -RoleEntity (Get-VBRRoleEntity -Name "r1")
Set-VBRUserRoleAssignment -Assignment $user -Role TapeOperator
RoleEntity : Tape Operator
Role       : TapeOperator
Type       : User
Name       : KOS-TEST-0CF\k4
Id         : 035c4f9d-9984-4890-8397-c19970e88829
```

Perform the following steps:

1. Run the [`Get-VBRUserRoleAssignment`](get-vbruserroleassignment.md) cmdlet. Specify the `Name` and `RoleEntity` parameter values. Save the result to the `$user` variable.
2. Run the `Set-VBRUserRoleAssignment` cmdlet. Set the `$user` variable as the `Assignment` parameter value. Set the `TapeOperator` value as the `Role` parameter value.

:::

::: example
### Example 2. Modifying Role to a Custom Role

This example shows how to modify a role that is assigned to the `Tech\BackupAdmin` user to a custom role.

```
$user = Get-VBRUserRoleAssignment -Name "Tech\BackupAdmin" -Role BackupOperator
Set-VBRUserRoleAssignment -Assignment $user -RoleEntity (Get-VBRRoleEntity -Name "r1")
RoleEntity : r1
Role       : Custom
Type       : User
Name       : Tech\BackupAdmin
Id         : 2985e2ba-b3e4-4fdf-99f7-b1f6fe7f7818
```

Perform the following steps:

1. Run the [`Get-VBRUserRoleAssignment`](get-vbruserroleassignment.md) cmdlet. Specify the `Name` and `Role` parameter values. Save the result to the `$user` variable.
2. Run the `Set-VBRUserRoleAssignment` cmdlet. Set the `$user` variable as the `Assignment` parameter value. Set the `r1` custom role as the `RoleEntity` parameter value.

:::

## Related Commands

- [`Get-VBRRoleEntity`](get-vbrroleentity.md)
- [`Get-VBRUserRoleAssignment`](get-vbruserroleassignment.md)