contracts

Creates, updates, deletes, gets or lists a contracts resource.

Overview

Name	contracts
Type	Resource
Id	entra_id.contracts.contracts

Fields

The following fields are returned by SELECT queries:

get

Retrieved entity

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
contractType	string	Type of contract. The possible values are: SyndicationPartner, BreadthPartner, ResellerPartner. See more in the table below.
customerId	string (uuid)	The unique identifier for the customer tenant referenced by this partnership. Corresponds to the id property of the customer tenant's organization resource. (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)
defaultDomainName	string	A copy of the customer tenant's default domain name. The copy is made when the partnership with the customer is established. It isn't automatically updated if the customer tenant's default domain name changes.
deletedDateTime	string (date-time)	Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
displayName	string	A copy of the customer tenant's display name. The copy is made when the partnership with the customer is established. It is not automatically updated if the customer tenant's display name changes.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
contractType	string	Type of contract. The possible values are: SyndicationPartner, BreadthPartner, ResellerPartner. See more in the table below.
customerId	string (uuid)	The unique identifier for the customer tenant referenced by this partnership. Corresponds to the id property of the customer tenant's organization resource. (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)
defaultDomainName	string	A copy of the customer tenant's default domain name. The copy is made when the partnership with the customer is established. It isn't automatically updated if the customer tenant's default domain name changes.
deletedDateTime	string (date-time)	Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
displayName	string	A copy of the customer tenant's display name. The copy is made when the partnership with the customer is established. It is not automatically updated if the customer tenant's display name changes.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	contract_id		Retrieve the properties and relationships of contract object.
list	select			Retrieve a list of contract objects associated to a partner tenant.
insert	insert
update	update	contract_id
delete	delete	contract_id	If-Match
get_available_extension_properties	exec			Return all directory extension definitions that are registered in a directory, including through multitenant apps. The following entities support extension properties:
get_by_ids	exec			Return the directory objects specified in a list of IDs. Only a subset of user properties are returned by default in v1.0. Some common uses for this function are to:
validate_properties	exec			Validate that a Microsoft 365 group's display name or mail nickname complies with naming policies. Clients can use this API to determine whether a display name or mail nickname is valid before trying to create a Microsoft 365 group. To validate the properties of an existing group, use the group: validateProperties function. The following policy validations are performed for the display name and mail nickname properties: 1. Validate the prefix and suffix naming policy 2. Validate the custom banned words policy 3. Validate that the mail nickname is unique This API only returns the first validation failure that is encountered. If the properties fail multiple validations, only the first validation failure is returned. However, you can validate both the mail nickname and the display name and receive a collection of validation errors if you're only validating the prefix and suffix naming policy. To learn more about configuring naming policies, see Configure naming policy.
check_member_groups	exec	contract_id		Check for membership in a specified list of group IDs, and return from that list the IDs of groups where a specified object is a member. The specified object can be of one of the following types: - user - group - service principal - organizational contact - device - directory object This function is transitive. You can check up to a maximum of 20 groups per request. This function supports all groups provisioned in Microsoft Entra ID. Because Microsoft 365 groups cannot contain other groups, membership in a Microsoft 365 group is always direct.
check_member_objects	exec	contract_id
get_member_groups	exec	contract_id		Return all the group IDs for the groups that the specified user, group, service principal, organizational contact, device, or directory object is a member of. This function is transitive. This API returns up to 11,000 group IDs. If more than 11,000 results are available, it returns a 400 Bad Request error with the DirectoryResultSizeLimitExceeded error code. If you get the DirectoryResultSizeLimitExceeded error code, use the List group transitive memberOf API instead.
get_member_objects	exec	contract_id		Return all IDs for the groups, administrative units, and directory roles that an object of one of the following types is a member of: - user - group - service principal - organizational contact - device - directory object This function is transitive. Only users and role-enabled groups can be members of directory roles.
restore	exec	contract_id		Restore a recently deleted directory object from deleted items. The following types are supported: - administrativeUnit - application - agentIdentityBlueprint - agentIdentity - agentIdentityBlueprintPrincipal - agentUser - certificateBasedAuthPki - certificateAuthorityDetail - group - servicePrincipal - user If an item is accidentally deleted, you can fully restore the item. Additionally, restoring an application doesn't automatically restore the associated service principal automatically. You must call this API to explicitly restore the deleted service principal. A recently deleted item remains available for up to 30 days. After 30 days, the item is permanently deleted.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
contract_id	string	The unique identifier of contract
If-Match	string	ETag

SELECT examples

get

Retrieve the properties and relationships of contract object.

SELECT
id,
contractType,
customerId,
defaultDomainName,
deletedDateTime,
displayName
FROM entra_id.contracts.contracts
WHERE contract_id = '{{ contract_id }}' -- required
;

list

Retrieve a list of contract objects associated to a partner tenant.

SELECT
id,
contractType,
customerId,
defaultDomainName,
deletedDateTime,
displayName
FROM entra_id.contracts.contracts
;

INSERT examples

insert

No description available.

INSERT INTO entra_id.contracts.contracts (
id,
deletedDateTime,
contractType,
customerId,
defaultDomainName,
displayName
)
SELECT 
'{{ id }}',
'{{ deletedDateTime }}',
'{{ contractType }}',
'{{ customerId }}',
'{{ defaultDomainName }}',
'{{ displayName }}'
RETURNING
id,
contractType,
customerId,
defaultDomainName,
deletedDateTime,
displayName
;

Manifest

# Description fields are for documentation purposes
- name: contracts
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: deletedDateTime
    value: "{{ deletedDateTime }}"
    description: |
      Date and time when this object was deleted. Always null when the object hasn't been deleted.
  - name: contractType
    value: "{{ contractType }}"
    description: |
      Type of contract. The possible values are:  SyndicationPartner, BreadthPartner, ResellerPartner. See more in the table below.
  - name: customerId
    value: "{{ customerId }}"
    description: |
      The unique identifier for the customer tenant referenced by this partnership. Corresponds to the id property of the customer tenant's organization resource.
  - name: defaultDomainName
    value: "{{ defaultDomainName }}"
    description: |
      A copy of the customer tenant's default domain name. The copy is made when the partnership with the customer is established. It isn't automatically updated if the customer tenant's default domain name changes.
  - name: displayName
    value: "{{ displayName }}"
    description: |
      A copy of the customer tenant's display name. The copy is made when the partnership with the customer is established. It is not automatically updated if the customer tenant's display name changes.

UPDATE examples

update

No description available.

UPDATE entra_id.contracts.contracts
SET 
id = '{{ id }}',
deletedDateTime = '{{ deletedDateTime }}',
contractType = '{{ contractType }}',
customerId = '{{ customerId }}',
defaultDomainName = '{{ defaultDomainName }}',
displayName = '{{ displayName }}'
WHERE 
contract_id = '{{ contract_id }}' --required
RETURNING
id,
contractType,
customerId,
defaultDomainName,
deletedDateTime,
displayName;

DELETE examples

delete

No description available.

DELETE FROM entra_id.contracts.contracts
WHERE contract_id = '{{ contract_id }}' --required
AND If-Match = '{{ If-Match }}'
;

Lifecycle Methods

get_available_extension_properties

Return all directory extension definitions that are registered in a directory, including through multitenant apps. The following entities support extension properties:

EXEC entra_id.contracts.contracts.get_available_extension_properties 
@@json=
'{
"isSyncedFromOnPremises": {{ isSyncedFromOnPremises }}
}'
;

get_by_ids

Return the directory objects specified in a list of IDs. Only a subset of user properties are returned by default in v1.0. Some common uses for this function are to:

EXEC entra_id.contracts.contracts.get_by_ids 
@@json=
'{
"ids": "{{ ids }}", 
"types": "{{ types }}"
}'
;

validate_properties

Validate that a Microsoft 365 group's display name or mail nickname complies with naming policies. Clients can use this API to determine whether a display name or mail nickname is valid before trying to create a Microsoft 365 group. To validate the properties of an existing group, use the group: validateProperties function. The following policy validations are performed for the display name and mail nickname properties:
1. Validate the prefix and suffix naming policy
2. Validate the custom banned words policy
3. Validate that the mail nickname is unique This API only returns the first validation failure that is encountered. If the properties fail multiple validations, only the first validation failure is returned. However, you can validate both the mail nickname and the display name and receive a collection of validation errors if you're only validating the prefix and suffix naming policy. To learn more about configuring naming policies, see Configure naming policy.

EXEC entra_id.contracts.contracts.validate_properties 
@@json=
'{
"entityType": "{{ entityType }}", 
"displayName": "{{ displayName }}", 
"mailNickname": "{{ mailNickname }}", 
"onBehalfOfUserId": "{{ onBehalfOfUserId }}"
}'
;

check_member_groups

Check for membership in a specified list of group IDs, and return from that list the IDs of groups where a specified object is a member. The specified object can be of one of the following types:
- user
- group
- service principal
- organizational contact
- device
- directory object This function is transitive. You can check up to a maximum of 20 groups per request. This function supports all groups provisioned in Microsoft Entra ID. Because Microsoft 365 groups cannot contain other groups, membership in a Microsoft 365 group is always direct.

EXEC entra_id.contracts.contracts.check_member_groups 
@contract_id='{{ contract_id }}' --required 
@@json=
'{
"groupIds": "{{ groupIds }}"
}'
;

check_member_objects

Success

EXEC entra_id.contracts.contracts.check_member_objects 
@contract_id='{{ contract_id }}' --required 
@@json=
'{
"ids": "{{ ids }}"
}'
;

get_member_groups

Return all the group IDs for the groups that the specified user, group, service principal, organizational contact, device, or directory object is a member of. This function is transitive. This API returns up to 11,000 group IDs. If more than 11,000 results are available, it returns a 400 Bad Request error with the DirectoryResultSizeLimitExceeded error code. If you get the DirectoryResultSizeLimitExceeded error code, use the List group transitive memberOf API instead.

EXEC entra_id.contracts.contracts.get_member_groups 
@contract_id='{{ contract_id }}' --required 
@@json=
'{
"securityEnabledOnly": {{ securityEnabledOnly }}
}'
;

get_member_objects

Return all IDs for the groups, administrative units, and directory roles that an object of one of the following types is a member of:
- user
- group
- service principal
- organizational contact
- device
- directory object This function is transitive. Only users and role-enabled groups can be members of directory roles.

EXEC entra_id.contracts.contracts.get_member_objects 
@contract_id='{{ contract_id }}' --required 
@@json=
'{
"securityEnabledOnly": {{ securityEnabledOnly }}
}'
;

restore

Restore a recently deleted directory object from deleted items. The following types are supported:
- administrativeUnit
- application
- agentIdentityBlueprint
- agentIdentity
- agentIdentityBlueprintPrincipal
- agentUser
- certificateBasedAuthPki
- certificateAuthorityDetail
- group
- servicePrincipal
- user If an item is accidentally deleted, you can fully restore the item. Additionally, restoring an application doesn't automatically restore the associated service principal automatically. You must call this API to explicitly restore the deleted service principal. A recently deleted item remains available for up to 30 days. After 30 days, the item is permanently deleted.

EXEC entra_id.contracts.contracts.restore 
@contract_id='{{ contract_id }}' --required
;