permission_grants

Creates, updates, deletes, gets or lists a permission_grants resource.

Overview

Name	permission_grants
Type	Resource
Id	entra_id.groups.permission_grants

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
clientAppId	string	ID of the service principal of the Microsoft Entra app that has been granted access. Read-only.
clientId	string	ID of the Microsoft Entra app that has been granted access. Read-only.
deletedDateTime	string (date-time)	Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
permission	string	The name of the resource-specific permission. Read-only.
permissionType	string	The type of permission. The possible values are: Application, Delegated. Read-only.
resourceAppId	string	ID of the Microsoft Entra app that is hosting the resource. Read-only.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
clientAppId	string	ID of the service principal of the Microsoft Entra app that has been granted access. Read-only.
clientId	string	ID of the Microsoft Entra app that has been granted access. Read-only.
deletedDateTime	string (date-time)	Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
permission	string	The name of the resource-specific permission. Read-only.
permissionType	string	The type of permission. The possible values are: Application, Delegated. Read-only.
resourceAppId	string	ID of the Microsoft Entra app that is hosting the resource. Read-only.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	group_id, resource_specific_permission_grant_id
list	select	group_id		List all resource-specific permission grants on the group. This list specifies the Microsoft Entra apps that have access to the group, along with the corresponding resource-specific access that each app has.
insert	insert	group_id
update	update	group_id, resource_specific_permission_grant_id
delete	delete	group_id, resource_specific_permission_grant_id	If-Match

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
group_id	string	The unique identifier of group
resource_specific_permission_grant_id	string	The unique identifier of resourceSpecificPermissionGrant
If-Match	string	ETag

SELECT examples

get

Retrieved navigation property

SELECT
id,
clientAppId,
clientId,
deletedDateTime,
permission,
permissionType,
resourceAppId
FROM entra_id.groups.permission_grants
WHERE group_id = '{{ group_id }}' -- required
AND resource_specific_permission_grant_id = '{{ resource_specific_permission_grant_id }}' -- required
;

list

List all resource-specific permission grants on the group. This list specifies the Microsoft Entra apps that have access to the group, along with the corresponding resource-specific access that each app has.

SELECT
id,
clientAppId,
clientId,
deletedDateTime,
permission,
permissionType,
resourceAppId
FROM entra_id.groups.permission_grants
WHERE group_id = '{{ group_id }}' -- required
;

INSERT examples

insert

No description available.

INSERT INTO entra_id.groups.permission_grants (
id,
deletedDateTime,
clientAppId,
clientId,
permission,
permissionType,
resourceAppId,
group_id
)
SELECT 
'{{ id }}',
'{{ deletedDateTime }}',
'{{ clientAppId }}',
'{{ clientId }}',
'{{ permission }}',
'{{ permissionType }}',
'{{ resourceAppId }}',
'{{ group_id }}'
RETURNING
id,
clientAppId,
clientId,
deletedDateTime,
permission,
permissionType,
resourceAppId
;

Manifest

# Description fields are for documentation purposes
- name: permission_grants
props:
  - name: group_id
    value: "{{ group_id }}"
    description: Required parameter for the permission_grants resource.
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: deletedDateTime
    value: "{{ deletedDateTime }}"
    description: |
      Date and time when this object was deleted. Always null when the object hasn't been deleted.
  - name: clientAppId
    value: "{{ clientAppId }}"
    description: |
      ID of the service principal of the Microsoft Entra app that has been granted access. Read-only.
  - name: clientId
    value: "{{ clientId }}"
    description: |
      ID of the Microsoft Entra app that has been granted access. Read-only.
  - name: permission
    value: "{{ permission }}"
    description: |
      The name of the resource-specific permission. Read-only.
  - name: permissionType
    value: "{{ permissionType }}"
    description: |
      The type of permission. The possible values are: Application, Delegated. Read-only.
  - name: resourceAppId
    value: "{{ resourceAppId }}"
    description: |
      ID of the Microsoft Entra app that is hosting the resource. Read-only.

UPDATE examples

update

No description available.

UPDATE entra_id.groups.permission_grants
SET 
id = '{{ id }}',
deletedDateTime = '{{ deletedDateTime }}',
clientAppId = '{{ clientAppId }}',
clientId = '{{ clientId }}',
permission = '{{ permission }}',
permissionType = '{{ permissionType }}',
resourceAppId = '{{ resourceAppId }}'
WHERE 
group_id = '{{ group_id }}' --required
AND resource_specific_permission_grant_id = '{{ resource_specific_permission_grant_id }}' --required
RETURNING
id,
clientAppId,
clientId,
deletedDateTime,
permission,
permissionType,
resourceAppId;

DELETE examples

delete

No description available.

DELETE FROM entra_id.groups.permission_grants
WHERE group_id = '{{ group_id }}' --required
AND resource_specific_permission_grant_id = '{{ resource_specific_permission_grant_id }}' --required
AND If-Match = '{{ If-Match }}'
;