access_reviews_definitions_instances_stages

Creates, updates, deletes, gets or lists an access_reviews_definitions_instances_stages resource.

Overview

Name	access_reviews_definitions_instances_stages
Type	Resource
Id	entra_id.identity_governance.access_reviews_definitions_instances_stages

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
decisions	array	Each user reviewed in an accessReviewStage has a decision item representing if they were approved, denied, or not yet reviewed.
endDateTime	string (date-time)	The date and time in ISO 8601 format and UTC time when the review stage is scheduled to end. This property is the cumulative total of the durationInDays for all stages. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
fallbackReviewers	array	This collection of reviewer scopes is used to define the list of fallback reviewers. These fallback reviewers are notified to take action if no users are found from the list of reviewers specified. This could occur when either the group owner is specified as the reviewer but the group owner doesn't exist, or manager is specified as reviewer but a user's manager doesn't exist.
reviewers	array	This collection of access review scopes is used to define who the reviewers are. For examples of options for assigning reviewers, see Assign reviewers to your access review definition using the Microsoft Graph API.
startDateTime	string (date-time)	The date and time in ISO 8601 format and UTC time when the review stage is scheduled to start. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
status	string	Specifies the status of an accessReviewStage. Possible values: Initializing, NotStarted, Starting, InProgress, Completing, Completed, AutoReviewing, and AutoReviewed. Supports $orderby, and $filter (eq only). Read-only.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
decisions	array	Each user reviewed in an accessReviewStage has a decision item representing if they were approved, denied, or not yet reviewed.
endDateTime	string (date-time)	The date and time in ISO 8601 format and UTC time when the review stage is scheduled to end. This property is the cumulative total of the durationInDays for all stages. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
fallbackReviewers	array	This collection of reviewer scopes is used to define the list of fallback reviewers. These fallback reviewers are notified to take action if no users are found from the list of reviewers specified. This could occur when either the group owner is specified as the reviewer but the group owner doesn't exist, or manager is specified as reviewer but a user's manager doesn't exist.
reviewers	array	This collection of access review scopes is used to define who the reviewers are. For examples of options for assigning reviewers, see Assign reviewers to your access review definition using the Microsoft Graph API.
startDateTime	string (date-time)	The date and time in ISO 8601 format and UTC time when the review stage is scheduled to start. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
status	string	Specifies the status of an accessReviewStage. Possible values: Initializing, NotStarted, Starting, InProgress, Completing, Completed, AutoReviewing, and AutoReviewed. Supports $orderby, and $filter (eq only). Read-only.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	access_review_schedule_definition_id, access_review_instance_id, access_review_stage_id		Retrieve the properties and relationships of an accessReviewStage object.
list	select	access_review_schedule_definition_id, access_review_instance_id		Retrieve the stages in a multi-stage access review instance.
insert	insert	access_review_schedule_definition_id, access_review_instance_id
update	update	access_review_schedule_definition_id, access_review_instance_id, access_review_stage_id		Update the properties of an accessReviewStage object. Only the reviewers and fallbackReviewers properties can be updated. You can only add reviewers to the fallbackReviewers property but can't remove existing fallbackReviewers. To update an accessReviewStage, its status must be NotStarted, Initializing, or InProgress.
delete	delete	access_review_schedule_definition_id, access_review_instance_id, access_review_stage_id	If-Match
stop	exec	access_review_schedule_definition_id, access_review_instance_id, access_review_stage_id		Stop an access review stage that is inProgress. After the access review stage stops, the stage status will be Completed and the reviewers can no longer give input. If there are subsequent stages that depend on the completed stage, the next stage will be created. The accessReviewInstanceDecisionItem objects will always reflect the last decisions recorded across all stages at that given time, regardless of the status of the stages.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
access_review_instance_id	string	The unique identifier of accessReviewInstance
access_review_schedule_definition_id	string	The unique identifier of accessReviewScheduleDefinition
access_review_stage_id	string	The unique identifier of accessReviewStage
If-Match	string	ETag

SELECT examples

get

Retrieve the properties and relationships of an accessReviewStage object.

SELECT
id,
decisions,
endDateTime,
fallbackReviewers,
reviewers,
startDateTime,
status
FROM entra_id.identity_governance.access_reviews_definitions_instances_stages
WHERE access_review_schedule_definition_id = '{{ access_review_schedule_definition_id }}' -- required
AND access_review_instance_id = '{{ access_review_instance_id }}' -- required
AND access_review_stage_id = '{{ access_review_stage_id }}' -- required
;

list

Retrieve the stages in a multi-stage access review instance.

SELECT
id,
decisions,
endDateTime,
fallbackReviewers,
reviewers,
startDateTime,
status
FROM entra_id.identity_governance.access_reviews_definitions_instances_stages
WHERE access_review_schedule_definition_id = '{{ access_review_schedule_definition_id }}' -- required
AND access_review_instance_id = '{{ access_review_instance_id }}' -- required
;

INSERT examples

insert

No description available.

INSERT INTO entra_id.identity_governance.access_reviews_definitions_instances_stages (
id,
endDateTime,
fallbackReviewers,
reviewers,
startDateTime,
status,
decisions,
access_review_schedule_definition_id,
access_review_instance_id
)
SELECT 
'{{ id }}',
'{{ endDateTime }}',
'{{ fallbackReviewers }}',
'{{ reviewers }}',
'{{ startDateTime }}',
'{{ status }}',
'{{ decisions }}',
'{{ access_review_schedule_definition_id }}',
'{{ access_review_instance_id }}'
RETURNING
id,
decisions,
endDateTime,
fallbackReviewers,
reviewers,
startDateTime,
status
;

Manifest

# Description fields are for documentation purposes
- name: access_reviews_definitions_instances_stages
props:
  - name: access_review_schedule_definition_id
    value: "{{ access_review_schedule_definition_id }}"
    description: Required parameter for the access_reviews_definitions_instances_stages resource.
  - name: access_review_instance_id
    value: "{{ access_review_instance_id }}"
    description: Required parameter for the access_reviews_definitions_instances_stages resource.
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: endDateTime
    value: "{{ endDateTime }}"
    description: |
      The date and time in ISO 8601 format and UTC time when the review stage is scheduled to end. This property is the cumulative total of the durationInDays for all stages. Read-only.
  - name: fallbackReviewers
    description: |
      This collection of reviewer scopes is used to define the list of fallback reviewers. These fallback reviewers are notified to take action if no users are found from the list of reviewers specified. This could occur when either the group owner is specified as the reviewer but the group owner doesn't exist, or manager is specified as reviewer but a user's manager doesn't exist.
    value:
      - query: "{{ query }}"
        queryRoot: "{{ queryRoot }}"
        queryType: "{{ queryType }}"
  - name: reviewers
    description: |
      This collection of access review scopes is used to define who the reviewers are. For examples of options for assigning reviewers, see Assign reviewers to your access review definition using the Microsoft Graph API.
    value:
      - query: "{{ query }}"
        queryRoot: "{{ queryRoot }}"
        queryType: "{{ queryType }}"
  - name: startDateTime
    value: "{{ startDateTime }}"
    description: |
      The date and time in ISO 8601 format and UTC time when the review stage is scheduled to start. Read-only.
  - name: status
    value: "{{ status }}"
    description: |
      Specifies the status of an accessReviewStage. Possible values: Initializing, NotStarted, Starting, InProgress, Completing, Completed, AutoReviewing, and AutoReviewed. Supports $orderby, and $filter (eq only). Read-only.
  - name: decisions
    description: |
      Each user reviewed in an accessReviewStage has a decision item representing if they were approved, denied, or not yet reviewed.
    value:
      - id: "{{ id }}"
        accessReviewId: "{{ accessReviewId }}"
        appliedBy: "{{ appliedBy }}"
        appliedDateTime: "{{ appliedDateTime }}"
        applyResult: "{{ applyResult }}"
        decision: "{{ decision }}"
        justification: "{{ justification }}"
        principal: "{{ principal }}"
        principalLink: "{{ principalLink }}"
        recommendation: "{{ recommendation }}"
        resource: "{{ resource }}"
        resourceLink: "{{ resourceLink }}"
        reviewedBy: "{{ reviewedBy }}"
        reviewedDateTime: "{{ reviewedDateTime }}"
        insights: "{{ insights }}"

UPDATE examples

update

Update the properties of an accessReviewStage object. Only the reviewers and fallbackReviewers properties can be updated. You can only add reviewers to the fallbackReviewers property but can't remove existing fallbackReviewers. To update an accessReviewStage, its status must be NotStarted, Initializing, or InProgress.

UPDATE entra_id.identity_governance.access_reviews_definitions_instances_stages
SET 
id = '{{ id }}',
endDateTime = '{{ endDateTime }}',
fallbackReviewers = '{{ fallbackReviewers }}',
reviewers = '{{ reviewers }}',
startDateTime = '{{ startDateTime }}',
status = '{{ status }}',
decisions = '{{ decisions }}'
WHERE 
access_review_schedule_definition_id = '{{ access_review_schedule_definition_id }}' --required
AND access_review_instance_id = '{{ access_review_instance_id }}' --required
AND access_review_stage_id = '{{ access_review_stage_id }}' --required
RETURNING
id,
decisions,
endDateTime,
fallbackReviewers,
reviewers,
startDateTime,
status;

DELETE examples

delete

No description available.

DELETE FROM entra_id.identity_governance.access_reviews_definitions_instances_stages
WHERE access_review_schedule_definition_id = '{{ access_review_schedule_definition_id }}' --required
AND access_review_instance_id = '{{ access_review_instance_id }}' --required
AND access_review_stage_id = '{{ access_review_stage_id }}' --required
AND If-Match = '{{ If-Match }}'
;

Lifecycle Methods

stop

Stop an access review stage that is inProgress. After the access review stage stops, the stage status will be Completed and the reviewers can no longer give input. If there are subsequent stages that depend on the completed stage, the next stage will be created. The accessReviewInstanceDecisionItem objects will always reflect the last decisions recorded across all stages at that given time, regardless of the status of the stages.

EXEC entra_id.identity_governance.access_reviews_definitions_instances_stages.stop 
@access_review_schedule_definition_id='{{ access_review_schedule_definition_id }}' --required, 
@access_review_instance_id='{{ access_review_instance_id }}' --required, 
@access_review_stage_id='{{ access_review_stage_id }}' --required
;