entitlement_management_access_packages

Creates, updates, deletes, gets or lists an entitlement_management_access_packages resource.

Overview

Name	`entitlement_management_access_packages`
Type	Resource
Id	`entra_id.identity_governance.entitlement_management_access_packages`

Fields

The following fields are returned by SELECT queries:

get
list

Retrieved navigation property

Name	Datatype	Description
`id`	`string`	The unique identifier for an entity. Read-only.
`accessPackagesIncompatibleWith`	`array`	The access packages that are incompatible with this package. Read-only.
`assignmentPolicies`	`array`	Read-only. Nullable. Supports $expand.
`catalog`		Required when creating the access package. Read-only. Nullable.
`createdDateTime`	`string (date-time)`	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. (pattern: `^[0-9]{4,}-(0[1-9]\|1[012])-(0[1-9]\|[12][0-9]\|3[01])T([01][0-9]\|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z\|[+-][0-9][0-9]:[0-9][0-9])$`)
`description`	`string`	The description of the access package.
`displayName`	`string`	Required. The display name of the access package. Supports $filter (eq, contains).
`incompatibleAccessPackages`	`array`	The access packages whose assigned users are ineligible to be assigned this access package.
`incompatibleGroups`	`array`	The groups whose members are ineligible to be assigned this access package.
`isHidden`	`boolean`	Indicates whether the access package is hidden from the requestor.
`modifiedDateTime`	`string (date-time)`	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. (pattern: `^[0-9]{4,}-(0[1-9]\|1[012])-(0[1-9]\|[12][0-9]\|3[01])T([01][0-9]\|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z\|[+-][0-9][0-9]:[0-9][0-9])$`)
`resourceRoleScopes`	`array`	The resource roles and scopes in this access package.

Retrieved collection

Name	Datatype	Description
`id`	`string`	The unique identifier for an entity. Read-only.
`accessPackagesIncompatibleWith`	`array`	The access packages that are incompatible with this package. Read-only.
`assignmentPolicies`	`array`	Read-only. Nullable. Supports $expand.
`catalog`		Required when creating the access package. Read-only. Nullable.
`createdDateTime`	`string (date-time)`	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. (pattern: `^[0-9]{4,}-(0[1-9]\|1[012])-(0[1-9]\|[12][0-9]\|3[01])T([01][0-9]\|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z\|[+-][0-9][0-9]:[0-9][0-9])$`)
`description`	`string`	The description of the access package.
`displayName`	`string`	Required. The display name of the access package. Supports $filter (eq, contains).
`incompatibleAccessPackages`	`array`	The access packages whose assigned users are ineligible to be assigned this access package.
`incompatibleGroups`	`array`	The groups whose members are ineligible to be assigned this access package.
`isHidden`	`boolean`	Indicates whether the access package is hidden from the requestor.
`modifiedDateTime`	`string (date-time)`	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. (pattern: `^[0-9]{4,}-(0[1-9]\|1[012])-(0[1-9]\|[12][0-9]\|3[01])T([01][0-9]\|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z\|[+-][0-9][0-9]:[0-9][0-9])$`)
`resourceRoleScopes`	`array`	The resource roles and scopes in this access package.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
`get`	`select`	`access_package_id`		Retrieve the properties and relationships of an accessPackage object.
`list`	`select`			Retrieve a list of accessPackage objects. The resulting list includes all the access packages that the caller has access to read, across all catalogs.
`insert`	`insert`			Create a new accessPackage object. The access package will be added to an existing accessPackageCatalog.
`update`	`update`	`access_package_id`		Update an existing accessPackage object to change one or more of its properties, such as the display name or description.
`delete`	`delete`	`access_package_id`	`If-Match`	Delete an accessPackage object. You cannot delete an access package if it has any accessPackageAssignment.
`get_applicable_policy_requirements`	`exec`	`access_package_id`		In Microsoft Entra entitlement management, this action retrieves a list of accessPackageAssignmentRequestRequirements objects that the currently signed-in user can use to create an accessPackageAssignmentRequest. Each requirement object corresponds to an access package assignment policy that the currently signed-in user is allowed to request an assignment for.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`access_package_id`	`string`	The unique identifier of accessPackage
`If-Match`	`string`	ETag

`SELECT` examples

get
list

Retrieve the properties and relationships of an accessPackage object.

SELECT
id,
accessPackagesIncompatibleWith,
assignmentPolicies,
catalog,
createdDateTime,
description,
displayName,
incompatibleAccessPackages,
incompatibleGroups,
isHidden,
modifiedDateTime,
resourceRoleScopes
FROM entra_id.identity_governance.entitlement_management_access_packages
WHERE access_package_id = '{{ access_package_id }}' -- required
;

Retrieve a list of accessPackage objects. The resulting list includes all the access packages that the caller has access to read, across all catalogs.

SELECT
id,
accessPackagesIncompatibleWith,
assignmentPolicies,
catalog,
createdDateTime,
description,
displayName,
incompatibleAccessPackages,
incompatibleGroups,
isHidden,
modifiedDateTime,
resourceRoleScopes
FROM entra_id.identity_governance.entitlement_management_access_packages
;

`INSERT` examples

insert
Manifest

Create a new accessPackage object. The access package will be added to an existing accessPackageCatalog.

INSERT INTO entra_id.identity_governance.entitlement_management_access_packages (
id,
createdDateTime,
description,
displayName,
isHidden,
modifiedDateTime,
accessPackagesIncompatibleWith,
assignmentPolicies,
catalog,
incompatibleAccessPackages,
incompatibleGroups,
resourceRoleScopes
)
SELECT 
'{{ id }}',
'{{ createdDateTime }}',
'{{ description }}',
'{{ displayName }}',
{{ isHidden }},
'{{ modifiedDateTime }}',
'{{ accessPackagesIncompatibleWith }}',
'{{ assignmentPolicies }}',
'{{ catalog }}',
'{{ incompatibleAccessPackages }}',
'{{ incompatibleGroups }}',
'{{ resourceRoleScopes }}'
RETURNING
id,
accessPackagesIncompatibleWith,
assignmentPolicies,
catalog,
createdDateTime,
description,
displayName,
incompatibleAccessPackages,
incompatibleGroups,
isHidden,
modifiedDateTime,
resourceRoleScopes
;

# Description fields are for documentation purposes
- name: entitlement_management_access_packages
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: createdDateTime
    value: "{{ createdDateTime }}"
    description: |
      The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.
  - name: description
    value: "{{ description }}"
    description: |
      The description of the access package.
  - name: displayName
    value: "{{ displayName }}"
    description: |
      Required. The display name of the access package. Supports $filter (eq, contains).
  - name: isHidden
    value: {{ isHidden }}
    description: |
      Indicates whether the access package is hidden from the requestor.
  - name: modifiedDateTime
    value: "{{ modifiedDateTime }}"
    description: |
      The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.
  - name: accessPackagesIncompatibleWith
    description: |
      The access packages that are incompatible with this package. Read-only.
    value:
      - id: "{{ id }}"
        createdDateTime: "{{ createdDateTime }}"
        description: "{{ description }}"
        displayName: "{{ displayName }}"
        isHidden: {{ isHidden }}
        modifiedDateTime: "{{ modifiedDateTime }}"
        accessPackagesIncompatibleWith: "{{ accessPackagesIncompatibleWith }}"
        assignmentPolicies: "{{ assignmentPolicies }}"
        catalog: "{{ catalog }}"
        incompatibleAccessPackages: "{{ incompatibleAccessPackages }}"
        incompatibleGroups: "{{ incompatibleGroups }}"
        resourceRoleScopes: "{{ resourceRoleScopes }}"
  - name: assignmentPolicies
    description: |
      Read-only. Nullable. Supports $expand.
    value:
      - id: "{{ id }}"
        allowedTargetScope: "{{ allowedTargetScope }}"
        automaticRequestSettings: "{{ automaticRequestSettings }}"
        createdDateTime: "{{ createdDateTime }}"
        description: "{{ description }}"
        displayName: "{{ displayName }}"
        expiration: "{{ expiration }}"
        modifiedDateTime: "{{ modifiedDateTime }}"
        notificationSettings: "{{ notificationSettings }}"
        requestApprovalSettings: "{{ requestApprovalSettings }}"
        requestorSettings: "{{ requestorSettings }}"
        reviewSettings: "{{ reviewSettings }}"
        specificAllowedTargets: "{{ specificAllowedTargets }}"
        accessPackage: "{{ accessPackage }}"
        catalog: "{{ catalog }}"
        customExtensionStageSettings: "{{ customExtensionStageSettings }}"
        questions: "{{ questions }}"
  - name: catalog
    value: "{{ catalog }}"
    description: |
      Required when creating the access package. Read-only. Nullable.
  - name: incompatibleAccessPackages
    description: |
      The access packages whose assigned users are ineligible to be assigned this access package.
    value:
      - id: "{{ id }}"
        createdDateTime: "{{ createdDateTime }}"
        description: "{{ description }}"
        displayName: "{{ displayName }}"
        isHidden: {{ isHidden }}
        modifiedDateTime: "{{ modifiedDateTime }}"
        accessPackagesIncompatibleWith: "{{ accessPackagesIncompatibleWith }}"
        assignmentPolicies: "{{ assignmentPolicies }}"
        catalog: "{{ catalog }}"
        incompatibleAccessPackages: "{{ incompatibleAccessPackages }}"
        incompatibleGroups: "{{ incompatibleGroups }}"
        resourceRoleScopes: "{{ resourceRoleScopes }}"
  - name: incompatibleGroups
    description: |
      The groups whose members are ineligible to be assigned this access package.
    value:
      - id: "{{ id }}"
        deletedDateTime: "{{ deletedDateTime }}"
        allowExternalSenders: {{ allowExternalSenders }}
        assignedLabels: "{{ assignedLabels }}"
        assignedLicenses: "{{ assignedLicenses }}"
        autoSubscribeNewMembers: {{ autoSubscribeNewMembers }}
        classification: "{{ classification }}"
        createdDateTime: "{{ createdDateTime }}"
        description: "{{ description }}"
        displayName: "{{ displayName }}"
        expirationDateTime: "{{ expirationDateTime }}"
        groupTypes: "{{ groupTypes }}"
        hasMembersWithLicenseErrors: {{ hasMembersWithLicenseErrors }}
        hideFromAddressLists: {{ hideFromAddressLists }}
        hideFromOutlookClients: {{ hideFromOutlookClients }}
        infoCatalogs: "{{ infoCatalogs }}"
        isArchived: {{ isArchived }}
        isAssignableToRole: {{ isAssignableToRole }}
        isManagementRestricted: {{ isManagementRestricted }}
        isSubscribedByMail: {{ isSubscribedByMail }}
        licenseProcessingState: "{{ licenseProcessingState }}"
        mail: "{{ mail }}"
        mailEnabled: {{ mailEnabled }}
        mailNickname: "{{ mailNickname }}"
        membershipRule: "{{ membershipRule }}"
        membershipRuleProcessingState: "{{ membershipRuleProcessingState }}"
        onPremisesDomainName: "{{ onPremisesDomainName }}"
        onPremisesLastSyncDateTime: "{{ onPremisesLastSyncDateTime }}"
        onPremisesNetBiosName: "{{ onPremisesNetBiosName }}"
        onPremisesProvisioningErrors: "{{ onPremisesProvisioningErrors }}"
        onPremisesSamAccountName: "{{ onPremisesSamAccountName }}"
        onPremisesSecurityIdentifier: "{{ onPremisesSecurityIdentifier }}"
        onPremisesSyncEnabled: {{ onPremisesSyncEnabled }}
        preferredDataLocation: "{{ preferredDataLocation }}"
        preferredLanguage: "{{ preferredLanguage }}"
        proxyAddresses: "{{ proxyAddresses }}"
        renewedDateTime: "{{ renewedDateTime }}"
        resourceBehaviorOptions: "{{ resourceBehaviorOptions }}"
        resourceProvisioningOptions: "{{ resourceProvisioningOptions }}"
        securityEnabled: {{ securityEnabled }}
        securityIdentifier: "{{ securityIdentifier }}"
        serviceProvisioningErrors: "{{ serviceProvisioningErrors }}"
        theme: "{{ theme }}"
        uniqueName: "{{ uniqueName }}"
        unseenCount: {{ unseenCount }}
        visibility: "{{ visibility }}"
        welcomeMessageEnabled: {{ welcomeMessageEnabled }}
        acceptedSenders: "{{ acceptedSenders }}"
        appRoleAssignments: "{{ appRoleAssignments }}"
        calendar: "{{ calendar }}"
        calendarView: "{{ calendarView }}"
        conversations: "{{ conversations }}"
        createdOnBehalfOf: "{{ createdOnBehalfOf }}"
        drive: "{{ drive }}"
        drives: "{{ drives }}"
        events: "{{ events }}"
        extensions: "{{ extensions }}"
        groupLifecyclePolicies: "{{ groupLifecyclePolicies }}"
        memberOf: "{{ memberOf }}"
        members: "{{ members }}"
        membersWithLicenseErrors: "{{ membersWithLicenseErrors }}"
        onenote: "{{ onenote }}"
        onPremisesSyncBehavior: "{{ onPremisesSyncBehavior }}"
        owners: "{{ owners }}"
        permissionGrants: "{{ permissionGrants }}"
        photo: "{{ photo }}"
        photos: "{{ photos }}"
        planner: "{{ planner }}"
        rejectedSenders: "{{ rejectedSenders }}"
        settings: "{{ settings }}"
        sites: "{{ sites }}"
        team: "{{ team }}"
        threads: "{{ threads }}"
        transitiveMemberOf: "{{ transitiveMemberOf }}"
        transitiveMembers: "{{ transitiveMembers }}"
  - name: resourceRoleScopes
    description: |
      The resource roles and scopes in this access package.
    value:
      - id: "{{ id }}"
        createdDateTime: "{{ createdDateTime }}"
        role: "{{ role }}"
        scope: "{{ scope }}"

`UPDATE` examples

update

Update an existing accessPackage object to change one or more of its properties, such as the display name or description.

UPDATE entra_id.identity_governance.entitlement_management_access_packages
SET 
id = '{{ id }}',
createdDateTime = '{{ createdDateTime }}',
description = '{{ description }}',
displayName = '{{ displayName }}',
isHidden = {{ isHidden }},
modifiedDateTime = '{{ modifiedDateTime }}',
accessPackagesIncompatibleWith = '{{ accessPackagesIncompatibleWith }}',
assignmentPolicies = '{{ assignmentPolicies }}',
catalog = '{{ catalog }}',
incompatibleAccessPackages = '{{ incompatibleAccessPackages }}',
incompatibleGroups = '{{ incompatibleGroups }}',
resourceRoleScopes = '{{ resourceRoleScopes }}'
WHERE 
access_package_id = '{{ access_package_id }}' --required
RETURNING
id,
accessPackagesIncompatibleWith,
assignmentPolicies,
catalog,
createdDateTime,
description,
displayName,
incompatibleAccessPackages,
incompatibleGroups,
isHidden,
modifiedDateTime,
resourceRoleScopes;

`DELETE` examples

delete

Delete an accessPackage object. You cannot delete an access package if it has any accessPackageAssignment.

DELETE FROM entra_id.identity_governance.entitlement_management_access_packages
WHERE access_package_id = '{{ access_package_id }}' --required
AND If-Match = '{{ If-Match }}'
;

Lifecycle Methods

get_applicable_policy_requirements

In Microsoft Entra entitlement management, this action retrieves a list of accessPackageAssignmentRequestRequirements objects that the currently signed-in user can use to create an accessPackageAssignmentRequest. Each requirement object corresponds to an access package assignment policy that the currently signed-in user is allowed to request an assignment for.

EXEC entra_id.identity_governance.entitlement_management_access_packages.get_applicable_policy_requirements 
@access_package_id='{{ access_package_id }}' --required
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

INSERT examples​

UPDATE examples​

DELETE examples​

Lifecycle Methods​