entitlement_management_assignment_policies

Creates, updates, deletes, gets or lists an entitlement_management_assignment_policies resource.

Overview

Name	entitlement_management_assignment_policies
Type	Resource
Id	entra_id.identity_governance.entitlement_management_assignment_policies

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
accessPackage		Access package containing this policy. Read-only. Supports $expand.
allowedTargetScope		Principals that can be assigned the access package through this policy. The possible values are: notSpecified, specificDirectoryUsers, specificConnectedOrganizationUsers, specificDirectoryServicePrincipals, allMemberUsers, allDirectoryUsers, allDirectoryServicePrincipals, allConfiguredConnectedOrganizationUsers, allExternalUsers, allDirectoryAgentIdentities, unknownFutureValue.
automaticRequestSettings		This property is only present for an auto assignment policy; if absent, this is a request-based policy.
catalog		Catalog of the access package containing this policy. Read-only.
createdDateTime	string (date-time)	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
customExtensionStageSettings	array	The collection of stages when to execute one or more custom access package workflow extensions. Supports $expand.
description	string	The description of the policy.
displayName	string	The display name of the policy.
expiration		The expiration date for assignments created in this policy.
modifiedDateTime	string (date-time)	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
notificationSettings
questions	array	Questions that are posed to the requestor.
requestApprovalSettings		Specifies the settings for approval of requests for an access package assignment through this policy. For example, if approval is required for new requests.
requestorSettings		Provides additional settings to select who can create a request for an access package assignment through this policy, and what they can include in their request.
reviewSettings		Settings for access reviews of assignments through this policy.
specificAllowedTargets	array	The principals that can be assigned access from an access package through this policy.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
accessPackage		Access package containing this policy. Read-only. Supports $expand.
allowedTargetScope		Principals that can be assigned the access package through this policy. The possible values are: notSpecified, specificDirectoryUsers, specificConnectedOrganizationUsers, specificDirectoryServicePrincipals, allMemberUsers, allDirectoryUsers, allDirectoryServicePrincipals, allConfiguredConnectedOrganizationUsers, allExternalUsers, allDirectoryAgentIdentities, unknownFutureValue.
automaticRequestSettings		This property is only present for an auto assignment policy; if absent, this is a request-based policy.
catalog		Catalog of the access package containing this policy. Read-only.
createdDateTime	string (date-time)	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
customExtensionStageSettings	array	The collection of stages when to execute one or more custom access package workflow extensions. Supports $expand.
description	string	The description of the policy.
displayName	string	The display name of the policy.
expiration		The expiration date for assignments created in this policy.
modifiedDateTime	string (date-time)	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
notificationSettings
questions	array	Questions that are posed to the requestor.
requestApprovalSettings		Specifies the settings for approval of requests for an access package assignment through this policy. For example, if approval is required for new requests.
requestorSettings		Provides additional settings to select who can create a request for an access package assignment through this policy, and what they can include in their request.
reviewSettings		Settings for access reviews of assignments through this policy.
specificAllowedTargets	array	The principals that can be assigned access from an access package through this policy.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	access_package_assignment_policy_id		In Microsoft Entra entitlement management, retrieve the properties and relationships of an accessPackageAssignmentPolicy object.
list	select			Retrieve a list of accessPackageAssignmentPolicy objects in Microsoft Entra entitlement management. If the delegated user is in a directory role, the resulting list includes all the assignment policies that the caller has access to read, across all catalogs and access packages. If the delegated user is an access package manager or catalog owner, they should instead retrieve the policies for the access packages they can read with list accessPackages by including $expand=assignmentPolicies as a query parameter.
insert	insert			Create a new accessPackageAssignmentPolicy object in Microsoft Entra entitlement management. The request includes a reference to the accessPackage that contains this policy, which must already exist.
replace	replace	access_package_assignment_policy_id		Update an existing accessPackageAssignmentPolicy object to change one or more of its properties, such as the display name or description.
delete	delete	access_package_assignment_policy_id	If-Match	In Microsoft Entra entitlement management, delete an accessPackageAssignmentPolicy.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
access_package_assignment_policy_id	string	The unique identifier of accessPackageAssignmentPolicy
If-Match	string	ETag

SELECT examples

get

In Microsoft Entra entitlement management, retrieve the properties and relationships of an
accessPackageAssignmentPolicy object.

SELECT
id,
accessPackage,
allowedTargetScope,
automaticRequestSettings,
catalog,
createdDateTime,
customExtensionStageSettings,
description,
displayName,
expiration,
modifiedDateTime,
notificationSettings,
questions,
requestApprovalSettings,
requestorSettings,
reviewSettings,
specificAllowedTargets
FROM entra_id.identity_governance.entitlement_management_assignment_policies
WHERE access_package_assignment_policy_id = '{{ access_package_assignment_policy_id }}' -- required
;

list

Retrieve a list of accessPackageAssignmentPolicy objects in Microsoft Entra entitlement management. If the delegated user is in a directory role, the resulting list includes all the assignment policies that the caller has access to read, across all catalogs and access packages. If the delegated user is an access package manager or catalog owner, they should instead retrieve the policies for the access packages they can read with list accessPackages by including $expand=assignmentPolicies as a query parameter.

SELECT
id,
accessPackage,
allowedTargetScope,
automaticRequestSettings,
catalog,
createdDateTime,
customExtensionStageSettings,
description,
displayName,
expiration,
modifiedDateTime,
notificationSettings,
questions,
requestApprovalSettings,
requestorSettings,
reviewSettings,
specificAllowedTargets
FROM entra_id.identity_governance.entitlement_management_assignment_policies
;

INSERT examples

insert

Create a new accessPackageAssignmentPolicy object in Microsoft Entra entitlement management. The request includes a reference to the accessPackage that contains this policy, which must already exist.

INSERT INTO entra_id.identity_governance.entitlement_management_assignment_policies (
id,
allowedTargetScope,
automaticRequestSettings,
createdDateTime,
description,
displayName,
expiration,
modifiedDateTime,
notificationSettings,
requestApprovalSettings,
requestorSettings,
reviewSettings,
specificAllowedTargets,
accessPackage,
catalog,
customExtensionStageSettings,
questions
)
SELECT 
'{{ id }}',
'{{ allowedTargetScope }}',
'{{ automaticRequestSettings }}',
'{{ createdDateTime }}',
'{{ description }}',
'{{ displayName }}',
'{{ expiration }}',
'{{ modifiedDateTime }}',
'{{ notificationSettings }}',
'{{ requestApprovalSettings }}',
'{{ requestorSettings }}',
'{{ reviewSettings }}',
'{{ specificAllowedTargets }}',
'{{ accessPackage }}',
'{{ catalog }}',
'{{ customExtensionStageSettings }}',
'{{ questions }}'
RETURNING
id,
accessPackage,
allowedTargetScope,
automaticRequestSettings,
catalog,
createdDateTime,
customExtensionStageSettings,
description,
displayName,
expiration,
modifiedDateTime,
notificationSettings,
questions,
requestApprovalSettings,
requestorSettings,
reviewSettings,
specificAllowedTargets
;

Manifest

# Description fields are for documentation purposes
- name: entitlement_management_assignment_policies
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: allowedTargetScope
    value: "{{ allowedTargetScope }}"
    description: |
      Principals that can be assigned the access package through this policy. The possible values are: notSpecified, specificDirectoryUsers, specificConnectedOrganizationUsers, specificDirectoryServicePrincipals, allMemberUsers, allDirectoryUsers, allDirectoryServicePrincipals, allConfiguredConnectedOrganizationUsers, allExternalUsers, allDirectoryAgentIdentities, unknownFutureValue.
  - name: automaticRequestSettings
    value: "{{ automaticRequestSettings }}"
    description: |
      This property is only present for an auto assignment policy; if absent, this is a request-based policy.
  - name: createdDateTime
    value: "{{ createdDateTime }}"
    description: |
      The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
  - name: description
    value: "{{ description }}"
    description: |
      The description of the policy.
  - name: displayName
    value: "{{ displayName }}"
    description: |
      The display name of the policy.
  - name: expiration
    value: "{{ expiration }}"
    description: |
      The expiration date for assignments created in this policy.
  - name: modifiedDateTime
    value: "{{ modifiedDateTime }}"
    description: |
      The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
  - name: notificationSettings
    value: "{{ notificationSettings }}"
  - name: requestApprovalSettings
    value: "{{ requestApprovalSettings }}"
    description: |
      Specifies the settings for approval of requests for an access package assignment through this policy. For example, if approval is required for new requests.
  - name: requestorSettings
    value: "{{ requestorSettings }}"
    description: |
      Provides additional settings to select who can create a request for an access package assignment through this policy, and what they can include in their request.
  - name: reviewSettings
    value: "{{ reviewSettings }}"
    description: |
      Settings for access reviews of assignments through this policy.
  - name: specificAllowedTargets
    description: |
      The principals that can be assigned access from an access package through this policy.
    value:
  - name: accessPackage
    value: "{{ accessPackage }}"
    description: |
      Access package containing this policy. Read-only. Supports $expand.
  - name: catalog
    value: "{{ catalog }}"
    description: |
      Catalog of the access package containing this policy. Read-only.
  - name: customExtensionStageSettings
    description: |
      The collection of stages when to execute one or more custom access package workflow extensions. Supports $expand.
    value:
      - id: "{{ id }}"
        stage: "{{ stage }}"
        customExtension: "{{ customExtension }}"
  - name: questions
    description: |
      Questions that are posed to the  requestor.
    value:
      - id: "{{ id }}"
        isAnswerEditable: {{ isAnswerEditable }}
        isRequired: {{ isRequired }}
        localizations: "{{ localizations }}"
        sequence: {{ sequence }}
        text: "{{ text }}"

REPLACE examples

replace

Update an existing accessPackageAssignmentPolicy object to change one or more of its properties, such as the display name or description.

REPLACE entra_id.identity_governance.entitlement_management_assignment_policies
SET 
id = '{{ id }}',
allowedTargetScope = '{{ allowedTargetScope }}',
automaticRequestSettings = '{{ automaticRequestSettings }}',
createdDateTime = '{{ createdDateTime }}',
description = '{{ description }}',
displayName = '{{ displayName }}',
expiration = '{{ expiration }}',
modifiedDateTime = '{{ modifiedDateTime }}',
notificationSettings = '{{ notificationSettings }}',
requestApprovalSettings = '{{ requestApprovalSettings }}',
requestorSettings = '{{ requestorSettings }}',
reviewSettings = '{{ reviewSettings }}',
specificAllowedTargets = '{{ specificAllowedTargets }}',
accessPackage = '{{ accessPackage }}',
catalog = '{{ catalog }}',
customExtensionStageSettings = '{{ customExtensionStageSettings }}',
questions = '{{ questions }}'
WHERE 
access_package_assignment_policy_id = '{{ access_package_assignment_policy_id }}' --required
RETURNING
id,
accessPackage,
allowedTargetScope,
automaticRequestSettings,
catalog,
createdDateTime,
customExtensionStageSettings,
description,
displayName,
expiration,
modifiedDateTime,
notificationSettings,
questions,
requestApprovalSettings,
requestorSettings,
reviewSettings,
specificAllowedTargets;

DELETE examples

delete

In Microsoft Entra entitlement management, delete an accessPackageAssignmentPolicy.

DELETE FROM entra_id.identity_governance.entitlement_management_assignment_policies
WHERE access_package_assignment_policy_id = '{{ access_package_assignment_policy_id }}' --required
AND If-Match = '{{ If-Match }}'
;