entitlement_management_assignment_requests

Creates, updates, deletes, gets or lists an entitlement_management_assignment_requests resource.

Overview

Name	entitlement_management_assignment_requests
Type	Resource
Id	entra_id.identity_governance.entitlement_management_assignment_requests

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
accessPackage		The access package associated with the accessPackageAssignmentRequest. An access package defines the collections of resource roles and the policies for how one or more users can get access to those resources. Read-only. Nullable. Supports $expand.
answers	array	Answers provided by the requestor to accessPackageQuestions asked of them at the time of request.
assignment		For a requestType of userAdd or adminAdd, this is an access package assignment requested to be created. For a requestType of userRemove, adminRemove, approverRemove, or systemRemove, this has the id property of an existing assignment to be removed. Supports $expand.
completedDateTime	string (date-time)	The date of the end of processing, either successful or failure, of a request. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
createdDateTime	string (date-time)	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. Supports $filter. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
customExtensionCalloutInstances	array	Information about all the custom extension calls that were made during the access package assignment workflow.
justification	string	The requestor's supplied justification.
requestType		The type of the request. The possible values are: notSpecified, userAdd, userUpdate, userRemove, adminAdd, adminUpdate, adminRemove, systemAdd, systemUpdate, systemRemove, onBehalfAdd (not supported), unknownFutureValue. Use the Prefer: include-unknown-enum-members request header to get the following values in this evolvable enum: approverRemove. Requests from the user have a requestType of userAdd, userUpdate, or userRemove. This property can't be changed once set.
requestor		The subject who requested or, if a direct assignment, was assigned. Read-only. Nullable. Supports $expand.
schedule		The range of dates that access is to be assigned to the requestor. This property can't be changed once set, but a new schedule for an assignment can be included in another userUpdate or adminUpdate assignment request.
state		The state of the request. The possible values are: submitted, pendingApproval, delivering, delivered, deliveryFailed, denied, scheduled, canceled, partiallyDelivered, unknownFutureValue. Read-only. Supports $filter (eq).
status	string	More information on the request processing status. Read-only.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
accessPackage		The access package associated with the accessPackageAssignmentRequest. An access package defines the collections of resource roles and the policies for how one or more users can get access to those resources. Read-only. Nullable. Supports $expand.
answers	array	Answers provided by the requestor to accessPackageQuestions asked of them at the time of request.
assignment		For a requestType of userAdd or adminAdd, this is an access package assignment requested to be created. For a requestType of userRemove, adminRemove, approverRemove, or systemRemove, this has the id property of an existing assignment to be removed. Supports $expand.
completedDateTime	string (date-time)	The date of the end of processing, either successful or failure, of a request. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
createdDateTime	string (date-time)	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. Supports $filter. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
customExtensionCalloutInstances	array	Information about all the custom extension calls that were made during the access package assignment workflow.
justification	string	The requestor's supplied justification.
requestType		The type of the request. The possible values are: notSpecified, userAdd, userUpdate, userRemove, adminAdd, adminUpdate, adminRemove, systemAdd, systemUpdate, systemRemove, onBehalfAdd (not supported), unknownFutureValue. Use the Prefer: include-unknown-enum-members request header to get the following values in this evolvable enum: approverRemove. Requests from the user have a requestType of userAdd, userUpdate, or userRemove. This property can't be changed once set.
requestor		The subject who requested or, if a direct assignment, was assigned. Read-only. Nullable. Supports $expand.
schedule		The range of dates that access is to be assigned to the requestor. This property can't be changed once set, but a new schedule for an assignment can be included in another userUpdate or adminUpdate assignment request.
state		The state of the request. The possible values are: submitted, pendingApproval, delivering, delivered, deliveryFailed, denied, scheduled, canceled, partiallyDelivered, unknownFutureValue. Read-only. Supports $filter (eq).
status	string	More information on the request processing status. Read-only.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	access_package_assignment_request_id		In Microsoft Entra entitlement management, retrieve the properties and relationships of an accessPackageAssignmentRequest object.
list	select			In Microsoft Entra entitlement management, retrieve a list of accessPackageAssignmentRequest objects. The resulting list includes all the assignment requests, current and well as expired, that the caller has access to read, across all catalogs and access packages.
insert	insert			In Microsoft Entra Entitlement Management, create a new accessPackageAssignmentRequest object. This operation is used to assign a user to an access package, update the assignment, or to remove an access package assignment.
update	update	access_package_assignment_request_id
delete	delete	access_package_assignment_request_id	If-Match	Delete an accessPackageAssignmentRequest object. This request can be made to remove a denied or completed request. You cannot delete an access package assignment request if it has any accessPackageAssignment objects.
cancel	exec	access_package_assignment_request_id		In Microsoft Entra Entitlement Management, cancel accessPackageAssignmentRequest objects that are in a cancellable state: accepted, pendingApproval, pendingNotBefore, pendingApprovalEscalated.
reprocess	exec	access_package_assignment_request_id		In Microsoft Entra entitlement management, callers can automatically retry a user's request for access to an access package. It's performed on an accessPackageAssignmentRequest object whose requestState is in a DeliveryFailed or PartiallyDelivered state. You can only reprocess a request within 14 days from the time the original request was completed. For requests completed more than 14 days, you will need to ask the users to cancel the request(s) and make a new request in the MyAccess portal.
resume	exec	access_package_assignment_request_id		Resume a user's access package request after waiting for a callback from a custom extension. In Microsoft Entra entitlement management, when an access package policy has been enabled to call out a custom extension and the request processing is waiting for the callback from the customer, the customer can initiate a resume action. It's performed on an accessPackageAssignmentRequest object whose requestStatus is in a WaitingForCallback state.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
access_package_assignment_request_id	string	The unique identifier of accessPackageAssignmentRequest
If-Match	string	ETag

SELECT examples

get

In Microsoft Entra entitlement management, retrieve the properties and relationships of an accessPackageAssignmentRequest object.

SELECT
id,
accessPackage,
answers,
assignment,
completedDateTime,
createdDateTime,
customExtensionCalloutInstances,
justification,
requestType,
requestor,
schedule,
state,
status
FROM entra_id.identity_governance.entitlement_management_assignment_requests
WHERE access_package_assignment_request_id = '{{ access_package_assignment_request_id }}' -- required
;

list

In Microsoft Entra entitlement management, retrieve a list of accessPackageAssignmentRequest objects. The resulting list includes all the assignment requests, current and well as expired, that the caller has access to read, across all catalogs and access packages.

SELECT
id,
accessPackage,
answers,
assignment,
completedDateTime,
createdDateTime,
customExtensionCalloutInstances,
justification,
requestType,
requestor,
schedule,
state,
status
FROM entra_id.identity_governance.entitlement_management_assignment_requests
;

INSERT examples

insert

In Microsoft Entra Entitlement Management, create a new accessPackageAssignmentRequest object. This operation is used to assign a user to an access package, update the assignment, or to remove an access package assignment.

INSERT INTO entra_id.identity_governance.entitlement_management_assignment_requests (
id,
answers,
completedDateTime,
createdDateTime,
customExtensionCalloutInstances,
justification,
requestType,
schedule,
state,
status,
accessPackage,
assignment,
requestor
)
SELECT 
'{{ id }}',
'{{ answers }}',
'{{ completedDateTime }}',
'{{ createdDateTime }}',
'{{ customExtensionCalloutInstances }}',
'{{ justification }}',
'{{ requestType }}',
'{{ schedule }}',
'{{ state }}',
'{{ status }}',
'{{ accessPackage }}',
'{{ assignment }}',
'{{ requestor }}'
RETURNING
id,
accessPackage,
answers,
assignment,
completedDateTime,
createdDateTime,
customExtensionCalloutInstances,
justification,
requestType,
requestor,
schedule,
state,
status
;

Manifest

# Description fields are for documentation purposes
- name: entitlement_management_assignment_requests
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: answers
    description: |
      Answers provided by the requestor to accessPackageQuestions asked of them at the time of request.
    value:
      - displayValue: "{{ displayValue }}"
        answeredQuestion:
          id: "{{ id }}"
          isAnswerEditable: {{ isAnswerEditable }}
          isRequired: {{ isRequired }}
          localizations:
            - languageCode: "{{ languageCode }}"
              text: "{{ text }}"
          sequence: {{ sequence }}
          text: "{{ text }}"
  - name: completedDateTime
    value: "{{ completedDateTime }}"
    description: |
      The date of the end of processing, either successful or failure, of a request. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.
  - name: createdDateTime
    value: "{{ createdDateTime }}"
    description: |
      The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. Supports $filter.
  - name: customExtensionCalloutInstances
    description: |
      Information about all the custom extension calls that were made during the access package assignment workflow.
    value:
      - customExtensionId: "{{ customExtensionId }}"
        detail: "{{ detail }}"
        externalCorrelationId: "{{ externalCorrelationId }}"
        id: "{{ id }}"
        status: "{{ status }}"
  - name: justification
    value: "{{ justification }}"
    description: |
      The requestor's supplied justification.
  - name: requestType
    value: "{{ requestType }}"
    description: |
      The type of the request. The possible values are: notSpecified, userAdd, userUpdate, userRemove, adminAdd, adminUpdate, adminRemove, systemAdd, systemUpdate, systemRemove, onBehalfAdd (not supported), unknownFutureValue. Use the Prefer: include-unknown-enum-members request header to get the following values in this evolvable enum: approverRemove. Requests from the user have a requestType of userAdd, userUpdate, or userRemove. This property can't be changed once set.
  - name: schedule
    value: "{{ schedule }}"
    description: |
      The range of dates that access is to be assigned to the requestor. This property can't be changed once set, but a new schedule for an assignment can be included in another userUpdate or adminUpdate assignment request.
  - name: state
    value: "{{ state }}"
    description: |
      The state of the request. The possible values are: submitted, pendingApproval, delivering, delivered, deliveryFailed, denied, scheduled, canceled, partiallyDelivered, unknownFutureValue. Read-only. Supports $filter (eq).
  - name: status
    value: "{{ status }}"
    description: |
      More information on the request processing status. Read-only.
  - name: accessPackage
    value: "{{ accessPackage }}"
    description: |
      The access package associated with the accessPackageAssignmentRequest. An access package defines the collections of resource roles and the policies for how one or more users can get access to those resources. Read-only. Nullable.  Supports $expand.
  - name: assignment
    value: "{{ assignment }}"
    description: |
      For a requestType of userAdd or adminAdd, this is an access package assignment requested to be created. For a requestType of userRemove, adminRemove, approverRemove, or systemRemove, this has the id property of an existing assignment to be removed.   Supports $expand.
  - name: requestor
    value: "{{ requestor }}"
    description: |
      The subject who requested or, if a direct assignment, was assigned. Read-only. Nullable. Supports $expand.

UPDATE examples

update

No description available.

UPDATE entra_id.identity_governance.entitlement_management_assignment_requests
SET 
id = '{{ id }}',
answers = '{{ answers }}',
completedDateTime = '{{ completedDateTime }}',
createdDateTime = '{{ createdDateTime }}',
customExtensionCalloutInstances = '{{ customExtensionCalloutInstances }}',
justification = '{{ justification }}',
requestType = '{{ requestType }}',
schedule = '{{ schedule }}',
state = '{{ state }}',
status = '{{ status }}',
accessPackage = '{{ accessPackage }}',
assignment = '{{ assignment }}',
requestor = '{{ requestor }}'
WHERE 
access_package_assignment_request_id = '{{ access_package_assignment_request_id }}' --required
RETURNING
id,
accessPackage,
answers,
assignment,
completedDateTime,
createdDateTime,
customExtensionCalloutInstances,
justification,
requestType,
requestor,
schedule,
state,
status;

DELETE examples

delete

Delete an accessPackageAssignmentRequest object. This request can be made to remove a denied or completed request. You cannot delete an access package assignment request if it has any accessPackageAssignment objects.

DELETE FROM entra_id.identity_governance.entitlement_management_assignment_requests
WHERE access_package_assignment_request_id = '{{ access_package_assignment_request_id }}' --required
AND If-Match = '{{ If-Match }}'
;

Lifecycle Methods

cancel

In Microsoft Entra Entitlement Management, cancel accessPackageAssignmentRequest objects that are in a cancellable state: accepted, pendingApproval, pendingNotBefore, pendingApprovalEscalated.

EXEC entra_id.identity_governance.entitlement_management_assignment_requests.cancel 
@access_package_assignment_request_id='{{ access_package_assignment_request_id }}' --required
;

reprocess

In Microsoft Entra entitlement management, callers can automatically retry a user's request for access to an access package. It's performed on an accessPackageAssignmentRequest object whose requestState is in a DeliveryFailed or PartiallyDelivered state. You can only reprocess a request within 14 days from the time the original request was completed. For requests completed more than 14 days, you will need to ask the users to cancel the request(s) and make a new request in the MyAccess portal.

EXEC entra_id.identity_governance.entitlement_management_assignment_requests.reprocess 
@access_package_assignment_request_id='{{ access_package_assignment_request_id }}' --required
;

resume

Resume a user's access package request after waiting for a callback from a custom extension. In Microsoft Entra entitlement management, when an access package policy has been enabled to call out a custom extension and the request processing is waiting for the callback from the customer, the customer can initiate a resume action. It's performed on an accessPackageAssignmentRequest object whose requestStatus is in a WaitingForCallback state.

EXEC entra_id.identity_governance.entitlement_management_assignment_requests.resume 
@access_package_assignment_request_id='{{ access_package_assignment_request_id }}' --required 
@@json=
'{
"source": "{{ source }}", 
"type": "{{ type }}", 
"data": "{{ data }}"
}'
;