privileged_access_group_assignment_schedule_instances_group

Creates, updates, deletes, gets or lists a privileged_access_group_assignment_schedule_instances_group resource.

Overview

Name	privileged_access_group_assignment_schedule_instances_group
Type	Resource
Id	entra_id.identity_governance.privileged_access_group_assignment_schedule_instances_group

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
acceptedSenders	array	The list of users or groups allowed to create posts or calendar events in this group. If this list is nonempty, then only users or groups listed here are allowed to post.
allowExternalSenders	boolean	Indicates if people external to the organization can send messages to the group. The default value is false. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID}).
appRoleAssignments	array	Represents the app roles granted to a group for an application. Supports $expand.
assignedLabels	array	The list of sensitivity label pairs (label ID, label name) associated with a Microsoft 365 group. Requires $select to retrieve. This property can be updated only in delegated scenarios where the caller requires both the Microsoft Graph permission and a supported administrator role.
assignedLicenses	array	The licenses that are assigned to the group. Requires $select to retrieve. Supports $filter (eq). Read-only.
autoSubscribeNewMembers	boolean	Indicates if new members added to the group are autosubscribed to receive email notifications. You can set this property in a PATCH request for the group; don't set it in the initial POST request that creates the group. Default value is false. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID}).
calendar		The group's calendar. Read-only.
calendarView	array	The calendar view for the calendar. Read-only.
classification	string	Describes a classification for the group (such as low, medium, or high business impact). Valid values for this property are defined by creating a ClassificationList setting value, based on the template definition.Returned by default. Supports $filter (eq, ne, not, ge, le, startsWith).
conversations	array	The group's conversations.
createdDateTime	string (date-time)	Timestamp of when the group was created. The value can't be modified and is automatically populated when the group is created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on January 1, 2014 is 2014-01-01T00:00:00Z. Returned by default. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
createdOnBehalfOf		The user (or application) that created the group. NOTE: This property isn't set if the user is an administrator. Read-only.
deletedDateTime	string (date-time)	Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
description	string	An optional description for the group. Returned by default. Supports $filter (eq, ne, not, ge, le, startsWith) and $search.
displayName	string	The display name for the group. This property is required when a group is created and can't be cleared during updates. Maximum length is 256 characters. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values), $search, and $orderby.
drive		The group's default drive. Read-only.
drives	array	The group's drives. Read-only.
events	array	The group's calendar events.
expirationDateTime	string (date-time)	Timestamp of when the group is set to expire. It's null for security groups, but for Microsoft 365 groups, it represents when the group is set to expire as defined in the groupLifecyclePolicy. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on January 1, 2014 is 2014-01-01T00:00:00Z. Returned by default. Supports $filter (eq, ne, not, ge, le, in). Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
extensions	array	The collection of open extensions defined for the group. Read-only. Nullable.
groupLifecyclePolicies	array	The collection of lifecycle policies for this group. Read-only. Nullable.
groupTypes	array	Specifies the group type and its membership. If the collection contains Unified, the group is a Microsoft 365 group; otherwise, it's either a security group or a distribution group. For details, see groups overview.If the collection includes DynamicMembership, the group has dynamic membership; otherwise, membership is static. Returned by default. Supports $filter (eq, not).
hasMembersWithLicenseErrors	boolean	Indicates whether there are members in this group that have license errors from its group-based license assignment. This property is never returned on a GET operation. You can use it as a $filter argument to get groups that have members with license errors (that is, filter for this property being true). See an example. Supports $filter (eq).
hideFromAddressLists	boolean	True if the group isn't displayed in certain parts of the Outlook UI: the Address Book, address lists for selecting message recipients, and the Browse Groups dialog for searching groups; otherwise, false. The default value is false. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID}).
hideFromOutlookClients	boolean	True if the group isn't displayed in Outlook clients, such as Outlook for Windows and Outlook on the web; otherwise, false. The default value is false. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID}).
infoCatalogs	array
isArchived	boolean	When a group is associated with a team, this property determines whether the team is in read-only mode.To read this property, use the /group/{groupId}/team endpoint or the Get team API. To update this property, use the archiveTeam and unarchiveTeam APIs.
isAssignableToRole	boolean	Indicates whether this group can be assigned to a Microsoft Entra role. Optional. This property can only be set while creating the group and is immutable. If set to true, the securityEnabled property must also be set to true, visibility must be Hidden, and the group can't be a dynamic group (that is, groupTypes can't contain DynamicMembership). Only callers with at least the Privileged Role Administrator role can set this property. The caller must also be assigned the RoleManagement.ReadWrite.Directory permission to set this property or update the membership of such groups. For more, see Using a group to manage Microsoft Entra role assignmentsUsing this feature requires a Microsoft Entra ID P1 license. Returned by default. Supports $filter (eq, ne, not).
isManagementRestricted	boolean	Indicates whether the group is a member of a restricted management administrative unit. If not set, the default value is null and the default behavior is false. Read-only. To manage a group member of a restricted management administrative unit, the administrator or calling app must be assigned a Microsoft Entra role at the scope of the restricted management administrative unit. Requires $select to retrieve.
isSubscribedByMail	boolean	Indicates whether the signed-in user is subscribed to receive email conversations. The default value is true. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID}).
licenseProcessingState		Indicates the status of the group license assignment to all group members. The default value is false. Read-only. Possible values: QueuedForProcessing, ProcessingInProgress, and ProcessingComplete.Requires $select to retrieve. Read-only.
mail	string	The SMTP address for the group, for example, 'serviceadmins@contoso.com'. Returned by default. Read-only. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values).
mailEnabled	boolean	Specifies whether the group is mail-enabled. Required. Returned by default. Supports $filter (eq, ne, not).
mailNickname	string	The mail alias for the group, unique for Microsoft 365 groups in the organization. Maximum length is 64 characters. This property can contain only characters in the ASCII character set 0 - 127 except the following characters: @ () / [] ' ; : <> , SPACE. Required. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values).
memberOf	array	Groups that this group is a member of. HTTP Methods: GET (supported for all groups). Read-only. Nullable. Supports $expand.
members	array	The members of this group, who can be users, devices, other groups, or service principals. Supports the List members, Add member, and Remove member operations. Nullable. Supports $expand including nested $select. For example, /groups?$filter=startsWith(displayName,'Role')&$select=id,displayName&$expand=members($select=id,userPrincipalName,displayName).
membersWithLicenseErrors	array	A list of group members with license errors from this group-based license assignment. Read-only.
membershipRule	string	The rule that determines members for this group if the group is a dynamic group (groupTypes contains DynamicMembership). For more information about the syntax of the membership rule, see Membership Rules syntax. Returned by default. Supports $filter (eq, ne, not, ge, le, startsWith).
membershipRuleProcessingState	string	Indicates whether the dynamic membership processing is on or paused. Possible values are On or Paused. Returned by default. Supports $filter (eq, ne, not, in).
onPremisesDomainName	string	Contains the on-premises domain FQDN, also called dnsDomainName synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect.Returned by default. Read-only.
onPremisesLastSyncDateTime	string (date-time)	Indicates the last time at which the group was synced with the on-premises directory. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on January 1, 2014 is 2014-01-01T00:00:00Z. Returned by default. Read-only. Supports $filter (eq, ne, not, ge, le, in). (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
onPremisesNetBiosName	string	Contains the on-premises netBios name synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect.Returned by default. Read-only.
onPremisesProvisioningErrors	array	Errors when using Microsoft synchronization product during provisioning. Returned by default. Supports $filter (eq, not).
onPremisesSamAccountName	string	Contains the on-premises SAM account name synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect.Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith). Read-only.
onPremisesSecurityIdentifier	string	Contains the on-premises security identifier (SID) for the group synchronized from on-premises to the cloud. Read-only. Returned by default. Supports $filter (eq including on null values).
onPremisesSyncBehavior
onPremisesSyncEnabled	boolean	true if this group is synced from an on-premises directory; false if this group was originally synced from an on-premises directory but is no longer synced; null if this object has never synced from an on-premises directory (default). Returned by default. Read-only. Supports $filter (eq, ne, not, in, and eq on null values).
onenote
owners	array	The owners of the group who can be users or service principals. Limited to 100 owners. Nullable. If this property isn't specified when creating a Microsoft 365 group the calling user (admin or non-admin) is automatically assigned as the group owner. A non-admin user can't explicitly add themselves to this collection when they're creating the group. For more information, see the related known issue. For security groups, the admin user isn't automatically added to this collection. For more information, see the related known issue. Supports $filter (/$count eq 0, /$count ne 0, /$count eq 1, /$count ne 1); Supports $expand including nested $select. For example, /groups?$filter=startsWith(displayName,'Role')&$select=id,displayName&$expand=owners($select=id,userPrincipalName,displayName).
permissionGrants	array
photo		The group's profile photo
photos	array	The profile photos owned by the group. Read-only. Nullable.
planner		Entry-point to Planner resource that might exist for a Unified Group.
preferredDataLocation	string	The preferred data location for the Microsoft 365 group. By default, the group inherits the group creator's preferred data location. To set this property, the calling app must be granted the Directory.ReadWrite.All permission and the user be assigned at least one of the following Microsoft Entra roles: User Account Administrator Directory Writer Exchange Administrator SharePoint Administrator For more information about this property, see OneDrive Online Multi-Geo. Nullable. Returned by default.
preferredLanguage	string	The preferred language for a Microsoft 365 group. Should follow ISO 639-1 Code; for example, en-US. Returned by default. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values).
proxyAddresses	array	Email addresses for the group that direct to the same group mailbox. For example: ['SMTP: bob@contoso.com', 'smtp: bob@sales.contoso.com']. The any operator is required to filter expressions on multi-valued properties. Returned by default. Read-only. Not nullable. Supports $filter (eq, not, ge, le, startsWith, endsWith, /$count eq 0, /$count ne 0).
rejectedSenders	array	The list of users or groups not allowed to create posts or calendar events in this group. Nullable
renewedDateTime	string (date-time)	Timestamp of when the group was last renewed. This value can't be modified directly and is only updated via the renew service action. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on January 1, 2014 is 2014-01-01T00:00:00Z. Returned by default. Supports $filter (eq, ne, not, ge, le, in). Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
resourceBehaviorOptions	array	Specifies the group behaviors that can be set for a Microsoft 365 group during creation. This property can be set only as part of creation (POST). For the list of possible values, see Microsoft 365 group behaviors and provisioning options.
resourceProvisioningOptions	array	Specifies the group resources that are associated with the Microsoft 365 group. The possible value is Team. For more information, see Microsoft 365 group behaviors and provisioning options. Returned by default. Supports $filter (eq, not, startsWith).
securityEnabled	boolean	Specifies whether the group is a security group. Required. Returned by default. Supports $filter (eq, ne, not, in).
securityIdentifier	string	Security identifier of the group, used in Windows scenarios. Read-only. Returned by default.
serviceProvisioningErrors	array	Errors published by a federated service describing a nontransient, service-specific error regarding the properties or link from a group object. Supports $filter (eq, not, for isResolved and serviceInstance).
settings	array	Settings that can govern this group's behavior, like whether members can invite guests to the group. Nullable.
sites	array	The list of SharePoint sites in this group. Access the default site with /sites/root.
team		The team associated with this group.
theme	string	Specifies a Microsoft 365 group's color theme. Possible values are Teal, Purple, Green, Blue, Pink, Orange, or Red. Returned by default.
threads	array	The group's conversation threads. Nullable.
transitiveMemberOf	array	The groups that a group is a member of, either directly or through nested membership. Nullable.
transitiveMembers	array	The direct and transitive members of a group. Nullable.
uniqueName	string	The unique identifier that can be assigned to a group and used as an alternate key. Immutable. Read-only.
unseenCount	number (int32)	Count of conversations that received new posts since the signed-in user last visited the group. Requires $select to retrieve. Supported only on the Get group API (GET /groups/{ID}).
visibility	string	Specifies the group join policy and group content visibility for groups. The possible values are: Private, Public, or HiddenMembership. HiddenMembership can be set only for Microsoft 365 groups when the groups are created. It can't be updated later. Other values of visibility can be updated after group creation. If visibility value isn't specified during group creation on Microsoft Graph, a security group is created as Private by default, and the Microsoft 365 group is Public. Groups assignable to roles are always Private. To learn more, see group visibility options. Returned by default. Nullable.
welcomeMessageEnabled	boolean

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	privileged_access_group_assignment_schedule_instance_id		References the group that is the scope of the membership or ownership assignment through PIM for Groups. Supports $expand.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
privileged_access_group_assignment_schedule_instance_id	string	The unique identifier of privilegedAccessGroupAssignmentScheduleInstance

SELECT examples

get

References the group that is the scope of the membership or ownership assignment through PIM for Groups. Supports $expand.

SELECT
id,
acceptedSenders,
allowExternalSenders,
appRoleAssignments,
assignedLabels,
assignedLicenses,
autoSubscribeNewMembers,
calendar,
calendarView,
classification,
conversations,
createdDateTime,
createdOnBehalfOf,
deletedDateTime,
description,
displayName,
drive,
drives,
events,
expirationDateTime,
extensions,
groupLifecyclePolicies,
groupTypes,
hasMembersWithLicenseErrors,
hideFromAddressLists,
hideFromOutlookClients,
infoCatalogs,
isArchived,
isAssignableToRole,
isManagementRestricted,
isSubscribedByMail,
licenseProcessingState,
mail,
mailEnabled,
mailNickname,
memberOf,
members,
membersWithLicenseErrors,
membershipRule,
membershipRuleProcessingState,
onPremisesDomainName,
onPremisesLastSyncDateTime,
onPremisesNetBiosName,
onPremisesProvisioningErrors,
onPremisesSamAccountName,
onPremisesSecurityIdentifier,
onPremisesSyncBehavior,
onPremisesSyncEnabled,
onenote,
owners,
permissionGrants,
photo,
photos,
planner,
preferredDataLocation,
preferredLanguage,
proxyAddresses,
rejectedSenders,
renewedDateTime,
resourceBehaviorOptions,
resourceProvisioningOptions,
securityEnabled,
securityIdentifier,
serviceProvisioningErrors,
settings,
sites,
team,
theme,
threads,
transitiveMemberOf,
transitiveMembers,
uniqueName,
unseenCount,
visibility,
welcomeMessageEnabled
FROM entra_id.identity_governance.privileged_access_group_assignment_schedule_instances_group
WHERE privileged_access_group_assignment_schedule_instance_id = '{{ privileged_access_group_assignment_schedule_instance_id }}' -- required
;