authorization_policy

Creates, updates, deletes, gets or lists an authorization_policy resource.

Overview

Name	authorization_policy
Type	Resource
Id	entra_id.policies.authorization_policy

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
allowEmailVerifiedUsersToJoinOrganization	boolean	Indicates whether a user can join the tenant by email validation.
allowInvitesFrom		Indicates who can invite guests to the organization. The possible values are: none, adminsAndGuestInviters, adminsGuestInvitersAndAllMembers, everyone. everyone is the default setting for all cloud environments except US Government. For more information, see allowInvitesFrom values.
allowUserConsentForRiskyApps	boolean	Indicates whether user consent for risky apps is allowed. We recommend keeping allowUserConsentForRiskyApps as false. Default value is false.
allowedToSignUpEmailBasedSubscriptions	boolean	Indicates whether users can sign up for email based subscriptions.
allowedToUseSSPR	boolean	Indicates whether administrators of the tenant can use the Self-Service Password Reset (SSPR). For more information, see Self-service password reset for administrators.
blockMsolPowerShell	boolean	To disable the use of MSOL PowerShell, set this property to true. This also disables user-based access to the legacy service endpoint used by MSOL PowerShell. This doesn't affect Microsoft Entra Connect or Microsoft Graph.
defaultUserRolePermissions	object	(title: defaultUserRolePermissions)
deletedDateTime	string (date-time)	Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
description	string	Description for this policy. Required.
displayName	string	Display name for this policy. Required.
guestUserRoleId	string (uuid)	Represents role templateId for the role that should be granted to guests. Currently following roles are supported: User (a0b1b346-4d3e-4e8b-98f8-753987be4970), Guest User (10dae51f-b6af-4016-8d66-8c2a99b929b3), and Restricted Guest User (2af84b1e-32c8-42b7-82bc-daa82404023b). (pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select			Retrieve the properties of an authorizationPolicy object.
update	update			Update the properties of an authorizationPolicy object.
delete	delete		If-Match

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
If-Match	string	ETag

SELECT examples

get

Retrieve the properties of an authorizationPolicy object.

SELECT
id,
allowEmailVerifiedUsersToJoinOrganization,
allowInvitesFrom,
allowUserConsentForRiskyApps,
allowedToSignUpEmailBasedSubscriptions,
allowedToUseSSPR,
blockMsolPowerShell,
defaultUserRolePermissions,
deletedDateTime,
description,
displayName,
guestUserRoleId
FROM entra_id.policies.authorization_policy
;

UPDATE examples

update

Update the properties of an authorizationPolicy object.

UPDATE entra_id.policies.authorization_policy
SET 
id = '{{ id }}',
deletedDateTime = '{{ deletedDateTime }}',
description = '{{ description }}',
displayName = '{{ displayName }}',
allowedToSignUpEmailBasedSubscriptions = {{ allowedToSignUpEmailBasedSubscriptions }},
allowedToUseSSPR = {{ allowedToUseSSPR }},
allowEmailVerifiedUsersToJoinOrganization = {{ allowEmailVerifiedUsersToJoinOrganization }},
allowInvitesFrom = '{{ allowInvitesFrom }}',
allowUserConsentForRiskyApps = {{ allowUserConsentForRiskyApps }},
blockMsolPowerShell = {{ blockMsolPowerShell }},
defaultUserRolePermissions = '{{ defaultUserRolePermissions }}',
guestUserRoleId = '{{ guestUserRoleId }}'
RETURNING
id,
allowEmailVerifiedUsersToJoinOrganization,
allowInvitesFrom,
allowUserConsentForRiskyApps,
allowedToSignUpEmailBasedSubscriptions,
allowedToUseSSPR,
blockMsolPowerShell,
defaultUserRolePermissions,
deletedDateTime,
description,
displayName,
guestUserRoleId;

DELETE examples

delete

No description available.

DELETE FROM entra_id.policies.authorization_policy
WHERE If-Match = '{{ If-Match }}'
;