permission_grant_policies

Creates, updates, deletes, gets or lists a permission_grant_policies resource.

Overview

Name	permission_grant_policies
Type	Resource
Id	entra_id.policies.permission_grant_policies

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
deletedDateTime	string (date-time)	Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
description	string	Description for this policy. Required.
displayName	string	Display name for this policy. Required.
excludes	array	Condition sets that are excluded in this permission grant policy. Automatically expanded on GET.
includes	array	Condition sets that are included in this permission grant policy. Automatically expanded on GET.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
deletedDateTime	string (date-time)	Date and time when this object was deleted. Always null when the object hasn't been deleted. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
description	string	Description for this policy. Required.
displayName	string	Display name for this policy. Required.
excludes	array	Condition sets that are excluded in this permission grant policy. Automatically expanded on GET.
includes	array	Condition sets that are included in this permission grant policy. Automatically expanded on GET.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	permission_grant_policy_id		Retrieve a single permissionGrantPolicy object.
list	select			Retrieve the list of permissionGrantPolicy objects.
insert	insert			Creates a permissionGrantPolicy. A permission grant policy is used to describe the conditions under which permissions can be granted (for example, during application consent). After creating the permission grant policy, you can add include condition sets to add matching rules, and add exclude condition sets to add exclusion rules.
update	update	permission_grant_policy_id		Update properties of a permissionGrantPolicy.
delete	delete	permission_grant_policy_id	If-Match	Delete a permissionGrantPolicy object.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
permission_grant_policy_id	string	The unique identifier of permissionGrantPolicy
If-Match	string	ETag

SELECT examples

get

Retrieve a single permissionGrantPolicy object.

SELECT
id,
deletedDateTime,
description,
displayName,
excludes,
includes
FROM entra_id.policies.permission_grant_policies
WHERE permission_grant_policy_id = '{{ permission_grant_policy_id }}' -- required
;

list

Retrieve the list of permissionGrantPolicy objects.

SELECT
id,
deletedDateTime,
description,
displayName,
excludes,
includes
FROM entra_id.policies.permission_grant_policies
;

INSERT examples

insert

Creates a permissionGrantPolicy. A permission grant policy is used to describe the conditions under which permissions can be granted (for example, during application consent). After creating the permission grant policy, you can add include condition sets to add matching rules, and add exclude condition sets to add exclusion rules.

INSERT INTO entra_id.policies.permission_grant_policies (
id,
deletedDateTime,
description,
displayName,
excludes,
includes
)
SELECT 
'{{ id }}',
'{{ deletedDateTime }}',
'{{ description }}',
'{{ displayName }}',
'{{ excludes }}',
'{{ includes }}'
RETURNING
id,
deletedDateTime,
description,
displayName,
excludes,
includes
;

Manifest

# Description fields are for documentation purposes
- name: permission_grant_policies
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: deletedDateTime
    value: "{{ deletedDateTime }}"
    description: |
      Date and time when this object was deleted. Always null when the object hasn't been deleted.
  - name: description
    value: "{{ description }}"
    description: |
      Description for this policy. Required.
  - name: displayName
    value: "{{ displayName }}"
    description: |
      Display name for this policy. Required.
  - name: excludes
    description: |
      Condition sets that are excluded in this permission grant policy. Automatically expanded on GET.
    value:
      - id: "{{ id }}"
        clientApplicationIds: "{{ clientApplicationIds }}"
        clientApplicationPublisherIds: "{{ clientApplicationPublisherIds }}"
        clientApplicationsFromVerifiedPublisherOnly: {{ clientApplicationsFromVerifiedPublisherOnly }}
        clientApplicationTenantIds: "{{ clientApplicationTenantIds }}"
        permissionClassification: "{{ permissionClassification }}"
        permissions: "{{ permissions }}"
        permissionType: "{{ permissionType }}"
        resourceApplication: "{{ resourceApplication }}"
  - name: includes
    description: |
      Condition sets that are included in this permission grant policy. Automatically expanded on GET.
    value:
      - id: "{{ id }}"
        clientApplicationIds: "{{ clientApplicationIds }}"
        clientApplicationPublisherIds: "{{ clientApplicationPublisherIds }}"
        clientApplicationsFromVerifiedPublisherOnly: {{ clientApplicationsFromVerifiedPublisherOnly }}
        clientApplicationTenantIds: "{{ clientApplicationTenantIds }}"
        permissionClassification: "{{ permissionClassification }}"
        permissions: "{{ permissions }}"
        permissionType: "{{ permissionType }}"
        resourceApplication: "{{ resourceApplication }}"

UPDATE examples

update

Update properties of a permissionGrantPolicy.

UPDATE entra_id.policies.permission_grant_policies
SET 
id = '{{ id }}',
deletedDateTime = '{{ deletedDateTime }}',
description = '{{ description }}',
displayName = '{{ displayName }}',
excludes = '{{ excludes }}',
includes = '{{ includes }}'
WHERE 
permission_grant_policy_id = '{{ permission_grant_policy_id }}' --required
RETURNING
id,
deletedDateTime,
description,
displayName,
excludes,
includes;

DELETE examples

delete

Delete a permissionGrantPolicy object.

DELETE FROM entra_id.policies.permission_grant_policies
WHERE permission_grant_policy_id = '{{ permission_grant_policy_id }}' --required
AND If-Match = '{{ If-Match }}'
;