delegated_admin_relationships

Creates, updates, deletes, gets or lists a delegated_admin_relationships resource.

Overview

Name	delegated_admin_relationships
Type	Resource
Id	entra_id.tenant_relationships.delegated_admin_relationships

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
accessAssignments	array	The access assignments associated with the delegated admin relationship.
accessDetails	object	(title: delegatedAdminAccessDetails)
activatedDateTime	string (date-time)	The date and time in ISO 8601 format and in UTC time when the relationship became active. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
autoExtendDuration	string (duration)	The duration by which the validity of the relationship is automatically extended, denoted in ISO 8601 format. Supported values are: P0D, PT0S, P180D. The default value is PT0S. PT0S indicates that the relationship expires when the endDateTime is reached and it isn't automatically extended. (pattern: ^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$)
createdDateTime	string (date-time)	The date and time in ISO 8601 format and in UTC time when the relationship was created. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
customer		The display name and unique identifier of the customer of the relationship. This is configured either by the partner at the time the relationship is created or by the system after the customer approves the relationship. Can't be changed by the customer.
displayName	string	The display name of the relationship used for ease of identification. Must be unique across all delegated admin relationships of the partner and is set by the partner only when the relationship is in the created status and can't be changed by the customer. Maximum length is 50 characters.
duration	string (duration)	The duration of the relationship in ISO 8601 format. Must be a value between P1D and P2Y inclusive. This is set by the partner only when the relationship is in the created status and can't be changed by the customer. (pattern: ^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$)
endDateTime	string (date-time)	The date and time in ISO 8601 format and in UTC time when the status of relationship changes to either terminated or expired. Calculated as endDateTime = activatedDateTime + duration. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
lastModifiedDateTime	string (date-time)	The date and time in ISO 8601 format and in UTC time when the relationship was last modified. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
operations	array	The long running operations associated with the delegated admin relationship.
requests	array	The requests associated with the delegated admin relationship.
status		The status of the relationship. Read Only. The possible values are: activating, active, approvalPending, approved, created, expired, expiring, terminated, terminating, terminationRequested, unknownFutureValue. Supports $orderby.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
accessAssignments	array	The access assignments associated with the delegated admin relationship.
accessDetails	object	(title: delegatedAdminAccessDetails)
activatedDateTime	string (date-time)	The date and time in ISO 8601 format and in UTC time when the relationship became active. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
autoExtendDuration	string (duration)	The duration by which the validity of the relationship is automatically extended, denoted in ISO 8601 format. Supported values are: P0D, PT0S, P180D. The default value is PT0S. PT0S indicates that the relationship expires when the endDateTime is reached and it isn't automatically extended. (pattern: ^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$)
createdDateTime	string (date-time)	The date and time in ISO 8601 format and in UTC time when the relationship was created. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
customer		The display name and unique identifier of the customer of the relationship. This is configured either by the partner at the time the relationship is created or by the system after the customer approves the relationship. Can't be changed by the customer.
displayName	string	The display name of the relationship used for ease of identification. Must be unique across all delegated admin relationships of the partner and is set by the partner only when the relationship is in the created status and can't be changed by the customer. Maximum length is 50 characters.
duration	string (duration)	The duration of the relationship in ISO 8601 format. Must be a value between P1D and P2Y inclusive. This is set by the partner only when the relationship is in the created status and can't be changed by the customer. (pattern: ^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$)
endDateTime	string (date-time)	The date and time in ISO 8601 format and in UTC time when the status of relationship changes to either terminated or expired. Calculated as endDateTime = activatedDateTime + duration. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
lastModifiedDateTime	string (date-time)	The date and time in ISO 8601 format and in UTC time when the relationship was last modified. Read-only. (pattern: ^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$)
operations	array	The long running operations associated with the delegated admin relationship.
requests	array	The requests associated with the delegated admin relationship.
status		The status of the relationship. Read Only. The possible values are: activating, active, approvalPending, approved, created, expired, expiring, terminated, terminating, terminationRequested, unknownFutureValue. Supports $orderby.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	delegated_admin_relationship_id		Read the properties of a delegatedAdminRelationship object.
list	select			Get a list of the delegatedAdminRelationship objects and their properties.
insert	insert			Create a new delegatedAdminRelationship object.
update	update	delegated_admin_relationship_id		Update the properties of a delegatedAdminRelationship object. The following restrictions apply: - You can update this relationship when its status property is created. - You can update the autoExtendDuration property when status is either created or active. - You can only remove the Microsoft Entra Global Administrator role when the status property is active, which indicates a long-running operation.
delete	delete	delegated_admin_relationship_id	If-Match	Delete a delegatedAdminRelationship object. A relationship can only be deleted if it's in the 'created' status.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
delegated_admin_relationship_id	string	The unique identifier of delegatedAdminRelationship
If-Match	string	ETag

SELECT examples

get

Read the properties of a delegatedAdminRelationship object.

SELECT
id,
accessAssignments,
accessDetails,
activatedDateTime,
autoExtendDuration,
createdDateTime,
customer,
displayName,
duration,
endDateTime,
lastModifiedDateTime,
operations,
requests,
status
FROM entra_id.tenant_relationships.delegated_admin_relationships
WHERE delegated_admin_relationship_id = '{{ delegated_admin_relationship_id }}' -- required
;

list

Get a list of the delegatedAdminRelationship objects and their properties.

SELECT
id,
accessAssignments,
accessDetails,
activatedDateTime,
autoExtendDuration,
createdDateTime,
customer,
displayName,
duration,
endDateTime,
lastModifiedDateTime,
operations,
requests,
status
FROM entra_id.tenant_relationships.delegated_admin_relationships
;

INSERT examples

insert

Create a new delegatedAdminRelationship object.

INSERT INTO entra_id.tenant_relationships.delegated_admin_relationships (
id,
accessDetails,
activatedDateTime,
autoExtendDuration,
createdDateTime,
customer,
displayName,
duration,
endDateTime,
lastModifiedDateTime,
status,
accessAssignments,
operations,
requests
)
SELECT 
'{{ id }}',
'{{ accessDetails }}',
'{{ activatedDateTime }}',
'{{ autoExtendDuration }}',
'{{ createdDateTime }}',
'{{ customer }}',
'{{ displayName }}',
'{{ duration }}',
'{{ endDateTime }}',
'{{ lastModifiedDateTime }}',
'{{ status }}',
'{{ accessAssignments }}',
'{{ operations }}',
'{{ requests }}'
RETURNING
id,
accessAssignments,
accessDetails,
activatedDateTime,
autoExtendDuration,
createdDateTime,
customer,
displayName,
duration,
endDateTime,
lastModifiedDateTime,
operations,
requests,
status
;

Manifest

# Description fields are for documentation purposes
- name: delegated_admin_relationships
props:
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: accessDetails
    value:
      unifiedRoles:
        - roleDefinitionId: "{{ roleDefinitionId }}"
  - name: activatedDateTime
    value: "{{ activatedDateTime }}"
    description: |
      The date and time in ISO 8601 format and in UTC time when the relationship became active. Read-only.
  - name: autoExtendDuration
    value: "{{ autoExtendDuration }}"
    description: |
      The duration by which the validity of the relationship is automatically extended, denoted in ISO 8601 format. Supported values are: P0D, PT0S, P180D. The default value is PT0S. PT0S indicates that the relationship expires when the endDateTime is reached and it isn't automatically extended.
  - name: createdDateTime
    value: "{{ createdDateTime }}"
    description: |
      The date and time in ISO 8601 format and in UTC time when the relationship was created. Read-only.
  - name: customer
    value: "{{ customer }}"
    description: |
      The display name and unique identifier of the customer of the relationship. This is configured either by the partner at the time the relationship is created or by the system after the customer approves the relationship. Can't be changed by the customer.
  - name: displayName
    value: "{{ displayName }}"
    description: |
      The display name of the relationship used for ease of identification. Must be unique across all delegated admin relationships of the partner and is set by the partner only when the relationship is in the created status and can't be changed by the customer. Maximum length is 50 characters.
  - name: duration
    value: "{{ duration }}"
    description: |
      The duration of the relationship in ISO 8601 format. Must be a value between P1D and P2Y inclusive. This is set by the partner only when the relationship is in the created status and can't be changed by the customer.
  - name: endDateTime
    value: "{{ endDateTime }}"
    description: |
      The date and time in ISO 8601 format and in UTC time when the status of relationship changes to either terminated or expired. Calculated as endDateTime = activatedDateTime + duration. Read-only.
  - name: lastModifiedDateTime
    value: "{{ lastModifiedDateTime }}"
    description: |
      The date and time in ISO 8601 format and in UTC time when the relationship was last modified. Read-only.
  - name: status
    value: "{{ status }}"
    description: |
      The status of the relationship. Read Only. The possible values are: activating, active, approvalPending, approved, created, expired, expiring, terminated, terminating, terminationRequested, unknownFutureValue. Supports $orderby.
  - name: accessAssignments
    description: |
      The access assignments associated with the delegated admin relationship.
    value:
      - id: "{{ id }}"
        accessContainer:
          accessContainerId: "{{ accessContainerId }}"
          accessContainerType: "{{ accessContainerType }}"
        accessDetails:
          unifiedRoles:
            - roleDefinitionId: "{{ roleDefinitionId }}"
        createdDateTime: "{{ createdDateTime }}"
        lastModifiedDateTime: "{{ lastModifiedDateTime }}"
        status: "{{ status }}"
  - name: operations
    description: |
      The long running operations associated with the delegated admin relationship.
    value:
      - id: "{{ id }}"
        createdDateTime: "{{ createdDateTime }}"
        data: "{{ data }}"
        lastModifiedDateTime: "{{ lastModifiedDateTime }}"
        operationType: "{{ operationType }}"
        status: "{{ status }}"
  - name: requests
    description: |
      The requests associated with the delegated admin relationship.
    value:
      - id: "{{ id }}"
        action: "{{ action }}"
        createdDateTime: "{{ createdDateTime }}"
        lastModifiedDateTime: "{{ lastModifiedDateTime }}"
        status: "{{ status }}"

UPDATE examples

update

Update the properties of a delegatedAdminRelationship object. The following restrictions apply:
- You can update this relationship when its status property is created.
- You can update the autoExtendDuration property when status is either created or active.
- You can only remove the Microsoft Entra Global Administrator role when the status property is active, which indicates a long-running operation.

UPDATE entra_id.tenant_relationships.delegated_admin_relationships
SET 
id = '{{ id }}',
accessDetails = '{{ accessDetails }}',
activatedDateTime = '{{ activatedDateTime }}',
autoExtendDuration = '{{ autoExtendDuration }}',
createdDateTime = '{{ createdDateTime }}',
customer = '{{ customer }}',
displayName = '{{ displayName }}',
duration = '{{ duration }}',
endDateTime = '{{ endDateTime }}',
lastModifiedDateTime = '{{ lastModifiedDateTime }}',
status = '{{ status }}',
accessAssignments = '{{ accessAssignments }}',
operations = '{{ operations }}',
requests = '{{ requests }}'
WHERE 
delegated_admin_relationship_id = '{{ delegated_admin_relationship_id }}' --required
RETURNING
id,
accessAssignments,
accessDetails,
activatedDateTime,
autoExtendDuration,
createdDateTime,
customer,
displayName,
duration,
endDateTime,
lastModifiedDateTime,
operations,
requests,
status;

DELETE examples

delete

Delete a delegatedAdminRelationship object. A relationship can only be deleted if it's in the 'created' status.

DELETE FROM entra_id.tenant_relationships.delegated_admin_relationships
WHERE delegated_admin_relationship_id = '{{ delegated_admin_relationship_id }}' --required
AND If-Match = '{{ If-Match }}'
;