Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings for group and app memberships that the signed-in user has access to in the organization.
Merill's Note
For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the AccessReview.ReadWrite.Membership permission.
If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant
Category
Application
Delegated
Identifier
18228521-a591-40f1-b215-5fad4488c117
5af8c3f5-baca-439a-97b0-ea58a435e269
DisplayText
Manage access reviews for group and app memberships
Manage access reviews for group and app memberships
Description
Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization for group and app memberships, without a signed-in user.
Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings for group and app memberships that the signed-in user has access to in the organization.
The feature-assigned unique identifier of an access review.
displayName
String
The access review name. Required on create.
startDateTime
DateTimeOffset
The date and time when the review is scheduled to be start. This date can be in the future. Required on create.
endDateTime
DateTimeOffset
The DateTime when the review is scheduled to end. This must be at least one day later than the start date. Required on create.
status
String
This read-only field specifies the status of an accessReview. The typical states include Initializing, NotStarted, Starting,InProgress, Completing, Completed, AutoReviewing, and AutoReviewed.
description
String
The description provided by the access review creator, to show to the reviewers.
businessFlowTemplateId
String
The business flow template identifier. Required on create. This value is case sensitive.
reviewerType
String
The relationship type of reviewer to the target object, one of: self, delegated, entityOwners. Required on create.
createdBy
userIdentity
The user who created this review.
reviewedEntity
identity
The object for which the access review is reviewing the access rights assignments. This identity can be the group for the review of memberships of users in a group, or the app for a review of assignments of users to an application. Required on create.
settings
accessReviewSettings
The settings of an accessReview, see type definition below.
The identity of the reviewer. If the recommendation was used as the review, the userPrincipalName is empty.
reviewedDate
DateTimeOffset
The date and time the most recent review for this access right was supplied.
reviewResult
String
The result of the review, one of NotReviewed, Deny, DontKnow or Approve.
justification
String
The reviewer's business justification, if supplied.
appliedBy
userIdentity
When the review completes, if the results were manually applied, the user identity of the user who applied the decision. If the review was autoapplied, the userPrincipalName is empty.
appliedDateTime
DateTimeOffset
The date and time when the review decision was applied.
applyResult
String
The outcome of applying the decision, one of: NotApplied, Success, Failed, NotFound, NotSupported.
accessRecommendation
String
The feature- generated recommendation shown to the reviewer, one of: Approve, Deny, NotAvailable.
The recurrence interval. Possible values: onetime, weekly, monthly, quarterly, halfyearly or annual.
recurrenceEndType
String
How the recurrence ends. Possible values: never, endBy, occurrences, or recurrenceCount. If it's never, then there's no explicit end of the recurrence series. If it's endBy, then the recurrence ends at a certain date. If it's occurrences, then the series ends after recurrenceCount instances of the review have completed.
For drive items, the display name might not always be available or up to date. For example, if a user changes their display name the API might show the new value in a future response, but the items associated with the user don't show up as changed when using delta.
id
String
Unique identifier for the identity or actor. For example, in the access reviews decisions API, this property might record the id of the principal, that is, the group, user, or application that's subject to review.
tenantId
String
Unique identity of the tenant. Optional.
thumbnails
thumbnailSet
Keyed collection of thumbnail resources. Optional. Applies to drive items, for example.
The display name of the identity. This might not always be available or up-to-date.
id
String
Unique identifier for the identity. Nullable. When the unique identifier is unavailable, the displayName property is provided for the identity, but the id property isn't included in the response.
ipAddress
String
Indicates the client IP address associated with the user performing the activity (audit log only).