EntitlementManagement.Read.All

Allows the app to read access packages and related entitlement management resources on behalf of the signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the EntitlementManagement.Read.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	c74fd47d-ed3c-45c3-9a9e-b8676de685d2	5449aa12-1393-4ea2-a7c7-d0e06c1a56b2
DisplayText	Read all entitlement management resources	Read all entitlement management resources
Description	Allows the app to read access packages and related entitlement management resources without a signed-in user.	Allows the app to read access packages and related entitlement management resources on behalf of the signed-in user.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{accessPackageAssignmentRequestId}
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{accessPackageAssignmentRequestId}/stages
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{accessPackageAssignmentRequestId}/stages/{approvalStageId}
	GET /identityGovernance/entitlementManagement/accessPackages
	GET /identityGovernance/entitlementManagement/accessPackages/{accessPackageId}
	GET /identityGovernance/entitlementManagement/accessPackages/{id}?$expand=resourceRoleScopes($expand=role,scope)
	GET /identityGovernance/entitlementManagement/accessPackages/{id}/accessPackagesIncompatibleWith
	GET /identityGovernance/entitlementManagement/accessPackages/{id}/incompatibleAccessPackages
	GET /identityGovernance/entitlementManagement/accessPackages/{id}/incompatibleGroups
	GET /identityGovernance/entitlementManagement/accessPackages/filterByCurrentUser(on='allowedRequestor')
	GET /identityGovernance/entitlementManagement/accessPackageSuggestions/filterByCurrentUser(on='{on}')
	GET /identityGovernance/entitlementManagement/assignmentPolicies
	GET /identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicyId}
	GET /identityGovernance/entitlementManagement/assignmentRequests
	GET /identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequestId}
	GET /identityGovernance/entitlementManagement/assignmentRequests/filterByCurrentUser(on='parameterValue')
	GET /identityGovernance/entitlementManagement/assignments
	GET /identityGovernance/entitlementManagement/assignments/{accessPackageAssignmentId}
	GET /identityGovernance/entitlementManagement/assignments/additionalAccess(accessPackageId='parameterValue',incompatibleAccessPackageId='parameterValue')
	GET /identityGovernance/entitlementManagement/assignments/filterByCurrentUser(on='parameterValue')
	GET /identityGovernance/entitlementManagement/availableAccessPackages/{availableAccessPackage-id}/resourceRoleScopes
	GET /identityGovernance/entitlementManagement/catalogs
	GET /identityGovernance/entitlementManagement/catalogs/{accessPackageCatalogId}
	GET /identityGovernance/entitlementManagement/catalogs/{accessPackageCatalogId}/resources/{accessPackageResourceId}/uploadSessions
	GET /identityGovernance/entitlementManagement/catalogs/{accessPackageCatalogId}/resources/{accessPackageResourceId}/uploadSessions/{customDataProvidedResourceUploadSessionId}
	GET /identityGovernance/entitlementManagement/catalogs/{catalogId}/customWorkflowExtensions
	GET /identityGovernance/entitlementManagement/catalogs/{catalogId}/customWorkflowExtensions/{accessPackageCustomWorkflowExtensionId}
	GET /identityGovernance/entitlementManagement/catalogs/{catalogId}/resourceRoles?$filter=(originSystem+eq+%27{originSystemType}%27+and+resource/id+eq+%27{resourceId}%27)&$expand=resource
	GET /identityGovernance/entitlementManagement/catalogs/{id}/resources
	GET /identityGovernance/entitlementManagement/connectedOrganizations
	GET /identityGovernance/entitlementManagement/connectedOrganizations/{connectedOrganizationId}
	GET /identityGovernance/entitlementManagement/connectedOrganizations/{id}/externalSponsors
	GET /identityGovernance/entitlementManagement/connectedOrganizations/{id}/internalSponsors
	GET /identityGovernance/entitlementManagement/controlConfigurations/endUserSettings
	GET /identityGovernance/entitlementManagement/externalOriginResourceConnectors
	GET /identityGovernance/entitlementManagement/externalOriginResourceConnectors/{externalOriginResourceConnectorId}
	GET /identityGovernance/entitlementManagement/resourceRequests
	GET /identityGovernance/entitlementManagement/settings
	GET /roleManagement/directory/roleAssignments
	GET /roleManagement/directory/roleAssignments/{id}
	GET /roleManagement/directory/roleDefinitions
	GET /roleManagement/directory/roleDefinitions/{id}
	GET identityGovernance/entitlementManagement/resourceEnvironments?$filter=originSystem eq 'SharePointOnline'
	POST /identityGovernance/entitlementManagement/accessPackages/{accessPackageId}/getApplicablePolicyRequirements

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{id}
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{id}/steps
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{id}/steps/{id}
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentPolicies
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentPolicies/{id}
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentRequests
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentRequests/{id}
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentRequests/filterByCurrentUser(on='parameterValue')
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentResourceRoles
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentResourceRoles/{id}
	GET /identityGovernance/entitlementManagement/accessPackageAssignments
	GET /identityGovernance/entitlementManagement/accessPackageAssignments/additionalAccess(accessPackageId='parameterValue',incompatibleAccessPackageId='parameterValue')
	GET /identityGovernance/entitlementManagement/accessPackageAssignments/filterByCurrentUser(on='parameterValue')
	GET /identityGovernance/entitlementManagement/accessPackageCatalogs
	GET /identityGovernance/entitlementManagement/accessPackageCatalogs/{catalogId}/accessPackageCustomWorkflowExtensions
	GET /identityGovernance/entitlementManagement/accessPackageCatalogs/{catalogId}/accessPackageCustomWorkflowExtensions/{accessPackageCustomWorkflowExtensionId}
	GET /identityGovernance/entitlementManagement/accessPackageCatalogs/{catalogId}/accessPackageResourceRoles?$filter=(originSystem+eq+%27{originSystemType}%27+and+accessPackageResource/id+eq+%27{resourceId}%27)&$expand=accessPackageResource
	GET /identityGovernance/entitlementManagement/accessPackageCatalogs/{catalogId}/customAccessPackageWorkflowExtensions
	GET /identityGovernance/entitlementManagement/accessPackageCatalogs/{catalogId}/customAccessPackageWorkflowExtensions/{customAccessPackageWorkflowExtensionId}
	GET /identityGovernance/entitlementManagement/accessPackageCatalogs/{id}
	GET /identityGovernance/entitlementManagement/accessPackageCatalogs/{id}/accessPackageResources
	GET /identityGovernance/entitlementManagement/accessPackageResourceEnvironments/{accessPackageResourceEnvironmentId}
	GET /identityGovernance/entitlementManagement/accessPackageResourceRequests
	GET /identityGovernance/entitlementManagement/accessPackages
	GET /identityGovernance/entitlementManagement/accessPackages/{id}
	GET /identityGovernance/entitlementManagement/accessPackages/{id}?$expand=accessPackageResourceRoleScopes($expand=accessPackageResourceRole,accessPackageResourceScope)
	GET /identityGovernance/entitlementManagement/accessPackages/{id}/accessPackagesIncompatibleWith
	GET /identityGovernance/entitlementManagement/accessPackages/{id}/incompatibleAccessPackages
	GET /identityGovernance/entitlementManagement/accessPackages/{id}/incompatibleGroups
	GET /identityGovernance/entitlementManagement/accessPackages/filterByCurrentUser(on='allowedRequestor')
	GET /identityGovernance/entitlementManagement/accessPackageSuggestions/filterByCurrentUser(on={on})
	GET /identityGovernance/entitlementManagement/assignmentRequests
	GET /identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequestId}
	GET /identityGovernance/entitlementManagement/assignmentRequests/filterByCurrentUser(on='parameterValue')
	GET /identityGovernance/entitlementManagement/availableAccessPackages/{availableAccessPackage-id}/resourceRoleScopes
	GET /identityGovernance/entitlementManagement/connectedOrganizations
	GET /identityGovernance/entitlementManagement/connectedOrganizations/{id}
	GET /identityGovernance/entitlementManagement/connectedOrganizations/{id}/externalSponsors
	GET /identityGovernance/entitlementManagement/connectedOrganizations/{id}/internalSponsors
	GET /identityGovernance/entitlementManagement/controlConfigurations/endUserSettings
	GET /identityGovernance/entitlementManagement/externalOriginResourceConnectors
	GET /identityGovernance/entitlementManagement/settings
	GET /identityGovernance/insights/accessDriftSummary
	GET /identityGovernance/insights/accessDriftSummary/{accessDriftSummary-id}
	GET /identityGovernance/insights/accessDriftSummary/{accessDriftSummary-id}/details
	GET /roleManagement/cloudPC/roleDefinitions
	GET /roleManagement/cloudPC/roleDefinitions/{id}
	GET /roleManagement/directory/roleAssignments
	GET /roleManagement/directory/roleAssignments/{id}
	GET identityGovernance/entitlementManagement/accessPackageResourceEnvironments?$filter=originSystem eq 'SharePointOnline'
	POST /identityGovernance/entitlementManagement/accessPackageCatalogs/{catalogId}/accessPackageCustomWorkflowExtensions
	POST /identityGovernance/entitlementManagement/accessPackages/{id}/getApplicablePolicyRequirements
	POST /identityGovernance/insights/accessDriftReport/microsoft.graph.downloadFile
	POST /identityGovernance/insights/accessDriftReport/microsoft.graph.generateDownloadUri

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgEntitlementManagementAccessPackage
	Get-MgEntitlementManagementAccessPackageApplicablePolicyRequirement
	Get-MgEntitlementManagementAccessPackageAssignmentApprovalStage
	Get-MgEntitlementManagementAccessPackageIncompatibleAccessPackage
	Get-MgEntitlementManagementAccessPackageIncompatibleGroup
	Get-MgEntitlementManagementAccessPackageIncompatibleWith
	Get-MgEntitlementManagementAssignment
	Get-MgEntitlementManagementAssignmentAdditional
	Get-MgEntitlementManagementAssignmentPolicy
	Get-MgEntitlementManagementAssignmentRequest
	Get-MgEntitlementManagementAvailableAccessPackageResourceRoleScope
	Get-MgEntitlementManagementCatalog
	Get-MgEntitlementManagementCatalogCustomWorkflowExtension
	Get-MgEntitlementManagementCatalogResource
	Get-MgEntitlementManagementCatalogResourceRole
	Get-MgEntitlementManagementCatalogResourceUploadSession
	Get-MgEntitlementManagementConnectedOrganization
	Get-MgEntitlementManagementConnectedOrganizationExternalSponsor
	Get-MgEntitlementManagementConnectedOrganizationInternalSponsor
	Get-MgEntitlementManagementControlConfiguration
	Get-MgEntitlementManagementExternalOriginResourceConnector
	Get-MgEntitlementManagementResourceEnvironment
	Get-MgEntitlementManagementResourceRequest
	Get-MgEntitlementManagementSetting
	Get-MgRoleManagementDirectoryRoleAssignment
	Get-MgRoleManagementDirectoryRoleDefinition
	Get-MgRoleManagementEntitlementManagementRoleAssignment
	Get-MgRoleManagementEntitlementManagementRoleDefinition
	Invoke-MgFilterEntitlementManagementAccessPackageByCurrentUser
	Invoke-MgFilterEntitlementManagementAccessPackageSuggestionByCurrentUser
	Invoke-MgFilterEntitlementManagementAssignmentByCurrentUser
	Invoke-MgFilterEntitlementManagementAssignmentRequestByCurrentUser

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaEntitlementManagementAccessPackage
	Get-MgBetaEntitlementManagementAccessPackageApplicablePolicyRequirement
	Get-MgBetaEntitlementManagementAccessPackageAssignment
	Get-MgBetaEntitlementManagementAccessPackageAssignmentAdditional
	Get-MgBetaEntitlementManagementAccessPackageAssignmentPolicy
	Get-MgBetaEntitlementManagementAccessPackageAssignmentRequest
	Get-MgBetaEntitlementManagementAccessPackageAssignmentResourceRole
	Get-MgBetaEntitlementManagementAccessPackageCatalog
	Get-MgBetaEntitlementManagementAccessPackageCatalogAccessPackageCustomWorkflowExtension
	Get-MgBetaEntitlementManagementAccessPackageCatalogAccessPackageResource
	Get-MgBetaEntitlementManagementAccessPackageCatalogAccessPackageResourceRole
	Get-MgBetaEntitlementManagementAccessPackageCatalogCustomAccessPackageWorkflowExtension
	Get-MgBetaEntitlementManagementAccessPackageIncompatibleAccessPackage
	Get-MgBetaEntitlementManagementAccessPackageIncompatibleGroup
	Get-MgBetaEntitlementManagementAccessPackageIncompatibleWith
	Get-MgBetaEntitlementManagementAccessPackageResourceEnvironment
	Get-MgBetaEntitlementManagementAccessPackageResourceRequest
	Get-MgBetaEntitlementManagementAssignmentRequest
	Get-MgBetaEntitlementManagementAvailableAccessPackageResourceRoleScope
	Get-MgBetaEntitlementManagementConnectedOrganization
	Get-MgBetaEntitlementManagementConnectedOrganizationExternalSponsor
	Get-MgBetaEntitlementManagementConnectedOrganizationInternalSponsor
	Get-MgBetaEntitlementManagementControlConfiguration
	Get-MgBetaEntitlementManagementExternalOriginResourceConnector
	Get-MgBetaEntitlementManagementSetting
	Get-MgBetaRoleManagementDirectoryRoleAssignment
	Get-MgBetaRoleManagementDirectoryRoleDefinition
	Get-MgBetaRoleManagementExchangeRoleAssignment
	Get-MgBetaRoleManagementExchangeRoleDefinition
	Invoke-MgBetaFilterEntitlementManagementAccessPackageAssignmentByCurrentUser
	Invoke-MgBetaFilterEntitlementManagementAccessPackageAssignmentRequestByCurrentUser
	Invoke-MgBetaFilterEntitlementManagementAccessPackageByCurrentUser
	Invoke-MgBetaFilterEntitlementManagementAccessPackageSuggestionByCurrentUser
	New-MgBetaEntitlementManagementAccessPackageCatalogAccessPackageCustomWorkflowExtension

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: accessDriftDetail

Property	Type	Description
createdDateTime	DateTimeOffset	The date and time when the drift record was created.
driftSource	accessDriftSource	The comparison system that detected the drift. The possible values are: `entra`, `externalApplication`, `unknownFutureValue`.
driftType	accessDriftType	The classification of the drift. The possible values are: `unauthorized`, `missing`, `inSync`, `unknownFutureValue`.
id	String	The unique identifier for the drift detail. Inherited from entity.
resource	driftResourceInfo	The governed resource associated with this drift record.

Graph reference: accessDriftReport

Property	Type	Description
downloadUri	String	The time-limited SAS URI for downloading the report file. This property is populated only in the response of the generateDownloadUri action.
expiresAt	DateTimeOffset	The date and time when the download URI expires. This property is populated only in the response of the generateDownloadUri action.
id	String	A randomly generated identifier for this report instance. Inherited from entity.
resourceType	accessDriftReportResourceType	The resource type of the report. The possible values are: `application`, `group`, `unknownFutureValue`.

Graph reference: accessDriftReportRequest

Property	Type	Description
catalogId	String	Reserved for future use. This property is currently ignored, and the report includes data from all catalogs.
reportFormat	String	The file format of the report. The supported values are `csv` and `parquet`. For the generateDownloadUri action, specify `parquet`.
resourceIds	String collection	Reserved for future use. This property is currently ignored, and the report includes all resources of the specified resource type.
resourceType	accessDriftReportResourceType	The type of resource for the report. The possible values are: `application`, `group`, `unknownFutureValue`.

Graph reference: accessDriftSummary

Property	Type	Description
createdDateTime	DateTimeOffset	The date and time when the drift snapshot was created.
driftCounts	driftCounts	The aggregate counts of unauthorized and missing assignments for this resource.
driftSource	accessDriftSource	The comparison system that detected the drift. The possible values are: `entra`, `externalApplication`, `unknownFutureValue`.
id	String	The unique identifier for the access drift summary. Inherited from entity.
resource	driftResourceInfo	The governed resource associated with this drift summary.

Graph reference: accessPackage

Property	Type	Description
createdDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
description	String	The description of the access package.
displayName	String	Required. The display name of the access package. Supports $filter (`eq`, `contains`).
id	String	Read-only.
isHidden	Boolean	Indicates whether the access package is hidden from the requestor.
modifiedDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.

Graph reference: accessPackageAssignment

Property	Type	Description
customExtensionCalloutInstances	customExtensionCalloutInstance collection	Information about all the custom extension calls that were made during the access package assignment workflow.
expiredDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
id	String	Read-only.
schedule	entitlementManagementSchedule	When the access assignment is to be in place. Read-only.
state	accessPackageAssignmentState	The state of the access package assignment. The possible values are: `delivering`, `partiallyDelivered`, `delivered`, `expired`, `deliveryFailed`, `unknownFutureValue`. Read-only. Supports `$filter` (`eq`).
status	String	More information about the assignment lifecycle. Possible values include `Delivering`, `Delivered`, `AutoAssignmentInGracePeriod`, `NearExpiry1DayNotificationTriggered`, or `ExpiredNotificationTriggered`. Read-only.

Graph reference: accessPackageAssignmentPolicy

Property	Type	Description
accessPackageNotificationSettings	accessPackageNotificationSettings	Represents the settings for email notifications for requests to an access package.
allowedTargetScope	allowedTargetScope	Principals that can be assigned the access package through this policy. The possible values are: `notSpecified`, `specificDirectoryUsers`, `specificConnectedOrganizationUsers`, `specificDirectoryServicePrincipals`, `allMemberUsers`, `allDirectoryUsers`, `allDirectoryServicePrincipals`, `allConfiguredConnectedOrganizationUsers`, `allExternalUsers`, `allDirectoryAgentIdentities`, `unknownFutureValue`.
automaticRequestSettings	accessPackageAutomaticRequestSettings	This property is only present for an auto assignment policy; if absent, this is a request-based policy.
createdDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.
description	String	The description of the policy.
displayName	String	The display name of the policy.
expiration	expirationPattern	The expiration date for assignments created in this policy.
id	String	Read-only.
modifiedDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.
requestApprovalSettings	accessPackageAssignmentApprovalSettings	Specifies the settings for approval of requests for an access package assignment through this policy. For example, if approval is required for new requests.
requestorSettings	accessPackageAssignmentRequestorSettings	Provides additional settings to select who can create a request for an access package assignment through this policy, and what they can include in their request.
reviewSettings	accessPackageAssignmentReviewSettings	Settings for access reviews of assignments through this policy.
specificAllowedTargets	subjectSet collection	The principals that can be assigned access from an access package through this policy.

Graph reference: accessPackageAssignmentRequest

Property	Type	Description
answers	accessPackageAnswer collection	Answers provided by the requestor to accessPackageQuestions asked of them at the time of request.
completedDateTime	DateTimeOffset	The date of the end of processing, either successful or failure, of a request. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
customExtensionCalloutInstances	customExtensionCalloutInstance collection	Information about all the custom extension calls that were made during the access package assignment workflow.
createdDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only. Supports `$filter`.
id	String	Read-only.
justification	String	The requestor's supplied justification.
requestType	accessPackageRequestType	The type of the request. The possible values are: `notSpecified`, `userAdd`, `userUpdate`, `userRemove`, `adminAdd`, `adminUpdate`, `adminRemove`, `systemAdd`, `systemUpdate`, `systemRemove`, `onBehalfAdd` (not supported), `unknownFutureValue`. Use the `Prefer: include-unknown-enum-members` request header to get the following values in this evolvable enum: `approverRemove`. Requests from the user have a requestType of `userAdd`, `userUpdate`, or `userRemove`. This property can't be changed once set.
schedule	entitlementManagementSchedule	The range of dates that access is to be assigned to the requestor. This property can't be changed once set, but a new schedule for an assignment can be included in another `userUpdate` or `adminUpdate` assignment request.
state	accessPackageRequestState	The state of the request. The possible values are: `submitted`, `pendingApproval`, `delivering`, `delivered`, `deliveryFailed`, `denied`, `scheduled`, `canceled`, `partiallyDelivered`, `unknownFutureValue`. Read-only. Supports `$filter` (`eq`).
status	String	More information on the request processing status. Read-only.

Graph reference: accessPackageAssignmentRequestRequirements

Property	Type	Description
allowCustomAssignmentSchedule	Boolean	Indicates whether the requestor is allowed to set a custom schedule.
isApprovalRequiredForAdd	Boolean	Indicates whether a request to add must be approved by an approver.
isApprovalRequiredForUpdate	Boolean	Indicates whether a request to update must be approved by an approver.
isRequestorJustificationRequired	Boolean	Indicates whether requestors must justify requesting access to an access package.
policyDescription	String	The description of the policy that the user is trying to request access using.
policyDisplayName	String	The display name of the policy that the user is trying to request access using.
policyId	String	The identifier of the policy that these requirements are associated with. This identifier can be used when creating a new assignment request.
questions	accessPackageQuestion collection	Questions that are configured on the policy. The questions can be required or optional; callers can determine whether a question is required or optional based on the isRequired property on accessPackageQuestion.
schedule	entitlementManagementSchedule	Schedule restrictions enforced, if any.

Graph reference: accessPackageAssignmentRequestWorkflowExtension

Property	Type	Description
authenticationConfiguration	customExtensionAuthenticationConfiguration	Configuration for securing the API call to the logic app. For example, using OAuth client credentials flow. Inherited from customCalloutExtension.
callbackConfiguration	customExtensionCallbackConfiguration	The callback configuration for a custom extension.
clientConfiguration	customExtensionClientConfiguration	HTTP connection settings that define how long Microsoft Entra ID can wait for a connection to a logic app, how many times you can retry a timed-out connection and the exception scenarios when retries are allowed. Inherited from customCalloutExtension.
createdBy	String	The userPrincipalName of the user or identity of the subject that created this resource. Read-only.
createdDateTime	DateTimeOffset	When the object was created.
description	String	Description for the customAccessPackageWorkflowExtension object. Inherited from customCalloutExtension.
displayName	String	Display name for the customAccessPackageWorkflowExtension object. Inherited from customCalloutExtension.
endpointConfiguration	customExtensionEndpointConfiguration	The type and details for configuring the endpoint to call the logic app's workflow. Inherited from customCalloutExtension.
id	String	Read-only.
lastModifiedBy	String	The userPrincipalName of the identity that last modified the object.
lastModifiedDateTime	DateTimeOffset	When the object was last modified.

Graph reference: accessPackageAssignmentResourceRole

Property	Type	Description
id	String	Read-only.
originId	String	A unique identifier relative to the origin system, corresponding to the originId property of the accessPackageResourceRole.
originSystem	String	The system where the role assignment is to be created or has been created for an access package assignment, such as `SharePointOnline`, `AadGroup`, or `AadApplication`, corresponding to the originSystem property of the accessPackageResourceRole.
status	String	The value is `PendingFulfillment` before the access package assignment is delivered to the origin system, and `Fulfilled` after the access package assignment is delivered to the origin system.

Graph reference: accessPackageAssignmentWorkflowExtension

Property	Type	Description
authenticationConfiguration	customExtensionAuthenticationConfiguration	Configuration for securing the API call to the logic app. For example, using OAuth client credentials flow. Inherited from customCalloutExtension.
callbackConfiguration	customExtensionCallbackConfiguration	The callback configuration for a custom extension.
clientConfiguration	customExtensionClientConfiguration	HTTP connection settings that define how long Microsoft Entra ID can wait for a connection to a logic app. The settings define how many times you can retry a timed-out connection and the exception scenarios when retries are allowed. Inherited from customCalloutExtension.
createdBy	String	The userPrincipalName of the user or identity of the subject that created this resource. Read-only.
createdDateTime	DateTimeOffset	When the entity was created.
description	String	Description for the customAccessPackageWorkflowExtension object. Inherited from customCalloutExtension.
displayName	String	Display name for the customAccessPackageWorkflowExtension object. Inherited from customCalloutExtension.
endpointConfiguration	customExtensionEndpointConfiguration	The type and details for configuring the endpoint to call the logic app's workflow. Inherited from customCalloutExtension.
id	String	Read-only.
lastModifiedBy	String	The userPrincipalName of the identity that last modified the entity.
lastModifiedDateTime	DateTimeOffset	When the entity was last modified.

Graph reference: accessPackageCatalog

Property	Type	Description
catalogType	accessPackageCatalogType	Whether the catalog is created by a user or entitlement management. The possible values are: `userManaged`, `serviceDefault`, `serviceManaged`, `unknownFutureValue`.
createdDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
description	String	The description of the access package catalog.
displayName	String	The display name of the access package catalog.
id	String	Read-only.
isExternallyVisible	Boolean	Whether the access packages in this catalog can be requested by users outside of the tenant.
modifiedDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
state	accessPackageCatalogState	Has the value `published` if the access packages are available for management. The possible values are: `unpublished`, `published`, `unknownFutureValue`.

Graph reference: accessPackageResource

Property	Type	Description
attributes	accessPackageResourceAttribute collection	Contains information about the attributes to be collected from the requestor and sent to the resource application.
createdDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
description	String	A description for the resource.
displayName	String	The display name of the resource, such as the application name, group name or site name.
id	String	Read-only.
modifiedDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
originId	String	The unique identifier of the resource in the origin system. For a Microsoft Entra group, this is the identifier of the group.
originSystem	String	The type of the resource in the origin system, such as `SharePointOnline`, `AadApplication` or `AadGroup`.

Graph reference: accessPackageResourceEnvironment

Property	Type	Description
connectionInfo	connectionInfo	Connection information of an environment used to connect to a resource.
createdDateTime	DateTimeOffset	The date and time that this object was created. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.
description	String	The description of this object.
displayName	String	The display name of this object.
id	String	The system-assigned unique identifier of the object.
isDefaultEnvironment	Boolean	Determines whether this is default environment or not. It is set to `true` for all static origin systems, such as Microsoft Entra groups and Microsoft Entra Applications.
modifiedDateTime	DateTimeOffset	The date and time that this object was last modified. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.
originId	String	The unique identifier of this environment in the origin system.
originSystem	String	The type of the resource in the origin system, that is, `SharePointOnline`. Requires `$filter` (`eq`).

Graph reference: accessPackageResourceRequest

Property	Type	Description
createdDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
id	String	Read-only.
requestType	accessPackageRequestType	The type of the request. Use `adminAdd` to add a resource, if the caller is an administrator or resource owner, `adminUpdate` to update a resource, or `adminRemove` to remove a resource.
state	accessPackageRequestState	The outcome of whether the service was able to add the resource to the catalog. The value is `delivered` if the resource was added or removed, and `deliveryFailed` if it couldn't be added or removed. Read-only.

Graph reference: accessPackageResourceRole

Property	Type	Description
description	String	A description for the resource role.
displayName	String	The display name of the resource role such as the role defined by the application.
id	String	Read-only.
originId	String	The unique identifier of the resource role in the origin system. For a SharePoint Online site, the originId is the sequence number of the role in the site.
originSystem	String	The type of the resource in the origin system, such as `SharePointOnline`, `AadApplication`, `AzureResources`, or `AadGroup`.
type	roleType	The role type for the Azure resource role. The possible values are: `active`, `eligible`, `application`, `delegated`, `unknownFutureValue`. The values `active` and `eligible` are only supported where **o

Graph reference: accessPackageResourceRoleScope

Property	Type	Description
createdDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
id	String	Read-only.

Graph reference: accessPackageResourceScope

Property	Type	Description
description	String	The description of the scope.
displayName	String	The display name of the scope.
id	String	Read-only.
isRootScope	Boolean	True if the scopes are arranged in a hierarchy and this is the top or root scope of the resource.
originId	String	The unique identifier of the resource in the origin system. If a Microsoft Entra group, originId is the identifier of the group. Supports `$filter` (`eq`).
originSystem	String	The type of the resource in the origin system, such as `SharePointOnline`, `AadApplication`, `AadGroup`, `AzureResources`, or `CustomDataProvidedResource`. Supports `$filter` (`eq`).

Graph reference: accessPackageSuggestion

Property	Type	Description
id	String	The identifier of the suggested access package. Read-only.
reasons	Collection(accessPackageSuggestionReason)	A collection of reasons why this access package is being suggested to the user.

Graph reference: approval

Property	Type	Description
id	String	Identifier of the approval decision. In PIM for Groups, it's the same identifier as the identifier of the assignment schedule request.

Graph reference: approvalStage

Property	Type	Description
assignedToMe	Boolean	Indicates whether the stage is assigned to the calling user to review. Read-only.
displayName	String	The label provided by the policy creator to identify an approval stage. Read-only.
id	String	The identifier of the stage associated with an approval object. Read-only.
justification	String	The justification associated with the approval stage decision.
reviewResult	String	The result of this approval record. Possible values include: `NotReviewed`, `Approved`, `Denied`.
reviewedBy	identity	The identifier of the reviewer. `00000000-0000-0000-0000-000000000000` if the assigned reviewer hasn't reviewed. Read-only.
reviewedDateTime	DateTimeOffset	The date and time when a decision was recorded. The date and time information uses ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
status	String	The stage status. Possible values: `InProgress`, `Initializing`, `Completed`, `Expired`. Read-only.

Graph reference: approvalStep

Property	Type	Description
assignedToMe	Boolean	Indicates whether the step is assigned to the calling user to review. Read-only.
displayName	String	The label provided by the policy creator to identify an approval step. Read-only.
id	String	The identifier of the step associated with an approval object. Read-only.
justification	String	The justification associated with the approval step decision.
reviewResult	String	The result of this approval record. Possible values include: `NotReviewed`, `Approved`, `Denied`.
reviewedBy	userIdentity collection	The identifier of the reviewer. `00000000-0000-0000-0000-000000000000` if the assigned reviewer hasn't reviewed. Read-only.
reviewedDateTime	DateTimeOffset	The date and time when a decision was recorded. The date and time information uses ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
status	String	The step status. Possible values: `InProgress`, `Initializing`, `Completed`, `Expired`. Read-only.

Graph reference: availableAccessPackage

Property	Type	Description
description	String	The description of the access package.
displayName	String	The display name of the access package.
id	String	Identifier of the access package. Read-only.

Graph reference: connectedOrganization

Property	Type	Description
createdDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
description	String	The description of the connected organization.
displayName	String	The display name of the connected organization. Supports `$filter` (`eq`).
id	String	Read-only.
identitySources	identitySource collection	The identity sources in this connected organization, one of azureActiveDirectoryTenant, crossCloudAzureActiveDirectoryTenant, domainIdentitySource, externalDomainFederation, or socialIdentitySource. Nullable.
modifiedDateTime	DateTimeOffset	*The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
state	connectedOrganizationState	The state of a connected organization defines whether assignment policies with requestor scope type `AllConfiguredConnectedOrganizationSubjects` are applicable or not. The possible values are: `configured`, `proposed`, `unknownFutureValue`.

Graph reference: customaccesspackageworkflowextension

Property	Type	Description
authenticationConfiguration	customExtensionAuthenticationConfiguration	Configuration for securing the API call to the logic app. For example, using OAuth client credentials flow. Inherited from customCalloutExtension.
clientConfiguration	customExtensionClientConfiguration	HTTP connection settings that define how long Microsoft Entra ID can wait for a connection to a logic app, how many times you can retry a timed-out connection and the exception scenarios when retries are allowed. Inherited from customCalloutExtension.
createdDateTime	DateTimeOffset	Represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
description	String	Description for the customAccessPackageWorkflowExtension object. Inherited from customCalloutExtension. Read-only.
displayName	String	Display name for the customAccessPackageWorkflowExtension object. Inherited from customCalloutExtension. Read-only. Supports `$filter` (`contains`).
endpointConfiguration	customExtensionEndpointConfiguration	The type and details for configuring the endpoint to call the logic app's workflow. Inherited from customCalloutExtension.
id	String	Identifier for the customAccessPackageWorkflowExtension object. Inherited from entity.
lastModifiedDateTime	DateTimeOffset	Represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.

Graph reference: customDataProvidedResourceFile

Property	Type	Description
id	String	Unique identifier for the file. Read-only.
name	String	Name of the uploaded file, including the file extension. Required. Supports `$filter` (`eq`, `ne`) and `$orderby`.
size	Int64	Size of the file in bytes. Read-only. Supports `$filter` (`eq`, `ne`, `gt`, `ge`, `lt`, `le`) and `$orderby`.
uploadedDateTime	DateTimeOffset	Timestamp when the file was uploaded. Read-only. Supports `$filter` (`eq`, `ne`, `gt`, `ge`, `lt`, `le`) and `$orderby`.

Graph reference: customDataProvidedResourceUploadSession

Property	Type	Description
createdDateTime	DateTimeOffset	DateTime when the upload session was created. Read-only. Supports `$orderby`.
data	microsoft.graph.customDataProvidedResourcePayloads.data	An object containing the context for which this data is being uploaded.
id	String	Unique identifier of the upload session. Read-only.
isUploadDone	Boolean	Indicates if all the necessary files have been uploaded to this session.
referenceId	String	The ID of the context for which data is being uploaded, for example, the Access Review instance ID. Supports `$filter (eq)`.
stats	customDataProvidedResourceUploadStats	Metadata about the files uploaded in this upload session thus far.
status	customDataProvidedResourceUploadStatus	Status of the upload session. The possible values are: `active`, `complete`, `expired`, `unknownFutureValue`. Supports `$filter (eq)`.

Graph reference: customExtensionCallbackConfiguration

Property	Type	Description
timeoutDuration	Duration	The maximum duration in ISO 8601 format that Microsoft Entra ID will wait for a resume action for the callout it sent to the logic app. The valid range for custom extensions in lifecycle workflows is five minutes to three hours. The valid range for custom extensions in entitlement management is between 5 minutes and 14 days. For example, `PT3H` refers to three hours, `P3D` refers to three days, `PT10M` refers to ten minutes.

Graph reference: directoryObject

Property	Type	Description
deletedDateTime	DateTimeOffset	Date and time when this object was deleted. Always `null` when the object hasn't been deleted.
id	String	The unique identifier for the object. For example, `12345678-9abc-def0-1234-56789abcde`. The value of the **i

Graph reference: endUserSettings

Property	Type	Description
relatedPeopleInsightLevel	accessPackageSuggestionRelatedPeopleInsightLevel	The level of related people insights to show in access package suggestions. The possible values are: `disabled`, `count`, `countAndNames`, `unknownFutureValue`.
showApproverDetailsToMembers	Boolean	Indicates whether approver details are shown to end users. When `true`, approver information is visible to members.

Graph reference: entitlementManagementSettings

Property	Type	Description
durationUntilExternalUserDeletedAfterBlocked	Duration	If externalUserLifecycleAction is `blockSignInAndDelete`, the duration, typically many days, after an external user is blocked from sign in before their account is deleted.
externalUserLifecycleAction	accessPackageExternalUserLifecycleAction	Automatic action that the service should take when an external user's last access package assignment is removed. The possible values are: `none`, `blockSignIn`, `blockSignInAndDelete`, `unknownFutureValue`.
id	String	A constant. Read-only.

Graph reference: externalOriginResourceConnector

Property	Type	Description
connectionInfo	connectionInfo	The connection information used to communicate with the external resource system. When connectorType is `sapIag`, the type is externalTokenBasedSapIagConnectionInfo.
connectorType	connectorType	The type of connector to SAP being used. The possible values are: `sapIag` (SAP Cloud Identity Access Governance), `unknownFutureValue`.
createdBy	String	The identifier of the user or application that created the connector.
createdDateTime	DateTimeOffset	The date and time when the connector was created.
description	String	A description of the connector.
displayName	String	The display name of the connector.
id	String	The unique identifier of the connector. Inherited from entity.
modifiedBy	String	The identifier of the user or application that last modified the connector.
modifiedDateTime	DateTimeOffset	The date and time when the connector was last modified.

Graph reference: group

Property	Type	Description
accessType	groupAccessType	Indicates the type of access to the group. The possible values are: `none`, `private`, `secret`, `public`, `unknownFutureValue`. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
allowExternalSenders	Boolean	Indicates if people external to the organization can send messages to the group. The default value is `false`. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
assignedLabels	assignedLabel collection	The list of sensitivity label pairs (label ID, label name) associated with a Microsoft 365 group or a cloud security group. Requires a Microsoft Entra ID P1 license. Requires `$select` to retrieve. This property can be specified during group creation or update. However, for cloud security groups, it's immutable once set. This property can be updated only in delegated scenarios where the caller requires both the Microsoft Graph permission and a supported administrator role. To learn more about managing this property for Microsoft 365 vs. cloud security groups, see Key differences from Microsoft 365 group labeling.
assignedLicenses	assignedLicense collection	The licenses that are assigned to the group. Requires `$select` to retrieve. Supports `$filter` (`eq`). Read-only.
autoSubscribeNewMembers	Boolean	Indicates if new members added to the group are autosubscribed to receive email notifications. You can set this property in a PATCH request for the group; don't set it in the initial POST request that creates the group. Default value is `false`. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
classification	String	Describes a classification for the group (such as low, medium, or high business impact). Valid values for this property are defined by creating a ClassificationList setting value, based on the template definition. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `startsWith`).
createdDateTime	DateTimeOffset	Timestamp of when the group was created. The value can't be modified and is automatically populated when the group is created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on January 1, 2014 is `2014-01-01T00:00:00Z`. Returned by default. Read-only.
deletedDateTime	DateTimeOffset	For some Microsoft Entra objects (user, group, application), if the object is deleted, it's first logically deleted, and this property is updated with the date and time when the object was deleted. Otherwise this property is `null`. If the object is restored, this property is updated to `null`. Inherited from directoryObject.
description	String	An optional description for the group. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `startsWith`) and `$search`.
displayName	String	The display name for the group. This property is required when a group is created and can't be cleared during updates. Maximum length is 256 characters. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values), `$search`, and `$orderby`.
expirationDateTime	DateTimeOffset	Timestamp of when the group is set to expire. It's `null` for security groups, but for Microsoft 365 groups, it represents when the group is set to expire as defined in the groupLifecyclePolicy. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on January 1, 2014 is `2014-01-01T00:00:00Z`. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`). Read-only.
groupTypes	String collection	Specifies the group type and its membership. If the collection contains `Unified`, the group is a Microsoft 365 group; otherwise, it's either a security group or a distribution group. For details, see groups overview. If the collection includes `DynamicMembership`, the group has dynamic membership; otherwise, membership is static. Returned by default. Supports `$filter` (`eq`, `not`).
hasMembersWithLicenseErrors	Boolean	Indicates whether there are members in this group that have license errors from its group-based license assignment. This property is never returned on a GET operation. You can use it as a $filter argument to get groups that have members with license errors (that is, filter for this property being true). See an example. Supports `$filter` (`eq`).
hideFromAddressLists	Boolean	True if the group isn't displayed in certain parts of the Outlook UI: the Address Book, address lists for selecting message recipients, and the Browse Groups dialog for searching groups; otherwise, false. The default value is `false`. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
hideFromOutlookClients	Boolean	True if the group isn't displayed in Outlook clients, such as Outlook for Windows and Outlook on the web; otherwise, false. The default value is `false`. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
id	String	The unique identifier for the group. Returned by default. Inherited from directoryObject. Key. Not nullable. Read-only. Supports `$filter` (`eq`, `ne`, `not`, `in`).
isArchived	Boolean	When a group is associated with a team, this property determines whether the team is in read-only mode. To read this property, use the `/group/{groupId}/team` endpoint or the Get team API. To update this property, use the archiveTeam and unarchiveTeam APIs.
isAssignableToRole	Boolean	Indicates whether this group can be assigned to a Microsoft Entra role. Optional. This property can only be set while creating the group and is immutable. If set to `true`, the securityEnabled property must also be set to `true`, visibility must be `Hidden`, and the group can't be a dynamic group (that is, groupTypes can't contain `DynamicMembership`). Only callers with at least the Privileged Role Administrator role can set this property. The caller must also be assigned the RoleManagement.ReadWrite.Directory permission to set this property or update the membership of such groups. For more, see Using a group to manage Microsoft Entra role assignments Using this feature requires a Microsoft Entra ID P1 license. Returned by default. Supports `$filter` (`eq`, `ne`, `not`).
isFavorite	Boolean	Indicates whether the user marked the group as favorite. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
isManagementRestricted	Boolean	Indicates whether the group is a member of a restricted management administrative unit. If not set, the default value is `null` and the default behavior is false. Read-only. To manage a group member of a restricted management administrative unit, the administrator or calling app must be assigned a Microsoft Entra role at the scope of the restricted management administrative unit. Requires `$select` to retrieve.
isSubscribedByMail	Boolean	Indicates whether the signed-in user is subscribed to receive email conversations. The default value is `true`. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
licenseProcessingState	String	Indicates the status of the group license assignment to all group members. The default value is `false`. Read-only. Possible values: `QueuedForProcessing`, `ProcessingInProgress`, and `ProcessingComplete`. Requires `$select` to retrieve. Read-only.
mail	String	The SMTP address for the group, for example, "[email protected]". Returned by default. Read-only. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
mailEnabled	Boolean	Specifies whether the group is mail-enabled. Required. Returned by default. Supports `$filter` (`eq`, `ne`, `not`).
mailNickname	String	The mail alias for the group, unique for Microsoft 365 groups in the organization. Maximum length is 64 characters. This property can contain only characters in the ASCII character set 0 - 127 except the following characters: `@ () \ [] " ; : <> , SPACE`. Required. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
membershipRule	String	The rule that determines members for this group if the group is a dynamic group (groupTypes contains `DynamicMembership`). For more information about the syntax of the membership rule, see Membership Rules syntax. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `startsWith`).
membershipRuleProcessingState	String	Indicates whether the dynamic membership processing is on or paused. Possible values are `On` or `Paused`. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `in`).
onPremisesDomainName	String	Contains the on-premises domain FQDN, also called dnsDomainName synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Returned by default. Read-only.
onPremisesExtensionAttributes	onPremisesExtensionAttributes	Complex type containing extension attributes 1-15 for the group, synchronized from on-premises Active Directory. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `in`).
onPremisesLastSyncDateTime	DateTimeOffset	Indicates the last time at which the group was synced with the on-premises directory. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on January 1, 2014 is `2014-01-01T00:00:00Z`. Returned by default. Read-only. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`).
onPremisesNetBiosName	String	Contains the on-premises netBios name synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Returned by default. Read-only.
onPremisesProvisioningErrors	onPremisesProvisioningError collection	Errors when using Microsoft synchronization product during provisioning. Returned by default. Supports `$filter` (`eq`, `not`).
onPremisesSamAccountName	String	Contains the on-premises SAM account name synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`). Read-only.
onPremisesSecurityIdentifier	String	Contains the on-premises security identifier (SID) for the group synchronized from on-premises to the cloud. Read-only. Returned by default. Supports `$filter` (`eq` including on `null` values).
onPremisesSyncEnabled	Boolean	`true` if this group is synced from an on-premises directory; `false` if this group was originally synced from an on-premises directory but is no longer synced; null if this object has never synced from an on-premises directory (default). Returned by default. Read-only. Supports `$filter` (`eq`, `ne`, `not`, `in`, and `eq` on `null` values).
preferredDataLocation	String	The preferred data location for the Microsoft 365 group. By default, the group inherits the group creator's preferred data location. To set this property, the calling app must be granted the Directory.ReadWrite.All permission and the user be assigned at least one of the following Microsoft Entra roles: User Account Administrator Directory Writer Exchange Administrator SharePoint Administrator For more information about this property, see OneDrive Online Multi-Geo. Nullable. Returned by default.
preferredLanguage	String	The preferred language for a Microsoft 365 group. Should follow ISO 639-1 Code; for example, `en-US`. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
proxyAddresses	String collection	Email addresses for the group that direct to the same group mailbox. For example: `["SMTP: [email protected]", "smtp: [email protected]"]`. The any operator is required to filter expressions on multi-valued properties. Returned by default. Read-only. Not nullable. Supports `$filter` (`eq`, `not`, `ge`, `le`, `startsWith`, `endsWith`, `/$count eq 0`, `/$count ne 0`).
renewedDateTime	DateTimeOffset	Timestamp of when the group was last renewed. This value can't be modified directly and is only updated via the renew service action. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on January 1, 2014 is `2014-01-01T00:00:00Z`. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`). Read-only.
resourceBehaviorOptions	String collection	Specifies the group behaviors that can be set for a Microsoft 365 group during creation. This property can be set only as part of creation (POST). For the list of possible values, see Microsoft 365 group behaviors and provisioning options.
resourceProvisioningOptions	String collection	Specifies the group resources that are associated with the Microsoft 365 group. The possible value is `Team`. For more information, see Microsoft 365 group behaviors and provisioning options. Returned by default. Supports `$filter` (`eq`, `not`, `startsWith`).
securityEnabled	Boolean	Specifies whether the group is a security group. Required. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `in`).
securityIdentifier	String	Security identifier of the group, used in Windows scenarios. Read-only. Returned by default.
serviceProvisioningErrors	serviceProvisioningError collection	Errors published by a federated service describing a nontransient, service-specific error regarding the properties or link from a group object. Supports `$filter` (`eq`, `not`, for isResolved and serviceInstance).
theme	string	Specifies a Microsoft 365 group's color theme. Possible values are `Teal`, `Purple`, `Green`, `Blue`, `Pink`, `Orange`, or `Red`. Returned by default.
uniqueName	String	The unique identifier that can be assigned to a group and used as an alternate key. Immutable. Read-only.
unseenConversationsCount	Int32	Count of conversations that have had one or more new posts delivered since the signed-in user's last visit to the group. This property is the same as unseenCount. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
unseenCount	Int32	Count of conversations that have received new posts since the signed-in user last visited the group. This property is the same as unseenConversationsCount. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
unseenMessagesCount	Int32	Count of new posts that have been delivered to the group's conversations since the signed-in user's last visit to the group. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
visibility	String	Specifies the group join policy and group content visibility for groups. The possible values are: `Private`, `Public`, or `HiddenMembership`. `HiddenMembership` can be set only for Microsoft 365 groups when the groups are created. It can't be updated later. Other values of visibility can be updated after group creation. If visibility value isn't specified during group creation on Microsoft Graph, a security group is created as `Private` by default, and the Microsoft 365 group is `Public`. Groups assignable to roles are always `Private`. To learn more, see group visibility options. Returned by default. Nullable.

Graph reference: privilegedAccessGroupAssignmentScheduleRequest

Property	Type	Description
accessId	privilegedAccessGroupRelationships	The identifier of a membership or ownership assignment relationship to the group. Required. The possible values are: `owner`, `member`, `unknownFutureValue`.
action	String	Represents the type of operation on the group membership or ownership assignment request. The possible values are: `adminAssign`, `adminUpdate`, `adminRemove`, `selfActivate`, `selfDeactivate`, `adminExtend`, `adminRenew`. `adminAssign`: For administrators to assign group membership or ownership to principals. `adminRemove`: For administrators to remove principals from group membership or ownership. `adminUpdate`: For administrators to change existing group membership or ownership assignments. `adminExtend`: For administrators to extend expiring assignments. `adminRenew`: For administrators to renew expired assignments. `selfActivate`: For principals to activate their assignments. `selfDeactivate`: For principals to deactivate their active assignments.
approvalId	String	The identifier of the approval of the request. Inherited from request.
completedDateTime	DateTimeOffset	The request completion date time. Inherited from request.
createdBy	identitySet	The principal that created this request. Inherited from request. Read-only. Supports `$filter` (`eq`, `ne`, and on `null` values).
createdDateTime	DateTimeOffset	The request creation date time. Inherited from request. Read-only.
customData	String	Free text field to define any custom data for the request. Not used. Inherited from request.
groupId	String	The identifier of the group representing the scope of the membership or ownership assignment through PIM for Groups. Required.
id	String	The unique identifier for the privilegedAccessGroupAssignmentScheduleRequest object. Key, not nullable, Read-only. Inherited from entity. Supports `$filter` (`eq`, `ne`).
isValidationOnly	Boolean	Determines whether the call is a validation or an actual call. Only set this property if you want to check whether an activation is subject to additional rules like MFA before actually submitting the request.
justification	String	A message provided by users and administrators when they create the privilegedAccessGroupAssignmentScheduleRequest object.
principalId	String	The identifier of the principal whose membership or ownership assignment to the group is managed through PIM for Groups. Supports `$filter` (`eq`, `ne`).
scheduleInfo	requestSchedule	The period of the group membership or ownership assignment. Recurring schedules are currently unsupported.
status	String	The status of the group membership or ownership assignment request. Inherited from request. Read-only. Supports `$filter` (`eq`, `ne`).
targetScheduleId	String	The identifier of the schedule that's created from the membership or ownership assignment request. Supports `$filter` (`eq`, `ne`).
ticketInfo	ticketInfo	Ticket details linked to the group membership or ownership assignment request including details of the ticket number and ticket system.

Graph reference: unifiedRoleAssignment

Property	Type	Description
appScopeId	String	Identifier of the app specific scope when the assignment scope is app specific. The scope of an assignment determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by a resource application only. For the entitlement management provider, use this property to specify a catalog. For example, `/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997`. Supports `$filter` (`eq`, `in`). For example, `/roleManagement/entitlementManagement/roleAssignments?$filter=appScopeId eq '/AccessPackageCatalog/{catalog id}'`.
directoryScopeId	String	Identifier of the directory object representing the scope of the assignment. The scope of an assignment determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications, unlike app scopes that are defined and understood by a resource application only. Supports `$filter` (`eq`, `in`).
id	String	The unique identifier for the unifiedRoleAssignment. Key, not nullable, Read-only.
principalId	String	Identifier of the principal to which the assignment is granted. Supported principals are users, role-assignable groups, and service principals. Supports `$filter` (`eq`, `in`).
roleDefinitionId	String	Identifier of the unifiedRoleDefinition the assignment is for. Read-only. Supports `$filter` (`eq`, `in`).

Graph reference: unifiedRoleAssignmentScheduleRequest

Property	Type	Description
action	String	Represents the type of the operation on the role assignment request. The possible values are: `adminAssign`, `adminUpdate`, `adminRemove`, `selfActivate`, `selfDeactivate`, `adminExtend`, `adminRenew`, `selfExtend`, `selfRenew`, `unknownFutureValue`. `adminAssign`: For administrators to assign roles to principals. `adminRemove`: For administrators to remove principals from roles. `adminUpdate`: For administrators to change existing role assignments. `adminExtend`: For administrators to extend expiring assignments. `adminRenew`: For administrators to renew expired assignments. `selfActivate`: For principals to activate their assignments. `selfDeactivate`: For principals to deactivate their active assignments. `selfExtend`: For principals to request to extend their expiring assignments. `selfRenew`: For principals to request to renew their expired assignments.
approvalId	String	The identifier of the approval of the request. Inherited from request.
appScopeId	String	Identifier of the app-specific scope when the assignment is scoped to an app. The scope of an assignment determines the set of resources for which the principal has been granted access. App scopes are scopes that are defined and understood by this application only. Use `/` for tenant-wide app scopes. Use directoryScopeId to limit the scope to particular directory objects, for example, administrative units. Supports `$filter` (`eq`, `ne`, and on `null` values).
completedDateTime	DateTimeOffset	The request completion date time. Inherited from request.
createdBy	identitySet	The principal that created this request. Inherited from request. Read-only. Supports `$filter` (`eq`, `ne`, and on `null` values).
createdDateTime	DateTimeOffset	The request creation date time. Inherited from request. Read-only.
customData	String	Free text field to define any custom data for the request. Not used. Inherited from request.
directoryScopeId	String	Identifier of the directory object representing the scope of the assignment. The scope of an assignment determines the set of resources for which the principal has been granted access. Directory scopes are shared scopes stored in the directory that are understood by multiple applications. Use `/` for tenant-wide scope. Use appScopeId to limit the scope to an application only. Supports `$filter` (`eq`, `ne`, and on `null` values).
id	String	The unique identifier for the unifiedRoleAssignmentScheduleRequest object. Key, not nullable, Read-only. Inherited from entity. Supports `$filter` (`eq`, `ne`).
isValidationOnly	Boolean	Determines whether the call is a validation or an actual call. Only set this property if you want to check whether an activation is subject to additional rules like MFA before actually submitting the request.
justification	String	A message provided by users and administrators when create they create the unifiedRoleAssignmentScheduleRequest object.
principalId	String	Identifier of the principal that has been granted the assignment. Can be a user, role-assignable group, or a service principal. Supports `$filter` (`eq`, `ne`).
roleDefinitionId	String	Identifier of the unifiedRoleDefinition object that is being assigned to the principal. Supports `$filter` (`eq`, `ne`).
scheduleInfo	requestSchedule	The period of the role assignment. Recurring schedules are currently unsupported.
status	String	The status of the role assignment request. Inherited from request. Read-only. Supports `$filter` (`eq`, `ne`).
targetScheduleId	String	Identifier of the schedule object that's linked to the assignment request. Supports `$filter` (`eq`, `ne`).
ticketInfo	ticketInfo	Ticket details linked to the role assignment request including details of the ticket number and ticket system.

Graph reference: unifiedRoleDefinition

Property	Type	Description
description	String	The description for the unifiedRoleDefinition. Read-only when isBuiltIn is `true`.
displayName	String	The display name for the unifiedRoleDefinition. Read-only when isBuiltIn is `true`. Required. Supports $filter (`eq`, `in`).
id	String	The unique identifier for the role definition. Key, not nullable, Read-only. Inherited from entity. Supports $filter (`eq`, `in`).
isBuiltIn	Boolean	Flag indicating whether the role definition is part of the default set included in Microsoft Entra or a custom definition. Read-only. Supports $filter (`eq`, `in`).
isEnabled	Boolean	Flag indicating whether the role is enabled for assignment. If `false` the role is not available for assignment. Read-only when isBuiltIn is true.
resourceScopes	String collection	List of the scopes or permissions the role definition applies to. Currently only `/` is supported. Read-only when isBuiltIn is true. DO NOT USE. This will be deprecated soon. Attach scope to role assignment.
rolePermissions	unifiedRolePermission collection	List of permissions included in the role. Read-only when isBuiltIn is `true`. Required.
templateId	String	Custom template identifier that can be set when isBuiltIn is `false` but is read-only when isBuiltIn is `true`. This identifier is typically used if one needs an identifier to be the same across different directories.
version	String	Indicates version of the role definition. Read-only when **i

Table of Contents

EntitlementManagement.Read.All

Graph Methods

Resources