EntitlementMgmt-SubjectAccess.ReadWrite

Allows the app to manage self-service entitlement management resources on behalf of the signed-in user. This includes operations such as requesting access and approving access of others.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the EntitlementMgmt-SubjectAccess.ReadWrite permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	-	e9fdcbbb-8807-410f-b9ec-8d5468c7c2ac
DisplayText	-	Read and write entitlement management resources related to self-service operations
Description	-	Allows the app to manage self-service entitlement management resources on behalf of the signed-in user. This includes operations such as requesting access and approving access of others.
AdminConsentRequired	Yes	No

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /identityGovernance/entitlementManagement/accessPackages/filterByCurrentUser(on='allowedRequestor')
	GET /identityGovernance/entitlementManagement/accessPackageSuggestions/filterByCurrentUser(on='{on}')
	GET /identityGovernance/entitlementManagement/assignmentRequests/filterByCurrentUser(on='parameterValue')
	GET /identityGovernance/entitlementManagement/assignments/filterByCurrentUser(on='parameterValue')
	GET /identityGovernance/entitlementManagement/availableAccessPackages/{availableAccessPackage-id}/resourceRoleScopes
	POST /identityGovernance/entitlementManagement/accessPackages/{accessPackageId}/getApplicablePolicyRequirements
	POST /identityGovernance/entitlementManagement/assignmentRequests
	POST /identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequestId}/cancel

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /identityGovernance/entitlementManagement/accessPackageAssignmentRequests/filterByCurrentUser(on='parameterValue')
	GET /identityGovernance/entitlementManagement/accessPackageAssignments/filterByCurrentUser(on='parameterValue')
	GET /identityGovernance/entitlementManagement/accessPackages/filterByCurrentUser(on='allowedRequestor')
	GET /identityGovernance/entitlementManagement/accessPackageSuggestions/filterByCurrentUser(on={on})
	GET /identityGovernance/entitlementManagement/assignmentRequests/filterByCurrentUser(on='parameterValue')
	GET /identityGovernance/entitlementManagement/availableAccessPackages/{availableAccessPackage-id}/resourceRoleScopes
	POST /identityGovernance/entitlementManagement/accessPackageAssignmentRequests
	POST /identityGovernance/entitlementManagement/accessPackageAssignmentRequests/{id}/cancel
	POST /identityGovernance/entitlementManagement/accessPackages/{id}/getApplicablePolicyRequirements
	POST /identityGovernance/entitlementManagement/assignmentRequests
	POST /identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequestId}/cancel

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgEntitlementManagementAccessPackageApplicablePolicyRequirement
	Invoke-MgFilterEntitlementManagementAccessPackageByCurrentUser
	Invoke-MgFilterEntitlementManagementAssignmentByCurrentUser
	Invoke-MgFilterEntitlementManagementAssignmentRequestByCurrentUser
	New-MgEntitlementManagementAssignmentRequest
	Stop-MgEntitlementManagementAssignmentRequest

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaEntitlementManagementAccessPackageApplicablePolicyRequirement
	Get-MgBetaEntitlementManagementAvailableAccessPackageResourceRoleScope
	Invoke-MgBetaFilterEntitlementManagementAccessPackageAssignmentByCurrentUser
	Invoke-MgBetaFilterEntitlementManagementAccessPackageAssignmentRequestByCurrentUser
	Invoke-MgBetaFilterEntitlementManagementAccessPackageByCurrentUser
	Invoke-MgBetaFilterEntitlementManagementAccessPackageSuggestionByCurrentUser
	New-MgBetaEntitlementManagementAccessPackageAssignmentRequest
	New-MgBetaEntitlementManagementAssignmentRequest
	Stop-MgBetaEntitlementManagementAccessPackageAssignmentRequest

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: accessPackage

Property	Type	Description
createdDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
description	String	The description of the access package.
displayName	String	Required. The display name of the access package. Supports $filter (`eq`, `contains`).
id	String	Read-only.
isHidden	Boolean	Indicates whether the access package is hidden from the requestor.
modifiedDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.

Graph reference: accessPackageAssignment

Property	Type	Description
customExtensionCalloutInstances	customExtensionCalloutInstance collection	Information about all the custom extension calls that were made during the access package assignment workflow.
expiredDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
id	String	Read-only.
schedule	entitlementManagementSchedule	When the access assignment is to be in place. Read-only.
state	accessPackageAssignmentState	The state of the access package assignment. The possible values are: `delivering`, `partiallyDelivered`, `delivered`, `expired`, `deliveryFailed`, `unknownFutureValue`. Read-only. Supports `$filter` (`eq`).
status	String	More information about the assignment lifecycle. Possible values include `Delivering`, `Delivered`, `AutoAssignmentInGracePeriod`, `NearExpiry1DayNotificationTriggered`, or `ExpiredNotificationTriggered`. Read-only.

Graph reference: accessPackageAssignmentPolicy

Property	Type	Description
accessPackageNotificationSettings	accessPackageNotificationSettings	Represents the settings for email notifications for requests to an access package.
allowedTargetScope	allowedTargetScope	Principals that can be assigned the access package through this policy. The possible values are: `notSpecified`, `specificDirectoryUsers`, `specificConnectedOrganizationUsers`, `specificDirectoryServicePrincipals`, `allMemberUsers`, `allDirectoryUsers`, `allDirectoryServicePrincipals`, `allConfiguredConnectedOrganizationUsers`, `allExternalUsers`, `allDirectoryAgentIdentities`, `unknownFutureValue`.
automaticRequestSettings	accessPackageAutomaticRequestSettings	This property is only present for an auto assignment policy; if absent, this is a request-based policy.
createdDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.
description	String	The description of the policy.
displayName	String	The display name of the policy.
expiration	expirationPattern	The expiration date for assignments created in this policy.
id	String	Read-only.
modifiedDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.
requestApprovalSettings	accessPackageAssignmentApprovalSettings	Specifies the settings for approval of requests for an access package assignment through this policy. For example, if approval is required for new requests.
requestorSettings	accessPackageAssignmentRequestorSettings	Provides additional settings to select who can create a request for an access package assignment through this policy, and what they can include in their request.
reviewSettings	accessPackageAssignmentReviewSettings	Settings for access reviews of assignments through this policy.
specificAllowedTargets	subjectSet collection	The principals that can be assigned access from an access package through this policy.

Graph reference: accessPackageAssignmentRequest

Property	Type	Description
answers	accessPackageAnswer collection	Answers provided by the requestor to accessPackageQuestions asked of them at the time of request.
completedDateTime	DateTimeOffset	The date of the end of processing, either successful or failure, of a request. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
customExtensionCalloutInstances	customExtensionCalloutInstance collection	Information about all the custom extension calls that were made during the access package assignment workflow.
createdDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only. Supports `$filter`.
id	String	Read-only.
justification	String	The requestor's supplied justification.
requestType	accessPackageRequestType	The type of the request. The possible values are: `notSpecified`, `userAdd`, `userUpdate`, `userRemove`, `adminAdd`, `adminUpdate`, `adminRemove`, `systemAdd`, `systemUpdate`, `systemRemove`, `onBehalfAdd` (not supported), `unknownFutureValue`. Use the `Prefer: include-unknown-enum-members` request header to get the following values in this evolvable enum: `approverRemove`. Requests from the user have a requestType of `userAdd`, `userUpdate`, or `userRemove`. This property can't be changed once set.
schedule	entitlementManagementSchedule	The range of dates that access is to be assigned to the requestor. This property can't be changed once set, but a new schedule for an assignment can be included in another `userUpdate` or `adminUpdate` assignment request.
state	accessPackageRequestState	The state of the request. The possible values are: `submitted`, `pendingApproval`, `delivering`, `delivered`, `deliveryFailed`, `denied`, `scheduled`, `canceled`, `partiallyDelivered`, `unknownFutureValue`. Read-only. Supports `$filter` (`eq`).
status	String	More information on the request processing status. Read-only.

Graph reference: accessPackageAssignmentRequestRequirements

Property	Type	Description
allowCustomAssignmentSchedule	Boolean	Indicates whether the requestor is allowed to set a custom schedule.
isApprovalRequiredForAdd	Boolean	Indicates whether a request to add must be approved by an approver.
isApprovalRequiredForUpdate	Boolean	Indicates whether a request to update must be approved by an approver.
isRequestorJustificationRequired	Boolean	Indicates whether requestors must justify requesting access to an access package.
policyDescription	String	The description of the policy that the user is trying to request access using.
policyDisplayName	String	The display name of the policy that the user is trying to request access using.
policyId	String	The identifier of the policy that these requirements are associated with. This identifier can be used when creating a new assignment request.
questions	accessPackageQuestion collection	Questions that are configured on the policy. The questions can be required or optional; callers can determine whether a question is required or optional based on the isRequired property on accessPackageQuestion.
schedule	entitlementManagementSchedule	Schedule restrictions enforced, if any.

Graph reference: accessPackageResourceRoleScope

Property	Type	Description
createdDateTime	DateTimeOffset	The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`
id	String	Read-only.

Graph reference: accessPackageSubject

Property	Type	Description
displayName	String	The display name of the subject.
email	String	The email address of the subject.
id	String	This property shouldn't be used as a dependency, as it could change without notice. Instead, use the objectId property.
objectId	String	The object identifier of the subject. `null` if the subject isn't yet a user in the tenant.
onPremisesSecurityIdentifier	String	A string representation of the principal's security identifier, if known, or `null` if the subject doesn't have a security identifier.
principalName	String	The principal name, if known, of the subject.
subjectLifecycle	accessPackageSubjectLifecycle	The lifecycle of the subject user, if a guest. The possible values are: `notDefined`, `notGoverned`, `governed`, `unknownFutureValue`.
subjectType	accessPackageSubjectType	The resource type of the subject. The possible values are: `notSpecified`, `user`, `servicePrincipal`, `unknownFutureValue`.

Graph reference: accessPackageSuggestion

Property	Type	Description
id	String	The identifier of the suggested access package. Read-only.
reasons	Collection(accessPackageSuggestionReason)	A collection of reasons why this access package is being suggested to the user.

Graph reference: availableAccessPackage

Property	Type	Description
description	String	The description of the access package.
displayName	String	The display name of the access package.
id	String	Identifier of the access package. Read-only.

Table of Contents

EntitlementMgmt-SubjectAccess.ReadWrite

Graph Methods

Resources