LifecyclePolicies-AgentId.ReadWrite.All

Allows the app to read, create, update and delete identity lifecycle policies for agent identities that the signed-in user has access to in the organization.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the LifecyclePolicies-AgentId.ReadWrite.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	00d1c504-8dc7-461b-8a0b-dc15c8f1bd5a	f2292ca5-46fc-4195-9b4d-16491bf9bf7f
DisplayText	Read and write identity lifecycle policies for agent identities	Read and write identity lifecycle policies for agent identities
Description	Allows the app to read, create, update and delete identity lifecycle policies for agent identities in the organization, without a signed-in user.	Allows the app to read, create, update and delete identity lifecycle policies for agent identities that the signed-in user has access to in the organization.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /identityGovernance/lifecycleWorkflows/lifecyclePolicies/{lifecyclePolicyId}
	GET /identityGovernance/lifecycleWorkflows/lifecyclePolicies
	GET /identityGovernance/lifecycleWorkflows/lifecyclePolicies/{lifecyclePolicyId}
	GET /identityGovernance/lifecycleWorkflows/lifecyclePolicies/{lifecyclePolicyId}/impact(startDateTime={startDateTime},endDateTime={endDateTime})
	GET /identityGovernance/lifecycleWorkflows/lifecyclePolicies/{lifecyclePolicyId}/report
	GET /identityGovernance/lifecycleWorkflows/lifecyclePolicies/{lifecyclePolicyId}/report/subjects
	GET /identityGovernance/lifecycleWorkflows/lifecyclePolicies/{lifecyclePolicyId}/rules
	GET /identityGovernance/lifecycleWorkflows/lifecyclePolicies/{lifecyclePolicyId}/rules/{lifecyclePolicyRuleId}
	GET /identityGovernance/lifecycleWorkflows/lifecyclePolicyPriorityConfigurations
	GET /identityGovernance/lifecycleWorkflows/lifecyclePolicyPriorityConfigurations/{subjectType}
	PATCH /identityGovernance/lifecycleWorkflows/lifecyclePolicies/{lifecyclePolicyId}
	PATCH /identityGovernance/lifecycleWorkflows/lifecyclePolicies/{lifecyclePolicyId}/rules/{lifecyclePolicyRuleId}
	PATCH /identityGovernance/lifecycleWorkflows/lifecyclePolicyPriorityConfigurations/{subjectType}
	POST /identityGovernance/lifecycleWorkflows/deletedItems/lifecyclePolicies/{lifecyclePolicyId}/restore
	POST /identityGovernance/lifecycleWorkflows/lifecyclePolicies

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: agentIdentityLifecyclePolicy

Property	Type	Description
createdDateTime	DateTimeOffset	The date and time when the policy was created. Inherited from lifecyclePolicy.
description	String	The description of the policy. Inherited from lifecyclePolicy.
displayName	String	The display name of the policy. Inherited from lifecyclePolicy.
enforcementAction	microsoft.graph.identityGovernance.lifecyclePolicyEnforcementAction	The action taken when an agent identity governed by the policy becomes non-compliant. Inherited from lifecyclePolicy.
gracePeriodInDays	Int32	The number of days after an identity becomes non-compliant before the enforcement action is applied. Inherited from lifecyclePolicy.
id	String	The unique identifier for the policy. Inherited from entity.
isEnabled	Boolean	Indicates whether the policy is enabled and actively evaluated. Inherited from lifecyclePolicy.
lastModifiedDateTime	DateTimeOffset	The date and time when the policy was last modified. Inherited from lifecyclePolicy.
notificationSchedule	microsoft.graph.identityGovernance.lifecyclePolicyNotificationSettings	The notification settings for the policy, including the offsets, in days after non-compliance, at which notifications are sent. Inherited from lifecyclePolicy.
policySource	microsoft.graph.identityGovernance.lifecyclePolicySource	Indicates whether the policy is system-managed (a built-in default) or created by an administrator. Inherited from lifecyclePolicy. The possible values are: `userCreated`, `systemDefault`, `unknownFutureValue`.
scope	subjectSet	The set of agent identities that the policy applies to. Inherited from lifecyclePolicy.
versionNumber	Int32	The version number of the policy, which increments each time the policy is updated. Inherited from lifecyclePolicy.

Graph reference: lifecyclePolicy

Property	Type	Description
createdDateTime	DateTimeOffset	The date and time when the policy was created.
description	String	The description of the policy.
displayName	String	The display name of the policy.
enforcementAction	microsoft.graph.identityGovernance.lifecyclePolicyEnforcementAction	The action taken when an identity governed by the policy becomes non-compliant. This is a polymorphic type; the possible types are deleteOnlyEnforcementAction, disableOnlyEnforcementAction, and disableThenDeleteEnforcementAction.
gracePeriodInDays	Int32	The number of days after an identity becomes non-compliant before the enforcement action is applied.
id	String	The unique identifier for the policy. Inherited from entity.
isEnabled	Boolean	Indicates whether the policy is enabled and actively evaluated.
lastModifiedDateTime	DateTimeOffset	The date and time when the policy was last modified.
notificationSchedule	microsoft.graph.identityGovernance.lifecyclePolicyNotificationSettings	The notification settings for the policy, including the offsets, in days after non-compliance, at which notifications are sent.
policySource	microsoft.graph.identityGovernance.lifecyclePolicySource	Indicates whether the policy is system-managed (a built-in default) or created by an administrator. The possible values are: `userCreated`, `systemDefault`, `unknownFutureValue`.
scope	subjectSet	The set of subjects that the policy applies to. For example, use an allExcludingGroupsSubjectSet to exclude specific groups from evaluation.
versionNumber	Int32	The version number of the policy, which increments each time the policy is updated.

Graph reference: lifecyclePolicyImpactSummary

Property	Type	Description
actionsTaken	microsoft.graph.identityGovernance.lifecyclePolicyImpactAction collection	The policy actions taken for the subject during the evaluation period.
id	String	The unique identifier for the impact result. Inherited from entity.

Graph reference: lifecyclePolicyNotificationSettings

Property	Type	Description
additionalFallbackRecipients	String collection	The email addresses used when no targeted notification recipient has a valid email address. These addresses aren't copied on every notification or used alongside a valid targeted recipient.
offsetsAfterNonComplianceInDays	Int32 collection	The offsets, in days after an identity becomes non-compliant, at which notifications are sent.

Graph reference: lifecyclePolicyPriorityConfiguration

Property	Type	Description
id	String	The unique identifier for the priority configuration, which corresponds to the subject type that the configuration applies to. Inherited from entity.
orderedPolicyIds	String collection	The identifiers of the lifecycle policies in evaluation priority order. The first policy in the collection has the highest priority. A maximum of 10 policies are allowed per subject type.
subjectType	microsoft.graph.identityGovernance.subjectType	The subject type that the lifecycle policies in this configuration apply to. The possible values are: `user`, `agentIdentity`, `unknownFutureValue`, `provisioningObject`. Use the `Prefer: include-unknown-enum-members` request header to get the `provisioningObject` value in this evolvable enum. Immutable.

Graph reference: lifecyclePolicyReport

Property	Type	Description
id	String	The unique identifier for the report. Inherited from entity.
policyVersion	Int32	The version of the lifecycle policy represented by the report.
scopeProcessing	microsoft.graph.identityGovernance.lifecyclePolicyScopeProcessing	The current and latest scope-processing status for the policy.
subjectsInScopeCount	Int32	The number of subjects currently in scope for the policy.

Graph reference: lifecyclePolicyRule

Property	Type	Description
id	String	The unique identifier for the rule. Inherited from entity.
isEnabled	Boolean	Indicates whether the rule is enabled and evaluated as part of its policy.

Graph reference: lifecyclePolicySubjectReport

Property	Type	Description
compliance	microsoft.graph.identityGovernance.lifecyclePolicySubjectCompliance	The subject's compliance status and the date and time when it was evaluated.
effectivePolicy	microsoft.graph.identityGovernance.lifecyclePolicyReference	A reference to the effective lifecycle policy for the subject.
enforcement	microsoft.graph.identityGovernance.lifecyclePolicySubjectEnforcement	The subject's enforcement status and action schedule.
id	String	The unique identifier for the subject report. Inherited from entity.
relationship	microsoft.graph.identityGovernance.lifecyclePolicyRelationship	The relationship between this policy and the subject. The possible values are: `effective`, `inScopeButIneffective`, `pending`, `unknownFutureValue`.
subject	microsoft.graph.identityGovernance.lifecyclePolicySubjectReference	The subject represented by this result.

Property	Type	Description
id	String	Identifier used for individually addressing the lifecycle workflows objects. Inherited from entity.

Graph reference: periodicAttestationRule

Property	Type	Description
attestationIntervalInDays	Int32	The number of days within which an identity must be attested to remain compliant with the rule.
id	String	The unique identifier for the rule. Inherited from entity.
isEnabled	Boolean	Indicates whether the rule is enabled and evaluated as part of its policy. Inherited from lifecyclePolicyRule.

Table of Contents

LifecyclePolicies-AgentId.ReadWrite.All

Graph Methods

Resources