Policy.ReadWrite.AccessReview

Allows the app to read and write your organization's directory access review default policy on behalf of the signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the Policy.ReadWrite.AccessReview permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	77c863fd-06c0-47ce-a7eb-49773e89d319	4f5bc9c8-ea54-4772-973a-9ca119cb0409
DisplayText	Read and write your organization's directory access review default policy	Read and write your organization's directory access review default policy
Description	Allows the app to read and write your organization's directory access review default policy without a signed-in user.	Allows the app to read and write your organization's directory access review default policy on behalf of the signed-in user.
AdminConsentRequired	Yes	Yes

Graph Methods

• API [v1.0]
• API [beta]
• PowerShell [v1.0]
• PowerShell [beta]

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

• accessReviewPolicy

Graph reference: accessReviewPolicy

Property	Type	Description
description	String	Description for this policy. Read-only.
displayName	String	Display name for this policy. Read-only.
isGroupOwnerManagementEnabled	Boolean	If true, group owners can create and manage access reviews on groups they own.