Microsoft Entra ID (formerly Azure AD) Identity Governance.entitlement Management API
The identityGovernance.entitlementManagement API from Microsoft Entra ID (formerly Azure AD) — 737 operation(s) for identitygovernance.entitlementmanagement.
Operations 1265
Showing the first 250 of 1265. The full set is in the contract, and via get_provider_operations.
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
GET
/identityGovernance/entitlementManagement
Read the entitlement management container · Get entitlementManagement from identityGovernance
#
Ask an LLM
“What does the entitlement management root object in Microsoft Entra identity governance contain?”
“Can I expand the top-level entitlement management node to see its catalogs and access packages together?”
Tell an agent
Fetch the entitlement management root for my tenant.
Show the top-level entitlement management object with its settings expanded.
PATCH
/identityGovernance/entitlementManagement
Update the entitlement management container · Update the navigation property entitlementManagement in identityGovernance
#
Ask an LLM
“Can I patch the entitlement management root object directly?”
“Which top-level entitlement management properties, like its settings, can be changed in one update?”
Tell an agent
Patch the entitlement management root with new settings {settings}.
Update the top-level entitlement management object in identity governance.
DELETE
/identityGovernance/entitlementManagement
Delete the entitlement management container · Delete navigation property entitlementManagement for identityGovernance
#
Ask an LLM
“Is it possible to remove the whole entitlement management navigation property from identity governance?”
“What happens if I delete the entitlement management root node itself?”
Tell an agent destructive · confirm first
Delete the entitlement management container from identity governance.
Remove the top-level entitlement management node entirely.
GET
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals
List access package assignment approvals · Get approval
#
Ask an LLM
“Which access package assignment approvals exist in entitlement management?”
“Can I page through every assignment approval record with a filter?”
Tell an agent
List all access package assignment approvals.
Show the assignment approvals, newest first, top 20.
POST
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals
Create an assignment approval record · Create new navigation property to accessPackageAssignmentApprovals for…
#
Ask an LLM
“Can I add a new approval object under access package assignment approvals?”
“What fields, like stages, go into a newly created assignment approval?”
Tell an agent
Create an assignment approval with stages {stages}.
Add a new access package assignment approval record.
GET
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{approval-id}
Get an assignment approval by ID · Get approval
#
Ask an LLM
“How do I look up one approval using the ID of an access package assignment request?”
“What properties does a single assignment approval object expose?”
Tell an agent
Get approval {approval} for the access package request.
Show me the details of assignment approval {approval}.
PATCH
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{approval-id}
Update an assignment approval · Update the navigation property accessPackageAssignmentApprovals in…
#
Ask an LLM
“Can I patch an existing assignment approval object, for example its stages?”
“Is it possible to overwrite the stages list on one approval record?”
Tell an agent
Update approval {approval} with stages {stages}.
Patch assignment approval {approval}.
DELETE
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{approval-id}
Delete an assignment approval · Delete navigation property accessPackageAssignmentApprovals for…
#
Ask an LLM
“Can an access package assignment approval object be deleted?”
“What is removed when I delete one assignment approval entry?”
Tell an agent destructive · confirm first
Delete assignment approval {approval}.
Remove the approval record {approval} from entitlement management.
GET
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{approval-id}/stages
List the stages of an approval · List approval stages
#
Ask an LLM
“Which approval stages belong to a given access package approval?”
“How can an approver see every stage in a multi-stage approval?”
Tell an agent
List the stages of approval {approval}.
Show all approval stages for request approval {approval}.
POST
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{approval-id}/stages
Add a stage to an approval · Create new navigation property to stages for identityGovernance
#
Ask an LLM
“Can I add another stage object to an existing approval?”
“What does a new approval stage need, such as a display name or status?”
Tell an agent
Add a stage named {name} to approval {approval}.
Create a new stage on approval {approval} with status {status}.
GET
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{approval-id}/stages/{approvalStage-id}
Get one stage of an approval · Get approvalStage
#
Ask an LLM
“How do I check who reviewed a specific stage of an approval and when?”
“What does a single approval stage record show about its review result?”
Tell an agent
Get stage {stage} of approval {approval}.
Show the reviewer and result for approval stage {stage} in approval {approval}.
PATCH
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{approval-id}/stages/{approvalStage-id}
Approve or deny an approval stage · Update approvalStage
#
Ask an LLM
“How do I approve or deny an access package request as an approver?”
“Do I have to give a justification when I deny a stage of an approval?”
Tell an agent
Approve stage {stage} of approval {approval} with justification {justification}.
Set the review result on stage {stage} of approval {approval} to {result}.
DELETE
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{approval-id}/stages/{approvalStage-id}
Delete a stage from an approval · Delete navigation property stages for identityGovernance
#
Ask an LLM
“Can one stage be removed from an approval object?”
“What happens to an approval when I delete one of its stages?”
Tell an agent destructive · confirm first
Delete stage {stage} from approval {approval}.
Remove approval stage {stage} under approval {approval}.
GET
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{approval-id}/stages/$count
Count the stages of an approval · Get the number of the resource
#
Ask an LLM
“How many stages does a particular approval have?”
“Can I get just the number of approval stages without listing them?”
Tell an agent
Count the stages in approval {approval}.
Tell me how many stages approval {approval} has.
GET
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/$count
Count access package assignment approvals · Get the number of the resource
#
Ask an LLM
“How many access package assignment approvals are there in total?”
“Is there a quick way to get the total number of assignment approval records?”
Tell an agent
Count all access package assignment approvals.
Give me the total number of assignment approval objects.
GET
/identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/microsoft.graph.filterByCurrentUser(on='{on}')
List approvals awaiting my decision · Invoke function filterByCurrentUser
#
Ask an LLM
“Which access package requests are waiting for me to approve?”
“Can I see only the approvals that are in scope for me as the signed-in approver?”
Tell an agent
List the approvals where I am the {on}.
Show assignment approvals filtered to the current user as {on}.
GET
/identityGovernance/entitlementManagement/accessPackages
List access packages · List accessPackages
#
Ask an LLM
“What access packages have been set up in my Entra tenant?”
“Can I filter the access package list by display name or catalog?”
Tell an agent
List all access packages in entitlement management.
Show access packages whose name contains Marketing.
POST
/identityGovernance/entitlementManagement/accessPackages
Create an access package · Create accessPackage
#
Ask an LLM
“How do I create a new access package in an existing catalog?”
“Can a new access package be hidden from requestors when I create it?”
Tell an agent
Create an access package called {name} in catalog {catalog}.
Create access package {name} with description {description} in catalog {catalog}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}
Get an access package · Get accessPackage
#
Ask an LLM
“Where can I read the properties and relationships of a single access package?”
“Can I expand an access package to include its resource role scopes?”
Tell an agent
Get access package {package}.
Show access package {package} with its resource role scopes expanded.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}
Update an access package · Update accessPackage
#
Ask an LLM
“How do I rename an access package or change its description?”
“Can I hide an existing access package from the request portal?”
Tell an agent
Rename access package {package} to {name}.
Change the description of access package {package} to {description}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}
Delete an access package · Delete accessPackage
#
Ask an LLM
“Can I delete an access package that still has users assigned?”
“What must be removed before an access package can be deleted?”
Tell an agent destructive · confirm first
Delete access package {package}.
Remove the access package {package} permanently.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/accessPackagesIncompatibleWith
List packages that mark this one incompatible · List accessPackagesIncompatibleWith
#
Ask an LLM
“Which other access packages have marked this package as incompatible with them?”
“What packages consider mine a conflict, looking from the other side?”
Tell an agent
List the access packages that declare {package} incompatible with them.
Show packages that flag access package {package} as a conflict.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/accessPackagesIncompatibleWith/{accessPackage-id1}
Get a package that marks this one incompatible · Get accessPackagesIncompatibleWith from identityGovernance
#
Ask an LLM
“Can I read one specific package from the set that treats mine as incompatible?”
“What does a single conflicting package look like from the incompatible-with side?”
Tell an agent
Get package {other} from the packages that list {package} as incompatible with them.
Show details of {other}, which marks access package {package} as a conflict.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/accessPackagesIncompatibleWith/$count
Count packages that mark this one incompatible · Get the number of the resource
#
Ask an LLM
“How many access packages have flagged this package as incompatible with them?”
“Can I get only the number of packages that treat mine as a conflict?”
Tell an agent
Count the packages that mark access package {package} as incompatible with them.
Tell me how many packages flag {package} as a conflict from their side.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies
List an access package's assignment policies · Get assignmentPolicies from identityGovernance
#
Ask an LLM
“Which assignment policies are attached to this access package?”
“Can I see who is allowed to request a package by reading its policies?”
Tell an agent
List the assignment policies of access package {package}.
Show every policy on access package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies
Add an assignment policy to an access package · Create new navigation property to assignmentPolicies for identityGovernance
#
Ask an LLM
“Can I create an assignment policy directly under a specific access package?”
“What settings, such as target scope and expiration, go into a package's new policy?”
Tell an agent
Add a policy named {name} to access package {package}.
Create a policy on package {package} with target scope {targetScope} and expiration {expiration}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}
Get one policy of an access package · Get assignmentPolicies from identityGovernance
#
Ask an LLM
“How do I read a particular assignment policy through its access package?”
“What approval and requestor settings does one package policy have?”
Tell an agent
Get policy {policy} of access package {package}.
Show the requestor settings of policy {policy} under package {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}
Update a policy through its access package · Update the navigation property assignmentPolicies in identityGovernance
#
Ask an LLM
“Can I patch an assignment policy by addressing it under its access package?”
“Which policy fields, such as display name or expiration, can I change here?”
Tell an agent
Rename policy {policy} on access package {package} to {name}.
Update the expiration of policy {policy} in package {package} to {expiration}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}
Remove a policy from an access package · Delete navigation property assignmentPolicies for identityGovernance
#
Ask an LLM
“Can I delete one assignment policy through its parent access package?”
“What happens to requests when a package policy is deleted?”
Tell an agent destructive · confirm first
Delete policy {policy} from access package {package}.
Remove assignment policy {policy} under package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/accessPackage
Get the package that owns a package policy · Get accessPackage from identityGovernance
#
Ask an LLM
“From a policy nested under an access package, can I navigate back to the owning package?”
“Which access package contains this particular nested policy?”
Tell an agent
Get the access package that contains policy {policy} under {package}.
Show the owning package for nested policy {policy} of {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/catalog
Get the catalog of a package policy · Get catalog from identityGovernance
#
Ask an LLM
“Which catalog does the package behind this nested policy belong to?”
“Can I read the catalog straight from a policy under an access package?”
Tell an agent
Get the catalog for policy {policy} of access package {package}.
Show which catalog holds nested policy {policy} in package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings
List custom extension stages on a package policy · Get customExtensionStageSettings from identityGovernance
#
Ask an LLM
“At which request stages does this package policy run custom workflow extensions?”
“Can I list the Logic App extension stage settings for a policy under an access package?”
Tell an agent
List custom extension stage settings of policy {policy} in package {package}.
Show when policy {policy} under {package} triggers custom extensions.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings
Add a custom extension stage to a package policy · Create new navigation property to customExtensionStageSettings for…
#
Ask an LLM
“How do I make a policy under an access package call a custom extension at a given stage?”
“Can I attach a workflow extension to the assignment-granted stage of a package's policy?”
Tell an agent
Add custom extension {extension} at stage {trigger} to policy {policy} of package {package}.
Create an extension stage setting on policy {policy} in {package} for stage {trigger}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings/{customExtensionStageSetting-id}
Get a custom extension stage on a package policy · Get customExtensionStageSettings from identityGovernance
#
Ask an LLM
“What stage does one custom extension setting on a package policy fire at?”
“Can I read a single extension stage setting nested under a package's policy?”
Tell an agent
Get extension stage setting {setting} of policy {policy} in package {package}.
Show custom extension stage {setting} on package {package} policy {policy}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings/{customExtensionStageSetting-id}
Update a custom extension stage on a package policy · Update the navigation property customExtensionStageSettings in…
#
Ask an LLM
“Can I change which stage a custom extension runs at on a package policy?”
“Is it possible to swap the custom extension linked to a stage setting under a package?”
Tell an agent
Change setting {setting} on policy {policy} of package {package} to run at stage {trigger}.
Point extension stage setting {setting} of {package} policy {policy} at extension {extension}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings/{customExtensionStageSetting-id}
Remove a custom extension stage from a package policy · Delete navigation property customExtensionStageSettings for identityGovernance
#
Ask an LLM
“Can I stop a package policy from calling a custom extension at some stage?”
“Is deleting an extension stage setting under a package policy reversible?”
Tell an agent destructive · confirm first
Delete extension stage setting {setting} from policy {policy} of package {package}.
Remove custom extension stage {setting} on {package} policy {policy}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings/{customExtensionStageSetting-id}/customExtension
Get the extension a package policy stage runs · Get customExtension from identityGovernance
#
Ask an LLM
“Which custom workflow extension gets executed at this stage of a package policy?”
“Can I read the Logic App details behind a package policy's extension stage?”
Tell an agent
Get the custom extension run by stage setting {setting} of policy {policy} in {package}.
Show which workflow extension setting {setting} calls for package {package} policy {policy}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings/$count
Count custom extension stages on a package policy · Get the number of the resource
#
Ask an LLM
“How many custom extension stage settings does a policy under an access package have?”
“Can I get just the number of extension triggers on a package policy?”
Tell an agent
Count the custom extension stage settings of policy {policy} in package {package}.
Tell me how many extension triggers policy {policy} of {package} has.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/questions
List requestor questions on a package policy · Get questions from identityGovernance
#
Ask an LLM
“What questions are requestors asked when they request through this package policy?”
“Can I see the question order for a policy nested under an access package?”
Tell an agent
List the requestor questions on policy {policy} of package {package}.
Show the questions asked by policy {policy} in access package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/questions
Add a requestor question to a package policy · Create new navigation property to questions for identityGovernance
#
Ask an LLM
“How do I add a question requestors must answer to a policy under an access package?”
“Can I make a new policy question required and set its position?”
Tell an agent
Add question {text} to policy {policy} of package {package}.
Create a question {text} at position {sequence} on package {package} policy {policy}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/questions/{accessPackageQuestion-id}
Get a requestor question on a package policy · Get questions from identityGovernance
#
Ask an LLM
“Can I read one requestor question from a policy under an access package?”
“Is a given question on a package policy required and editable?”
Tell an agent
Get question {question} of policy {policy} in package {package}.
Show whether question {question} on {package} policy {policy} is required.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/questions/{accessPackageQuestion-id}
Edit a requestor question on a package policy · Update the navigation property questions in identityGovernance
#
Ask an LLM
“Can I reword a question or change its order on a package policy?”
“Is it possible to make an existing package policy question optional?”
Tell an agent
Change the text of question {question} on policy {policy} of package {package} to {text}.
Move question {question} on {package} policy {policy} to position {sequence}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/questions/{accessPackageQuestion-id}
Remove a requestor question from a package policy · Delete navigation property questions for identityGovernance
#
Ask an LLM
“Can I drop a question that requestors see on a package policy?”
“What happens to earlier answers if a package policy question is deleted?”
Tell an agent destructive · confirm first
Delete question {question} from policy {policy} of package {package}.
Remove requestor question {question} on {package} policy {policy}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/{accessPackageAssignmentPolicy-id}/questions/$count
Count requestor questions on a package policy · Get the number of the resource
#
Ask an LLM
“How many questions does a policy under this access package ask?”
“Can I get only the number of requestor questions on a package policy?”
Tell an agent
Count the questions on policy {policy} of access package {package}.
Tell me how many requestor questions {package} policy {policy} has.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/assignmentPolicies/$count
Count an access package's policies · Get the number of the resource
#
Ask an LLM
“How many assignment policies does this access package have?”
“Can I get just the number of policies attached to one package?”
Tell an agent
Count the assignment policies on access package {package}.
Tell me how many policies package {package} carries.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/catalog
Get the catalog of an access package · Get catalog from identityGovernance
#
Ask an LLM
“Which catalog does this access package live in?”
“Can I read the catalog details straight from an access package?”
Tell an agent
Get the catalog of access package {package}.
Show which catalog holds package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleAccessPackages
List packages marked incompatible with this one · List incompatibleAccessPackages
#
Ask an LLM
“Which access packages have I marked as incompatible on this package?”
“Can a user who holds one of these conflicting packages still request mine?”
Tell an agent
List the access packages marked incompatible on package {package}.
Show the conflicting packages configured on {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleAccessPackages/{accessPackage-id1}/$ref
Unmark one package as incompatible (by path) · Remove accessPackage from incompatibleAccessPackages
#
Ask an LLM
“Can I remove a single package from my incompatible list by putting its ID in the URL?”
“How is an incompatibility link removed when I address the other package by path?”
Tell an agent destructive · confirm first
Remove {other} from the incompatible packages of {package}, addressing it in the path.
Unlink incompatible package {other} from access package {package} by its path ID.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleAccessPackages/$count
Count packages marked incompatible · Get the number of the resource
#
Ask an LLM
“How many incompatible access packages are configured on this package?”
“Can I get only the number of packages marked as a conflict on mine?”
Tell an agent
Count the packages marked incompatible on access package {package}.
Tell me how many conflicting packages {package} has configured.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleAccessPackages/$ref
List references to incompatible packages · List incompatibleAccessPackages
#
Ask an LLM
“Can I get only the reference links of the packages marked incompatible, not full objects?”
“What odata IDs point to the packages flagged as incompatible on mine?”
Tell an agent
List the reference links of incompatible packages on {package}.
Show only the odata IDs of conflicting packages for access package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleAccessPackages/$ref
Mark a package as incompatible · Add accessPackage to incompatibleAccessPackages
#
Ask an LLM
“How do I stop users with one access package from requesting another?”
“Can I add a package to the incompatible list by its odata reference?”
Tell an agent
Mark package {ref} as incompatible with access package {package}.
Add incompatible package reference {ref} to package {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleAccessPackages/$ref
Unmark a package as incompatible (by query) · Remove accessPackage from incompatibleAccessPackages
#
Ask an LLM
“Can I remove an incompatible package by passing its reference in the @id query parameter?”
“How do I undo a package conflict using the collection-level reference endpoint?”
Tell an agent destructive · confirm first
Remove incompatible package {refId} from {package} using the @id query reference.
Unmark the conflict between {package} and the package referenced by {refId}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleGroups
List groups marked incompatible · List incompatibleGroups
#
Ask an LLM
“Which groups are marked as incompatible with this access package?”
“Can members of certain groups be blocked from requesting a package?”
Tell an agent
List the groups marked incompatible on access package {package}.
Show the conflicting groups set on {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleGroups/{group-id}/$ref
Unmark a group as incompatible (by path) · Remove group from incompatibleGroups
#
Ask an LLM
“Can I remove one incompatible group by putting the group ID in the URL?”
“How do I let a group's members request a package again, addressing the group by path?”
Tell an agent destructive · confirm first
Remove group {group} from the incompatible groups of package {package}.
Unlink incompatible group {group} from {package} by its path ID.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleGroups/{group-id}/serviceProvisioningErrors
List provisioning errors of an incompatible group · Get serviceProvisioningErrors property value
#
Ask an LLM
“Does an incompatible group have any service provisioning errors?”
“Can I filter a conflicting group's provisioning errors to unresolved ones?”
Tell an agent
List service provisioning errors for incompatible group {group} on package {package}.
Show unresolved provisioning errors of group {group} blocked by {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleGroups/{group-id}/serviceProvisioningErrors/$count
Count provisioning errors of an incompatible group · Get the number of the resource
#
Ask an LLM
“How many provisioning errors does a group marked incompatible on a package have?”
“Can I just get the error count for a conflicting group?”
Tell an agent
Count provisioning errors of incompatible group {group} on package {package}.
Tell me how many service errors group {group} has under {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleGroups/$count
Count groups marked incompatible · Get the number of the resource
#
Ask an LLM
“How many groups are flagged as incompatible with this access package?”
“Can I get only the number of conflicting groups on a package?”
Tell an agent
Count the incompatible groups on access package {package}.
Tell me how many conflicting groups {package} has.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleGroups/$ref
List references to incompatible groups · List incompatibleGroups
#
Ask an LLM
“Can I retrieve just the reference links of the incompatible groups on a package?”
“Which group odata IDs are recorded as conflicts on my package?”
Tell an agent
List the reference links of incompatible groups on {package}.
Show only the group odata IDs flagged as conflicts on access package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleGroups/$ref
Mark a group as incompatible · Add group to incompatibleGroups
#
Ask an LLM
“How do I block members of a group from requesting an access package?”
“Can I add a group to a package's incompatible list by odata reference?”
Tell an agent
Block members of group {ref} from requesting access package {package}.
Add incompatible group reference {ref} to package {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/incompatibleGroups/$ref
Unmark a group as incompatible (by query) · Remove group from incompatibleGroups
#
Ask an LLM
“Can I remove an incompatible group by giving its reference in the @id query parameter?”
“How do I clear a group conflict through the collection-level reference endpoint?”
Tell an agent destructive · confirm first
Remove incompatible group {refId} from {package} using the @id query reference.
Unmark the group conflict referenced by {refId} on access package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/microsoft.graph.getApplicablePolicyRequirements
Get my request requirements for a package · Invoke action getApplicablePolicyRequirements
#
Ask an LLM
“What do I need to provide before I can request this access package?”
“Which of a package's policies am I, the signed-in user, allowed to request under?”
Tell an agent
Get the policy requirements that apply to me for access package {package}.
Show what I must answer or justify to request package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes
List the resource roles granted by a package · Get resourceRoleScopes from identityGovernance
#
Ask an LLM
“Which groups, apps or SharePoint sites and roles does this access package grant?”
“Can I see every resource role and scope bundled into one package?”
Tell an agent
List the resource grants in access package {package}.
Show which resource roles and scopes package {package} hands out.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes
Add a resource role to an access package · Create resourceRoleScope
#
Ask an LLM
“How do I add a group membership or app role to an access package?”
“Does the resource have to be in the catalog before I add its role to a package?”
Tell an agent
Add resource role {roleBody} with scope {scopeBody} to access package {package}.
Grant the resource role {roleBody} through package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}
Get one resource grant of a package · Get resourceRoleScopes from identityGovernance
#
Ask an LLM
“Can I read a single resource role and scope pairing inside an access package?”
“Which role and scope does one of a package's resource grants point to?”
Tell an agent
Get resource grant {grant} of access package {package}.
Show the role and scope behind grant {grant} in package {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}
Update a resource grant in a package · Update the navigation property resourceRoleScopes in identityGovernance
#
Ask an LLM
“Can I change the role or scope of an existing resource grant in a package?”
“Is it possible to patch a resource role scope rather than recreate it?”
Tell an agent
Change grant {grant} in package {package} to use role {roleBody}.
Update the scope of resource grant {grant} in {package} to {scopeBody}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}
Remove a resource role from an access package · Remove resourceRoleScope from an accessPackage
#
Ask an LLM
“How do I stop an access package from granting a particular resource role?”
“What happens to existing assignees when a resource role is removed from a package?”
Tell an agent destructive · confirm first
Remove resource grant {grant} from access package {package}.
Delete the role-and-scope pairing {grant} in package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role
Get the role a resource grant hands out · Get role from identityGovernance
#
Ask an LLM
“Which role does this resource grant in my access package hand out?”
“Can I see the origin ID of the role a package grant assigns?”
Tell an agent
Get the role handed out by grant {grant} in {package}.
Show which role resource grant {grant} of package {package} assigns.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role
Update the role a resource grant assigns · Update the navigation property role in identityGovernance
#
Ask an LLM
“Can I rename the role a resource grant assigns?”
“Which role properties, like origin ID, are editable through a grant?”
Tell an agent
Rename the role assigned by grant {grant} in {package} to {name}.
Set origin ID {originId} on the role of resource grant {grant}, package {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role
Unlink the role from a resource grant · Delete navigation property role for identityGovernance
#
Ask an LLM
“Can I unlink the role from a package's resource grant?”
“What does clearing a grant's role navigation remove?”
Tell an agent destructive · confirm first
Unlink the role from grant {grant} in {package}.
Clear the assigned role on resource grant {grant} of package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource
Get the resource that owns a grant's role · Get resource from identityGovernance
#
Ask an LLM
“Which app, group or site owns the role in this package grant?”
“Can I read the origin system of the role-owning resource?”
Tell an agent
Get the role-owning resource for grant {grant} in {package}.
Show which application owns the role of grant {grant}, package {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource
Update the resource that owns a grant's role · Update the navigation property resource in identityGovernance
#
Ask an LLM
“Can I edit the display name of the role-owning resource?”
“Which attributes of a grant role's owning resource are patchable?”
Tell an agent
Rename the role-owning resource for grant {grant} in {package} to {name}.
Change the role-owning resource description on grant {grant}, package {package}, to {description}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource
Unlink the resource that owns a grant's role · Delete navigation property resource for identityGovernance
#
Ask an LLM
“Can I unlink the role-owning resource from a grant's role?”
“What is lost if a grant role's owning resource link is deleted?”
Tell an agent destructive · confirm first
Unlink the role-owning resource for grant {grant} in {package}.
Delete the owning resource link beneath grant {grant}'s role, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/environment
Get the environment of a grant role's owner · Get environment from identityGovernance
#
Ask an LLM
“Which environment is the role-owning resource hosted in?”
“Can I read hosting environment details for a grant role's owner?”
Tell an agent
Get the environment of the role-owning resource for grant {grant} in {package}.
Show where grant {grant}'s role-owning resource lives, package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/microsoft.graph.refresh
Refresh the resource that owns a grant's role · Invoke action refresh
#
Ask an LLM
“Can I trigger a re-sync of the role-owning resource behind a grant?”
“How do I pull newly added roles from the resource that owns a grant's role?”
Tell an agent
Refresh the role-owning resource for grant {grant} in {package}.
Re-sync the owner of grant {grant}'s role in package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/roles
List roles offered by a grant role's owner · Get roles from identityGovernance
#
Ask an LLM
“What roles does the role-owning resource offer besides the granted one?”
“Can I list all roles offered by the resource behind a grant's role?”
Tell an agent
List roles offered by the role-owning resource for grant {grant} in {package}.
Show every role the owner of grant {grant}'s role offers, package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/roles
Add a role to a grant role's owner · Create new navigation property to roles for identityGovernance
#
Ask an LLM
“Can I add a new role offered by the role-owning resource?”
“Does a new role on the grant role's owner need an origin ID?”
Tell an agent
Add role {name} offered by the role-owning resource for grant {grant} in {package}.
Create a role with origin ID {originId} on grant {grant}'s role owner, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/roles/{accessPackageResourceRole-id}
Get a role offered by a grant role's owner · Get roles from identityGovernance
#
Ask an LLM
“Can I read one role offered by the role-owning resource of a grant?”
“Where does a specific role on a grant role's owner originate?”
Tell an agent
Get role {role} offered by the role-owning resource for grant {grant} in {package}.
Show role {role} from the owner of grant {grant}'s role, package {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/roles/{accessPackageResourceRole-id}
Update a role offered by a grant role's owner · Update the navigation property roles in identityGovernance
#
Ask an LLM
“Can I rename a role offered by the role-owning resource?”
“Which fields of a role on a grant role's owner can change?”
Tell an agent
Rename role {role} offered by the role-owning resource for grant {grant} in {package} to {name}.
Update role {role}'s description to {description} on the owner of grant {grant}'s role, package {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/roles/{accessPackageResourceRole-id}
Delete a role offered by a grant role's owner · Delete navigation property roles for identityGovernance
#
Ask an LLM
“Can I delete one role offered by the role-owning resource?”
“What breaks if a role on the grant role's owner is removed?”
Tell an agent destructive · confirm first
Delete role {role} offered by the role-owning resource for grant {grant} in {package}.
Remove role {role} permanently from the owner of grant {grant}'s role, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/roles/$count
Count roles offered by a grant role's owner · Get the number of the resource
#
Ask an LLM
“How many roles does the role-owning resource of a grant offer?”
“Is there a quick count of roles on a grant role's owner?”
Tell an agent
Count roles offered by the role-owning resource for grant {grant} in {package}.
Tell me the number of roles grant {grant}'s role owner has, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes
List scopes within a grant role's owner · Get scopes from identityGovernance
#
Ask an LLM
“Which scopes exist within the role-owning resource of a grant?”
“Does the resource owning a grant's role have a root scope?”
Tell an agent
List scopes within the role-owning resource for grant {grant} in {package}.
Show every scope inside grant {grant}'s role owner, package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes
Add a scope within a grant role's owner · Create new navigation property to scopes for identityGovernance
#
Ask an LLM
“Can I add a scope within the role-owning resource?”
“How do I flag a new scope inside a grant role's owner as root?”
Tell an agent
Add scope {name} within the role-owning resource for grant {grant} in {package}.
Create a scope inside grant {grant}'s role owner with isRootScope {isRootScope}, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}
Get a scope within a grant role's owner · Get scopes from identityGovernance
#
Ask an LLM
“Can I read one scope within the role-owning resource?”
“Is a given scope inside a grant role's owner the root scope?”
Tell an agent
Get scope {scope} within the role-owning resource for grant {grant} in {package}.
Display the details of scope {scope} inside grant {grant}'s role owner, package {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}
Update a scope within a grant role's owner · Update the navigation property scopes in identityGovernance
#
Ask an LLM
“Can I rename a scope within the role-owning resource?”
“Which scope fields inside a grant role's owner are patchable?”
Tell an agent
Rename scope {scope} within the role-owning resource for grant {grant} in {package} to {name}.
Update scope {scope}'s description to {description} inside grant {grant}'s role owner, package {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}
Delete a scope within a grant role's owner · Delete navigation property scopes for identityGovernance
#
Ask an LLM
“Can I delete a scope within the role-owning resource?”
“What happens when a scope inside a grant role's owner is removed?”
Tell an agent destructive · confirm first
Delete scope {scope} within the role-owning resource for grant {grant} in {package}.
Remove scope {scope} from inside grant {grant}'s role owner, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource
Get the resource of a catalogued scope · Get resource from identityGovernance
#
Ask an LLM
“Which resource does a catalogued scope under a grant role's owner belong to?”
“Can I navigate from a catalogued scope back to its resource on the role-owning branch?”
Tell an agent
Get the resource of catalogued scope {scope} for grant {grant} in {package}.
Show which resource catalogued scope {scope} belongs to, role-owning branch of grant {grant}, {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource
Update the resource of a catalogued scope · Update the navigation property resource in identityGovernance
#
Ask an LLM
“Can I rename the resource behind a catalogued scope on the role-owning branch?”
“Which fields of a catalogued scope's resource can be patched?”
Tell an agent
Rename the resource of catalogued scope {scope} for grant {grant} in {package} to {name}.
Set the description of catalogued scope {scope}'s resource to {description}, grant {grant}, {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource
Unlink the resource of a catalogued scope · Delete navigation property resource for identityGovernance
#
Ask an LLM
“Can I unlink the resource from a catalogued scope on the role-owning branch?”
“What gets removed when a catalogued scope's resource link is deleted?”
Tell an agent destructive · confirm first
Unlink the resource of catalogued scope {scope} for grant {grant} in {package}.
Delete catalogued scope {scope}'s resource link, role-owning branch of grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/environment
Get the environment of a catalogued scope's resource · Get environment from identityGovernance
#
Ask an LLM
“Where is a catalogued scope's resource hosted, on the role-owning branch?”
“Can I get environment info for the resource of a catalogued scope?”
Tell an agent
Get the environment of catalogued scope {scope}'s resource for grant {grant} in {package}.
Show hosting environment details for the resource of catalogued scope {scope}, grant {grant}, {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/microsoft.graph.refresh
Refresh a catalogued scope's resource · Invoke action refresh
#
Ask an LLM
“Can I re-sync the resource of a catalogued scope on the role-owning branch?”
“How do I refresh a catalogued scope's resource so new roles appear?”
Tell an agent
Refresh catalogued scope {scope}'s resource for grant {grant} in {package}.
Re-sync the resource behind catalogued scope {scope}, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/roles
List roles on a catalogued scope's resource · Get roles from identityGovernance
#
Ask an LLM
“Which roles are offered by a catalogued scope's resource?”
“Can I list roles for the resource of a catalogued scope on the role-owning branch?”
Tell an agent
List roles offered by catalogued scope {scope}'s resource for grant {grant} in {package}.
Show all roles on the resource of catalogued scope {scope}, grant {grant}, {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/roles
Add a role to a catalogued scope's resource · Create new navigation property to roles for identityGovernance
#
Ask an LLM
“Can I add a role offered by a catalogued scope's resource?”
“What does a new role on a catalogued scope's resource need?”
Tell an agent
Add role {name} offered by catalogued scope {scope}'s resource for grant {grant} in {package}.
Create a role with origin ID {originId} on catalogued scope {scope}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/roles/{accessPackageResourceRole-id}
Get a role on a catalogued scope's resource · Get roles from identityGovernance
#
Ask an LLM
“Can I read one role offered by a catalogued scope's resource?”
“Where does a role on a catalogued scope's resource originate?”
Tell an agent
Get role {role} offered by catalogued scope {scope}'s resource for grant {grant} in {package}.
Show role {role} on the resource of catalogued scope {scope}, grant {grant}, {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/roles/{accessPackageResourceRole-id}
Update a role on a catalogued scope's resource · Update the navigation property roles in identityGovernance
#
Ask an LLM
“Can I rename a role offered by a catalogued scope's resource?”
“Which fields of a role on a catalogued scope's resource are editable?”
Tell an agent
Rename role {role} offered by catalogued scope {scope}'s resource for grant {grant} in {package} to {name}.
Update role {role}'s description to {description} on catalogued scope {scope}'s resource, grant {grant}, {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/roles/{accessPackageResourceRole-id}
Delete a role on a catalogued scope's resource · Delete navigation property roles for identityGovernance
#
Ask an LLM
“Can I delete a role offered by a catalogued scope's resource?”
“Is removing a role from a catalogued scope's resource permanent?”
Tell an agent destructive · confirm first
Delete role {role} offered by catalogued scope {scope}'s resource for grant {grant} in {package}.
Remove role {role} from the resource of catalogued scope {scope}, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/roles/$count
Count roles on a catalogued scope's resource · Get the number of the resource
#
Ask an LLM
“How many roles does a catalogued scope's resource offer?”
“Can I get just the role count for the resource of a catalogued scope?”
Tell an agent
Count roles offered by catalogued scope {scope}'s resource for grant {grant} in {package}.
Tell me the number of roles on catalogued scope {scope}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions
List uploads on a catalogued scope's resource · Get uploadSessions from identityGovernance
#
Ask an LLM
“Which custom data upload sessions exist for a catalogued scope's resource?”
“Can I review bring-your-own-data uploads for the resource of a catalogued scope?”
Tell an agent
List upload sessions for catalogued scope {scope}'s resource, grant {grant} in {package}.
Show custom data uploads made to the resource of catalogued scope {scope}, grant {grant}, {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions
Start an upload on a catalogued scope's resource · Create new navigation property to uploadSessions for identityGovernance
#
Ask an LLM
“How do I start an external access data upload for a catalogued scope's resource?”
“Can a new upload for a catalogued scope's resource carry my reference ID?”
Tell an agent
Start an upload session with reference ID {referenceId} for catalogued scope {scope}'s resource, grant {grant} in {package}.
Open a new custom data upload on the resource of catalogued scope {scope}, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}
Get an upload on a catalogued scope's resource · Get uploadSessions from identityGovernance
#
Ask an LLM
“What is the status of one upload session on a catalogued scope's resource?”
“Has a particular catalogued scope resource upload finished processing?”
Tell an agent
Get upload session {session} for catalogued scope {scope}'s resource, grant {grant} in {package}.
Check the stats of custom data upload {session} on catalogued scope {scope}'s resource, grant {grant}, {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}
Update an upload on a catalogued scope's resource · Update the navigation property uploadSessions in identityGovernance
#
Ask an LLM
“How do I mark a catalogued scope resource upload as done?”
“Can I change the reference ID of an upload on a catalogued scope's resource?”
Tell an agent
Set isUploadDone to {isUploadDone} on upload session {session} for catalogued scope {scope}'s resource, grant {grant} in {package}.
Change upload {session}'s reference ID to {referenceId} on catalogued scope {scope}'s resource, grant {grant}, {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}
Delete an upload on a catalogued scope's resource · Delete navigation property uploadSessions for identityGovernance
#
Ask an LLM
“Can I discard an upload session for a catalogued scope's resource?”
“What happens to files when a catalogued scope resource upload is deleted?”
Tell an agent destructive · confirm first
Delete upload session {session} for catalogued scope {scope}'s resource, grant {grant} in {package}.
Discard the custom data upload {session} on catalogued scope {scope}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files
List files in a catalogued scope upload · Get files from identityGovernance
#
Ask an LLM
“Which files were sent in an upload for a catalogued scope's resource?”
“Can I list the files inside a catalogued scope resource upload session?”
Tell an agent
List files in upload {session} for catalogued scope {scope}'s resource, grant {grant} in {package}.
Show every uploaded file of session {session} on catalogued scope {scope}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}
Get a file record in a catalogued scope upload · Get files from identityGovernance
#
Ask an LLM
“Can I read one file record from a catalogued scope resource upload?”
“What metadata does a file in a catalogued scope upload session carry?”
Tell an agent
Get file {file} of upload {session} for catalogued scope {scope}'s resource, grant {grant} in {package}.
Show the record for file {file} in session {session}, catalogued scope {scope}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}/$value
Download a file from a catalogued scope upload · Get media content for the navigation property files from identityGovernance
#
Ask an LLM
“Can I download the bytes of a file uploaded to a catalogued scope's resource?”
“How do I retrieve the raw content of a catalogued scope upload file?”
Tell an agent
Download the content of file {file} in upload {session}, catalogued scope {scope}'s resource, grant {grant} in {package}.
Fetch raw bytes for file {file}, session {session}, on catalogued scope {scope}'s resource, grant {grant}, {package}.
PUT
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}/$value
Overwrite a file in a catalogued scope upload · Update media content for the navigation property files in identityGovernance
#
Ask an LLM
“Can I overwrite a file already uploaded to a catalogued scope's resource?”
“How do I put new content into a catalogued scope upload file?”
Tell an agent
Overwrite file {file} with new content in upload {session}, catalogued scope {scope}'s resource, grant {grant} in {package}.
Replace what is stored for file {file}, session {session}, on catalogued scope {scope}'s resource, grant {grant}, {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}/$value
Erase a file's content in a catalogued scope upload · Delete media content for the navigation property files in identityGovernance
#
Ask an LLM
“Can I erase the stored content of a catalogued scope upload file?”
“Is wiping a file's bytes in a catalogued scope resource upload reversible?”
Tell an agent destructive · confirm first
Erase the stored bytes of file {file} in upload {session}, catalogued scope {scope}'s resource, grant {grant} in {package}.
Wipe file {file}'s content from session {session} on catalogued scope {scope}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/$count
Count files in a catalogued scope upload · Get the number of the resource
#
Ask an LLM
“How many files are in a catalogued scope resource upload session?”
“Can I get only the file total for an upload on a catalogued scope's resource?”
Tell an agent
Count the files in upload {session} for catalogued scope {scope}'s resource, grant {grant} in {package}.
Tell me how many files session {session} holds, catalogued scope {scope}'s resource, grant {grant}, {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/microsoft.graph.uploadFile
Upload a file for a catalogued scope's resource · Invoke action uploadFile
#
Ask an LLM
“How do I upload an access data file for a catalogued scope's resource?”
“Can I add another file to an open catalogued scope upload session?”
Tell an agent
Upload a file into session {session} for catalogued scope {scope}'s resource, grant {grant} in {package}.
Push an access data file to upload {session} on catalogued scope {scope}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/{accessPackageResourceScope-id}/resource/uploadSessions/$count
Count uploads on a catalogued scope's resource · Get the number of the resource
#
Ask an LLM
“How many upload sessions exist for a catalogued scope's resource?”
“Can I get only the session total for a catalogued scope's resource?”
Tell an agent
Count the upload sessions for catalogued scope {scope}'s resource, grant {grant} in {package}.
Tell me how many custom data uploads catalogued scope {scope}'s resource has, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/scopes/$count
Count scopes within a grant role's owner · Get the number of the resource
#
Ask an LLM
“How many scopes exist within the role-owning resource of a grant?”
“Can I get just the scope count inside a grant role's owner?”
Tell an agent
Count scopes within the role-owning resource for grant {grant} in {package}.
Tell me the number of scopes inside grant {grant}'s role owner, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions
List uploads on a grant role's owner · Get uploadSessions from identityGovernance
#
Ask an LLM
“Which custom data upload sessions exist for the role-owning resource of a grant?”
“Can I review bring-your-own-data uploads sent to a grant role's owner?”
Tell an agent
List upload sessions for the role-owning resource of grant {grant} in {package}.
Show custom data uploads made to grant {grant}'s role owner, package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions
Start an upload on a grant role's owner · Create new navigation property to uploadSessions for identityGovernance
#
Ask an LLM
“How do I start an external access data upload for the role-owning resource?”
“Can a new upload for a grant role's owner carry my reference ID?”
Tell an agent
Start an upload session with reference ID {referenceId} for the role-owning resource of grant {grant} in {package}.
Open a new custom data upload on grant {grant}'s role owner, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}
Get an upload on a grant role's owner · Get uploadSessions from identityGovernance
#
Ask an LLM
“What is the status of one upload session on the role-owning resource?”
“Has a particular upload to a grant role's owner finished processing?”
Tell an agent
Get upload session {session} for the role-owning resource of grant {grant} in {package}.
Check the stats of custom data upload {session} on grant {grant}'s role owner, package {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}
Update an upload on a grant role's owner · Update the navigation property uploadSessions in identityGovernance
#
Ask an LLM
“How do I mark an upload to the role-owning resource as done?”
“Can I change the reference ID of an upload on a grant role's owner?”
Tell an agent
Set isUploadDone to {isUploadDone} on upload session {session} for the role-owning resource of grant {grant} in {package}.
Change upload {session}'s reference ID to {referenceId} on grant {grant}'s role owner, package {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}
Delete an upload on a grant role's owner · Delete navigation property uploadSessions for identityGovernance
#
Ask an LLM
“Can I discard an upload session for the role-owning resource?”
“What happens to files when an upload to a grant role's owner is deleted?”
Tell an agent destructive · confirm first
Delete upload session {session} for the role-owning resource of grant {grant} in {package}.
Discard the custom data upload {session} on grant {grant}'s role owner, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files
List files in an upload to a grant role's owner · Get files from identityGovernance
#
Ask an LLM
“Which files were sent in an upload for the role-owning resource?”
“Can I list the files inside an upload session on a grant role's owner?”
Tell an agent
List files in upload {session} for the role-owning resource of grant {grant} in {package}.
Show every uploaded file of session {session} on grant {grant}'s role owner, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}
Get a file record uploaded to a grant role's owner · Get files from identityGovernance
#
Ask an LLM
“Can I read one file record from an upload to the role-owning resource?”
“What metadata does a file uploaded to a grant role's owner carry?”
Tell an agent
Get file {file} of upload {session} for the role-owning resource of grant {grant} in {package}.
Show the record for file {file} in session {session}, grant {grant}'s role owner, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}/$value
Download a file uploaded to a grant role's owner · Get media content for the navigation property files from identityGovernance
#
Ask an LLM
“Can I download the bytes of a file uploaded to the role-owning resource?”
“How do I retrieve the raw content of a file sent to a grant role's owner?”
Tell an agent
Download the content of file {file} in upload {session}, role-owning resource of grant {grant} in {package}.
Fetch raw bytes for file {file}, session {session}, on grant {grant}'s role owner, package {package}.
PUT
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}/$value
Overwrite a file uploaded to a grant role's owner · Update media content for the navigation property files in identityGovernance
#
Ask an LLM
“Can I overwrite a file already uploaded to the role-owning resource?”
“How do I put new content into a file sent to a grant role's owner?”
Tell an agent
Overwrite file {file} with new content in upload {session}, role-owning resource of grant {grant} in {package}.
Replace what is stored for file {file}, session {session}, on grant {grant}'s role owner, package {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}/$value
Erase a file uploaded to a grant role's owner · Delete media content for the navigation property files in identityGovernance
#
Ask an LLM
“Can I erase the stored content of a file uploaded to the role-owning resource?”
“Is wiping a file's bytes on a grant role's owner reversible?”
Tell an agent destructive · confirm first
Erase the stored bytes of file {file} in upload {session}, role-owning resource of grant {grant} in {package}.
Wipe file {file}'s content from session {session} on grant {grant}'s role owner, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/$count
Count files in an upload to a grant role's owner · Get the number of the resource
#
Ask an LLM
“How many files are in an upload session on the role-owning resource?”
“Can I get only the file total for an upload to a grant role's owner?”
Tell an agent
Count the files in upload {session} for the role-owning resource of grant {grant} in {package}.
Tell me how many files session {session} holds, grant {grant}'s role owner, package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/microsoft.graph.uploadFile
Upload a file for a grant role's owner · Invoke action uploadFile
#
Ask an LLM
“How do I upload an access data file for the role-owning resource?”
“Can I add another file to an open upload on a grant role's owner?”
Tell an agent
Upload a file into session {session} for the role-owning resource of grant {grant} in {package}.
Push an access data file to upload {session} on grant {grant}'s role owner, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/role/resource/uploadSessions/$count
Count uploads on a grant role's owner · Get the number of the resource
#
Ask an LLM
“How many upload sessions exist for the role-owning resource of a grant?”
“Can I get only the session total for a grant role's owner?”
Tell an agent
Count the upload sessions for the role-owning resource of grant {grant} in {package}.
Tell me how many custom data uploads grant {grant}'s role owner has, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope
Get the scope a resource grant covers · Get scope from identityGovernance
#
Ask an LLM
“Which scope of the resource does this package grant cover?”
“Can I check whether a grant applies at the root scope?”
Tell an agent
Get the scope covered by grant {grant} in {package}.
Show which scope resource grant {grant} of package {package} applies to.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope
Update the scope a resource grant covers · Update the navigation property scope in identityGovernance
#
Ask an LLM
“Can I rename the scope a resource grant covers?”
“Is it possible to flag a grant's covered scope as the root scope?”
Tell an agent
Rename the scope covered by grant {grant} in {package} to {name}.
Set isRootScope to {isRootScope} on the scope of resource grant {grant}, package {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope
Unlink the scope from a resource grant · Delete navigation property scope for identityGovernance
#
Ask an LLM
“Is it possible to unlink the scope from a package's resource grant?”
“What happens when I clear the scope link on a grant?”
Tell an agent destructive · confirm first
Unlink the scope from grant {grant} in {package}.
Clear the covered scope on resource grant {grant} of package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource
Get the resource hosting a grant's scope · Get resource from identityGovernance
#
Ask an LLM
“Which app, group or site hosts the scope in this package grant?”
“Can I read the origin system of the scope-hosting resource?”
Tell an agent
Get the scope-hosting resource for grant {grant} in {package}.
Show which application hosts the scope of grant {grant}, package {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource
Update the resource hosting a grant's scope · Update the navigation property resource in identityGovernance
#
Ask an LLM
“Can I edit the display name of the scope-hosting resource?”
“Which attributes of a grant scope's hosting resource are patchable?”
Tell an agent
Rename the scope-hosting resource for grant {grant} in {package} to {name}.
Change the scope-hosting resource description on grant {grant}, package {package}, to {description}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource
Unlink the resource hosting a grant's scope · Delete navigation property resource for identityGovernance
#
Ask an LLM
“Can I unlink the scope-hosting resource from a grant's scope?”
“What is lost if a grant scope's hosting resource link is deleted?”
Tell an agent destructive · confirm first
Unlink the scope-hosting resource for grant {grant} in {package}.
Delete the hosting resource link beneath grant {grant}'s scope, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/environment
Get the environment of a grant scope's host · Get environment from identityGovernance
#
Ask an LLM
“Which environment is the scope-hosting resource in?”
“Can I read hosting environment details for a grant scope's host?”
Tell an agent
Get the environment of the scope-hosting resource for grant {grant} in {package}.
Show where grant {grant}'s scope-hosting resource lives, package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/microsoft.graph.refresh
Refresh the resource hosting a grant's scope · Invoke action refresh
#
Ask an LLM
“Can I trigger a re-sync of the scope-hosting resource behind a grant?”
“How do I pull newly added scopes from the resource hosting a grant's scope?”
Tell an agent
Refresh the scope-hosting resource for grant {grant} in {package}.
Re-sync the host of grant {grant}'s scope in package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles
List roles offered by a grant scope's host · Get roles from identityGovernance
#
Ask an LLM
“What roles are offered by the scope-hosting resource of a grant?”
“Can I list all roles on the resource hosting a grant's scope?”
Tell an agent
List roles offered by the scope-hosting resource for grant {grant} in {package}.
Show every role the host of grant {grant}'s scope offers, package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles
Add a role to a grant scope's host · Create new navigation property to roles for identityGovernance
#
Ask an LLM
“Can I add a new role offered by the scope-hosting resource?”
“Does a new role on a grant scope's host need an origin ID?”
Tell an agent
Add role {name} offered by the scope-hosting resource for grant {grant} in {package}.
Create a role with origin ID {originId} on grant {grant}'s scope host, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}
Get a role offered by a grant scope's host · Get roles from identityGovernance
#
Ask an LLM
“Can I read one role offered by the scope-hosting resource of a grant?”
“Where does a specific role on a grant scope's host originate?”
Tell an agent
Get role {role} offered by the scope-hosting resource for grant {grant} in {package}.
Show role {role} from the host of grant {grant}'s scope, package {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}
Update a role offered by a grant scope's host · Update the navigation property roles in identityGovernance
#
Ask an LLM
“Can I rename a role offered by the scope-hosting resource?”
“Which fields of a role on a grant scope's host can change?”
Tell an agent
Rename role {role} offered by the scope-hosting resource for grant {grant} in {package} to {name}.
Update role {role}'s description to {description} on the host of grant {grant}'s scope, package {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}
Delete a role offered by a grant scope's host · Delete navigation property roles for identityGovernance
#
Ask an LLM
“Can I delete one role offered by the scope-hosting resource?”
“What breaks if a role on a grant scope's host is removed?”
Tell an agent destructive · confirm first
Delete role {role} offered by the scope-hosting resource for grant {grant} in {package}.
Remove role {role} permanently from the host of grant {grant}'s scope, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource
Get the resource of a defined role · Get resource from identityGovernance
#
Ask an LLM
“Which resource is a defined role on a grant scope's host attached to?”
“Can I navigate from a defined role back to its resource on the scope-hosting branch?”
Tell an agent
Get the resource of defined role {role} for grant {grant} in {package}.
Show which resource defined role {role} is attached to, scope-hosting branch of grant {grant}, {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource
Update the resource of a defined role · Update the navigation property resource in identityGovernance
#
Ask an LLM
“Can I rename the resource behind a defined role on the scope-hosting branch?”
“Which fields of a defined role's resource can be patched?”
Tell an agent
Rename the resource of defined role {role} for grant {grant} in {package} to {name}.
Set the description of defined role {role}'s resource to {description}, grant {grant}, {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource
Unlink the resource of a defined role · Delete navigation property resource for identityGovernance
#
Ask an LLM
“Can I unlink the resource from a defined role on the scope-hosting branch?”
“What gets removed when a defined role's resource link is deleted?”
Tell an agent destructive · confirm first
Unlink the resource of defined role {role} for grant {grant} in {package}.
Delete defined role {role}'s resource link, scope-hosting branch of grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/environment
Get the environment of a defined role's resource · Get environment from identityGovernance
#
Ask an LLM
“Where is a defined role's resource hosted, on the scope-hosting branch?”
“Can I get environment info for the resource of a defined role?”
Tell an agent
Get the environment of defined role {role}'s resource for grant {grant} in {package}.
Show hosting environment details for the resource of defined role {role}, grant {grant}, {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/microsoft.graph.refresh
Refresh a defined role's resource · Invoke action refresh
#
Ask an LLM
“Can I re-sync the resource of a defined role on the scope-hosting branch?”
“How do I refresh a defined role's resource so new scopes appear?”
Tell an agent
Refresh defined role {role}'s resource for grant {grant} in {package}.
Re-sync the resource behind defined role {role}, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/scopes
List scopes on a defined role's resource · Get scopes from identityGovernance
#
Ask an LLM
“Which scopes exist within a defined role's resource?”
“Can I list scopes for the resource of a defined role on the scope-hosting branch?”
Tell an agent
List scopes within defined role {role}'s resource for grant {grant} in {package}.
Show all scopes on the resource of defined role {role}, grant {grant}, {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/scopes
Add a scope to a defined role's resource · Create new navigation property to scopes for identityGovernance
#
Ask an LLM
“Can I add a scope within a defined role's resource?”
“How do I make a new scope inside a defined role's resource the root scope?”
Tell an agent
Add scope {name} within defined role {role}'s resource for grant {grant} in {package}.
Create a scope with isRootScope {isRootScope} on defined role {role}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/scopes/{accessPackageResourceScope-id}
Get a scope on a defined role's resource · Get scopes from identityGovernance
#
Ask an LLM
“Can I read one scope within a defined role's resource?”
“Is a given scope inside a defined role's resource the root scope?”
Tell an agent
Get scope {scope} within defined role {role}'s resource for grant {grant} in {package}.
Show scope {scope} on the resource of defined role {role}, grant {grant}, {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/scopes/{accessPackageResourceScope-id}
Update a scope on a defined role's resource · Update the navigation property scopes in identityGovernance
#
Ask an LLM
“Can I rename a scope within a defined role's resource?”
“Which fields of a scope on a defined role's resource are editable?”
Tell an agent
Rename scope {scope} within defined role {role}'s resource for grant {grant} in {package} to {name}.
Update scope {scope}'s description to {description} on defined role {role}'s resource, grant {grant}, {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/scopes/{accessPackageResourceScope-id}
Delete a scope on a defined role's resource · Delete navigation property scopes for identityGovernance
#
Ask an LLM
“Can I delete a scope within a defined role's resource?”
“Is removing a scope from a defined role's resource permanent?”
Tell an agent destructive · confirm first
Delete scope {scope} within defined role {role}'s resource for grant {grant} in {package}.
Remove scope {scope} from the resource of defined role {role}, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/scopes/$count
Count scopes on a defined role's resource · Get the number of the resource
#
Ask an LLM
“How many scopes does a defined role's resource have?”
“Is there a quick scope total for a defined role's resource?”
Tell an agent
Count scopes within defined role {role}'s resource for grant {grant} in {package}.
Tell me the number of scopes on defined role {role}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions
List uploads on a defined role's resource · Get uploadSessions from identityGovernance
#
Ask an LLM
“Which custom data upload sessions exist for a defined role's resource?”
“Can I review bring-your-own-data uploads for the resource of a defined role?”
Tell an agent
List upload sessions for defined role {role}'s resource, grant {grant} in {package}.
Show custom data uploads made to the resource of defined role {role}, grant {grant}, {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions
Start an upload on a defined role's resource · Create new navigation property to uploadSessions for identityGovernance
#
Ask an LLM
“How do I start an external access data upload for a defined role's resource?”
“Can a new upload for a defined role's resource carry my reference ID?”
Tell an agent
Start an upload session with reference ID {referenceId} for defined role {role}'s resource, grant {grant} in {package}.
Open a new custom data upload on the resource of defined role {role}, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}
Get an upload on a defined role's resource · Get uploadSessions from identityGovernance
#
Ask an LLM
“What is the status of one upload session on a defined role's resource?”
“Has a particular defined role resource upload finished processing?”
Tell an agent
Get upload session {session} for defined role {role}'s resource, grant {grant} in {package}.
Check the stats of custom data upload {session} on defined role {role}'s resource, grant {grant}, {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}
Update an upload on a defined role's resource · Update the navigation property uploadSessions in identityGovernance
#
Ask an LLM
“How do I mark a defined role resource upload as done?”
“Can I change the reference ID of an upload on a defined role's resource?”
Tell an agent
Set isUploadDone to {isUploadDone} on upload session {session} for defined role {role}'s resource, grant {grant} in {package}.
Change upload {session}'s reference ID to {referenceId} on defined role {role}'s resource, grant {grant}, {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}
Delete an upload on a defined role's resource · Delete navigation property uploadSessions for identityGovernance
#
Ask an LLM
“Can I discard an upload session for a defined role's resource?”
“What happens to files when a defined role resource upload is deleted?”
Tell an agent destructive · confirm first
Delete upload session {session} for defined role {role}'s resource, grant {grant} in {package}.
Discard the custom data upload {session} on defined role {role}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files
List files in a defined role upload · Get files from identityGovernance
#
Ask an LLM
“Which files were sent in an upload for a defined role's resource?”
“Can I list the files inside a defined role resource upload session?”
Tell an agent
List files in upload {session} for defined role {role}'s resource, grant {grant} in {package}.
Show every uploaded file of session {session} on defined role {role}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}
Get a file record in a defined role upload · Get files from identityGovernance
#
Ask an LLM
“Can I read one file record from a defined role resource upload?”
“What metadata does a file in a defined role upload session carry?”
Tell an agent
Get file {file} of upload {session} for defined role {role}'s resource, grant {grant} in {package}.
Show the record for file {file} in session {session}, defined role {role}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}/$value
Download a file from a defined role upload · Get media content for the navigation property files from identityGovernance
#
Ask an LLM
“Can I download the bytes of a file uploaded to a defined role's resource?”
“How do I retrieve the raw content of a defined role upload file?”
Tell an agent
Download the content of file {file} in upload {session}, defined role {role}'s resource, grant {grant} in {package}.
Fetch raw bytes for file {file}, session {session}, on defined role {role}'s resource, grant {grant}, {package}.
PUT
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}/$value
Overwrite a file in a defined role upload · Update media content for the navigation property files in identityGovernance
#
Ask an LLM
“Can I overwrite a file already uploaded to a defined role's resource?”
“How do I put new content into a defined role upload file?”
Tell an agent
Overwrite file {file} with new content in upload {session}, defined role {role}'s resource, grant {grant} in {package}.
Replace what is stored for file {file}, session {session}, on defined role {role}'s resource, grant {grant}, {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}/$value
Erase a file's content in a defined role upload · Delete media content for the navigation property files in identityGovernance
#
Ask an LLM
“Can I erase the stored content of a defined role upload file?”
“Is wiping a file's bytes in a defined role resource upload reversible?”
Tell an agent destructive · confirm first
Erase the stored bytes of file {file} in upload {session}, defined role {role}'s resource, grant {grant} in {package}.
Wipe file {file}'s content from session {session} on defined role {role}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/$count
Count files in a defined role upload · Get the number of the resource
#
Ask an LLM
“How many files are in a defined role resource upload session?”
“Can I get only the file total for an upload on a defined role's resource?”
Tell an agent
Count the files in upload {session} for defined role {role}'s resource, grant {grant} in {package}.
Tell me how many files session {session} holds, defined role {role}'s resource, grant {grant}, {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/microsoft.graph.uploadFile
Upload a file for a defined role's resource · Invoke action uploadFile
#
Ask an LLM
“How do I upload an access data file for a defined role's resource?”
“Can I add another file to an open defined role upload session?”
Tell an agent
Upload a file into session {session} for defined role {role}'s resource, grant {grant} in {package}.
Push an access data file to upload {session} on defined role {role}'s resource, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/{accessPackageResourceRole-id}/resource/uploadSessions/$count
Count uploads on a defined role's resource · Get the number of the resource
#
Ask an LLM
“How many upload sessions exist for a defined role's resource?”
“Can I get only the session total for a defined role's resource?”
Tell an agent
Count the upload sessions for defined role {role}'s resource, grant {grant} in {package}.
Tell me how many custom data uploads defined role {role}'s resource has, grant {grant}, {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/roles/$count
Count roles offered by a grant scope's host · Get the number of the resource
#
Ask an LLM
“How many roles does the scope-hosting resource of a grant offer?”
“Is there a quick count of roles on a grant scope's host?”
Tell an agent
Count roles offered by the scope-hosting resource for grant {grant} in {package}.
Tell me the number of roles grant {grant}'s scope host has, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/scopes
List scopes within a grant scope's host · Get scopes from identityGovernance
#
Ask an LLM
“Which scopes exist within the scope-hosting resource of a grant?”
“Can I see sibling scopes on the resource hosting a grant's scope?”
Tell an agent
List scopes within the scope-hosting resource for grant {grant} in {package}.
Show every scope inside grant {grant}'s scope host, package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/scopes
Add a scope within a grant scope's host · Create new navigation property to scopes for identityGovernance
#
Ask an LLM
“Can I add a scope within the scope-hosting resource?”
“How do I flag a new scope on a grant scope's host as root?”
Tell an agent
Add scope {name} within the scope-hosting resource for grant {grant} in {package}.
Create a scope on grant {grant}'s scope host with isRootScope {isRootScope}, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/scopes/{accessPackageResourceScope-id}
Get a scope within a grant scope's host · Get scopes from identityGovernance
#
Ask an LLM
“Can I read one scope within the scope-hosting resource?”
“Is a given scope on a grant scope's host the root scope?”
Tell an agent
Get scope {scope}, one of the scopes within the scope-hosting resource for grant {grant} in {package}.
Show scope {scope} on grant {grant}'s scope host, package {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/scopes/{accessPackageResourceScope-id}
Update a scope within a grant scope's host · Update the navigation property scopes in identityGovernance
#
Ask an LLM
“Can I rename a scope within the scope-hosting resource?”
“Which scope fields on a grant scope's host are patchable?”
Tell an agent
Give scope {scope} inside the scope-hosting resource the new name {name}, grant {grant} in {package}.
Update scope {scope}'s description to {description} on grant {grant}'s scope host, package {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/scopes/{accessPackageResourceScope-id}
Delete a scope within a grant scope's host · Delete navigation property scopes for identityGovernance
#
Ask an LLM
“Can I delete a scope within the scope-hosting resource?”
“What happens when a scope on a grant scope's host is removed?”
Tell an agent destructive · confirm first
Delete scope {scope} within the scope-hosting resource for grant {grant} in {package}.
Remove scope {scope} from grant {grant}'s scope host, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/scopes/$count
Count scopes within a grant scope's host · Get the number of the resource
#
Ask an LLM
“How many scopes exist within the scope-hosting resource of a grant?”
“Can I get just the scope count on a grant scope's host?”
Tell an agent
Count scopes within the scope-hosting resource for grant {grant} in {package}.
Tell me the number of scopes on grant {grant}'s scope host, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions
List uploads on a grant scope's host · Get uploadSessions from identityGovernance
#
Ask an LLM
“Which custom data upload sessions exist for the scope-hosting resource of a grant?”
“Can I review bring-your-own-data uploads sent to a grant scope's host?”
Tell an agent
List upload sessions for the scope-hosting resource of grant {grant} in {package}.
Show custom data uploads made to grant {grant}'s scope host, package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions
Start an upload on a grant scope's host · Create new navigation property to uploadSessions for identityGovernance
#
Ask an LLM
“How do I start an external access data upload for the scope-hosting resource?”
“Can a new upload for a grant scope's host carry my reference ID?”
Tell an agent
Start an upload session with reference ID {referenceId} for the scope-hosting resource of grant {grant} in {package}.
Open a new custom data upload on grant {grant}'s scope host, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}
Get an upload on a grant scope's host · Get uploadSessions from identityGovernance
#
Ask an LLM
“What is the status of one upload session on the scope-hosting resource?”
“Has a particular upload to a grant scope's host finished processing?”
Tell an agent
Get upload session {session} for the scope-hosting resource of grant {grant} in {package}.
Check the stats of custom data upload {session} on grant {grant}'s scope host, package {package}.
PATCH
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}
Update an upload on a grant scope's host · Update the navigation property uploadSessions in identityGovernance
#
Ask an LLM
“How do I mark an upload to the scope-hosting resource as done?”
“Can I change the reference ID of an upload on a grant scope's host?”
Tell an agent
Set isUploadDone to {isUploadDone} on upload session {session} for the scope-hosting resource of grant {grant} in {package}.
Change upload {session}'s reference ID to {referenceId} on grant {grant}'s scope host, package {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}
Delete an upload on a grant scope's host · Delete navigation property uploadSessions for identityGovernance
#
Ask an LLM
“Can I discard an upload session for the scope-hosting resource?”
“What happens to files when an upload to a grant scope's host is deleted?”
Tell an agent destructive · confirm first
Delete upload session {session} for the scope-hosting resource of grant {grant} in {package}.
Discard the custom data upload {session} on grant {grant}'s scope host, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files
List files in an upload to a grant scope's host · Get files from identityGovernance
#
Ask an LLM
“Which files were sent in an upload for the scope-hosting resource?”
“Can I list the files inside an upload session on a grant scope's host?”
Tell an agent
List files in upload {session} for the scope-hosting resource of grant {grant} in {package}.
Show every uploaded file of session {session} on grant {grant}'s scope host, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}
Get a file record uploaded to a grant scope's host · Get files from identityGovernance
#
Ask an LLM
“Can I read one file record from an upload to the scope-hosting resource?”
“What metadata does a file uploaded to a grant scope's host carry?”
Tell an agent
Get file {file} of upload {session} for the scope-hosting resource of grant {grant} in {package}.
Show the record for file {file} in session {session}, grant {grant}'s scope host, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}/$value
Download a file uploaded to a grant scope's host · Get media content for the navigation property files from identityGovernance
#
Ask an LLM
“Can I download the bytes of a file uploaded to the scope-hosting resource?”
“How do I retrieve the raw content of a file sent to a grant scope's host?”
Tell an agent
Download the content of file {file} in upload {session}, scope-hosting resource of grant {grant} in {package}.
Fetch raw bytes for file {file}, session {session}, on grant {grant}'s scope host, package {package}.
PUT
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}/$value
Overwrite a file uploaded to a grant scope's host · Update media content for the navigation property files in identityGovernance
#
Ask an LLM
“Can I overwrite a file already uploaded to the scope-hosting resource?”
“How do I put new content into a file sent to a grant scope's host?”
Tell an agent
Overwrite file {file} with new content in upload {session}, scope-hosting resource of grant {grant} in {package}.
Replace what is stored for file {file}, session {session}, on grant {grant}'s scope host, package {package}.
DELETE
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/{customDataProvidedResourceFile-id}/$value
Erase a file uploaded to a grant scope's host · Delete media content for the navigation property files in identityGovernance
#
Ask an LLM
“Can I erase the stored content of a file uploaded to the scope-hosting resource?”
“Is wiping a file's bytes on a grant scope's host reversible?”
Tell an agent destructive · confirm first
Erase the stored bytes of file {file} in upload {session}, scope-hosting resource of grant {grant} in {package}.
Wipe file {file}'s content from session {session} on grant {grant}'s scope host, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/files/$count
Count files in an upload to a grant scope's host · Get the number of the resource
#
Ask an LLM
“How many files are in an upload session on the scope-hosting resource?”
“Can I get only the file total for an upload to a grant scope's host?”
Tell an agent
Count the files in upload {session} for the scope-hosting resource of grant {grant} in {package}.
Tell me how many files session {session} holds, grant {grant}'s scope host, package {package}.
POST
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions/{customDataProvidedResourceUploadSession-id}/microsoft.graph.uploadFile
Upload a file for a grant scope's host · Invoke action uploadFile
#
Ask an LLM
“How do I upload an access data file for the scope-hosting resource?”
“Can I add another file to an open upload on a grant scope's host?”
Tell an agent
Upload a file into session {session} for the scope-hosting resource of grant {grant} in {package}.
Push an access data file to upload {session} on grant {grant}'s scope host, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}/scope/resource/uploadSessions/$count
Count uploads on a grant scope's host · Get the number of the resource
#
Ask an LLM
“How many upload sessions exist for the scope-hosting resource of a grant?”
“Can I get only the session total for a grant scope's host?”
Tell an agent
Count the upload sessions for the scope-hosting resource of grant {grant} in {package}.
Tell me how many custom data uploads grant {grant}'s scope host has, package {package}.
GET
/identityGovernance/entitlementManagement/accessPackages/{accessPackage-id}/resourceRoleScopes/$count
Count the resource grants in a package · Get the number of the resource
#
Ask an LLM
“How many resource roles does this access package grant in total?”
“Can I get only the number of role-and-scope pairings in a package?”
Tell an agent
Count the resource grants in access package {package}.
Tell me how many resource role scopes package {package} contains.
GET
/identityGovernance/entitlementManagement/accessPackages/$count
Count access packages · Get the number of the resource
#
Ask an LLM
“How many access packages exist in the tenant?”
“Is there a quick way to get the total number of access packages?”
Tell an agent
Count all access packages.
Give me the total number of access packages in entitlement management.
GET
/identityGovernance/entitlementManagement/accessPackages/microsoft.graph.filterByCurrentUser(on='{on}')
List access packages I can request · Invoke function filterByCurrentUser
#
Ask an LLM
“Which access packages am I, the signed-in user, allowed to request?”
“Can I filter the access package list to the ones that apply to me?”
Tell an agent
List the access packages where I am the {on}.
Show access packages filtered to the current user as {on}.
GET
/identityGovernance/entitlementManagement/accessPackageSuggestions
List suggested access packages · Get accessPackageSuggestions from identityGovernance
#
Ask an LLM
“What access packages are being suggested to end users?”
“Can I see package suggestions based on related people and assignment history?”
Tell an agent
List all access package suggestions.
Show the suggested access packages and their reasons.
POST
/identityGovernance/entitlementManagement/accessPackageSuggestions
Create an access package suggestion · Create new navigation property to accessPackageSuggestions for…
#
Ask an LLM
“Can I add a suggestion record that points users to an access package?”
“What goes into a new package suggestion, such as reasons?”
Tell an agent
Create a suggestion for access package {packageBody}.
Add a package suggestion with reasons {reasons}.
GET
/identityGovernance/entitlementManagement/accessPackageSuggestions/{accessPackageSuggestion-id}
Get an access package suggestion · Get accessPackageSuggestions from identityGovernance
#
Ask an LLM
“Why was a specific access package suggested?”
“Can I read one suggestion record and its reasons?”
Tell an agent
Get access package suggestion {suggestion}.
Show the reasons behind suggestion {suggestion}.
PATCH
/identityGovernance/entitlementManagement/accessPackageSuggestions/{accessPackageSuggestion-id}
Update an access package suggestion · Update the navigation property accessPackageSuggestions in identityGovernance
#
Ask an LLM
“Can I change the reasons recorded on a package suggestion?”
“Is it possible to repoint an existing suggestion to a different access package?”
Tell an agent
Update the reasons on suggestion {suggestion} to {reasons}.
Point suggestion {suggestion} at access package {packageBody}.
DELETE
/identityGovernance/entitlementManagement/accessPackageSuggestions/{accessPackageSuggestion-id}
Delete an access package suggestion · Delete navigation property accessPackageSuggestions for identityGovernance
#
Ask an LLM
“Can I remove a suggestion so users stop seeing a package recommended?”
“Is deleting an access package suggestion permanent?”
Tell an agent destructive · confirm first
Delete access package suggestion {suggestion}.
Remove the package recommendation {suggestion}.
GET
/identityGovernance/entitlementManagement/accessPackageSuggestions/{accessPackageSuggestion-id}/accessPackage
Get the package behind a suggestion · Get accessPackage from identityGovernance
#
Ask an LLM
“Which access package does a given suggestion recommend?”
“Can I read the full package details straight from a suggestion?”
Tell an agent
Get the access package recommended by suggestion {suggestion}.
Show which package suggestion {suggestion} points to.
GET
/identityGovernance/entitlementManagement/accessPackageSuggestions/$count
Count access package suggestions · Get the number of the resource
#
Ask an LLM
“How many access package suggestions are there?”
“Can I get only the total number of package suggestions?”
Tell an agent
Count all access package suggestions.
Tell me how many package recommendations exist.
GET
/identityGovernance/entitlementManagement/accessPackageSuggestions/microsoft.graph.filterByCurrentUser(on='{on}')
List packages suggested for me · Invoke function filterByCurrentUser
#
Ask an LLM
“Which access packages are recommended for me personally?”
“Can I get suggestions tailored to my role and assignment history as the signed-in user?”
Tell an agent
List the package suggestions for me as {on}.
Show access package suggestions filtered to the current user as {on}.
GET
/identityGovernance/entitlementManagement/assignmentPolicies
List all assignment policies · List assignmentPolicies
#
Ask an LLM
“What assignment policies exist across all access packages in the tenant?”
“Can I filter the tenant-wide policy list by display name?”
Tell an agent
List every access package assignment policy in the tenant.
Show all assignment policies across entitlement management.
POST
/identityGovernance/entitlementManagement/assignmentPolicies
Create an assignment policy · Create assignmentPolicies
#
Ask an LLM
“How do I create a new access package assignment policy at the top level?”
“Which settings, like allowed target scope and expiration, can a new policy define?”
Tell an agent
Create an assignment policy named {name} for access package {packageBody}.
Create a policy {name} with target scope {targetScope} and expiration {expiration}.
GET
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}
Get an assignment policy · Get accessPackageAssignmentPolicy
#
Ask an LLM
“Where can I read the full properties of an access package assignment policy by ID?”
“Can I expand a policy to see its questions and custom extension stages?”
Tell an agent
Get assignment policy {policy}.
Show policy {policy} with its questions expanded.
PUT
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}
Replace an assignment policy · Update accessPackageAssignmentPolicy
#
Ask an LLM
“How do I update the display name or description of an assignment policy?”
“Does changing an assignment policy require sending the whole object?”
Tell an agent
Update assignment policy {policy} with display name {name}.
Replace the description of policy {policy} with {description}.
DELETE
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}
Delete an assignment policy · Delete accessPackageAssignmentPolicy
#
Ask an LLM
“Can I delete an access package assignment policy directly by its ID?”
“What happens to pending requests when an assignment policy is deleted?”
Tell an agent destructive · confirm first
Delete assignment policy {policy}.
Remove access package policy {policy} from entitlement management.
GET
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/accessPackage
Get the package a policy belongs to · Get accessPackage from identityGovernance
#
Ask an LLM
“Which access package does this assignment policy control?”
“Can I go from a policy ID straight to its access package?”
Tell an agent
Get the access package for assignment policy {policy}.
Show which package policy {policy} governs.
GET
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/catalog
Get the catalog of a policy's package · Get catalog from identityGovernance
#
Ask an LLM
“Which catalog holds the access package that this policy governs?”
“Can I look up the catalog directly from an assignment policy ID?”
Tell an agent
Get the catalog for assignment policy {policy}.
Show which catalog policy {policy} falls under.
GET
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings
List custom extension stages on a policy · Get customExtensionStageSettings from identityGovernance
#
Ask an LLM
“At which stages does an assignment policy call custom workflow extensions?”
“Can I list a policy's Logic App triggers without going through its access package?”
Tell an agent
List the custom extension stage settings of assignment policy {policy}.
Show when assignment policy {policy} runs custom extensions.
POST
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings
Add a custom extension stage to a policy · Create new navigation property to customExtensionStageSettings for…
#
Ask an LLM
“How do I make an assignment policy run a custom extension when a request is granted?”
“Can I attach a workflow extension to a policy by the policy ID alone?”
Tell an agent
Add custom extension {extension} at stage {trigger} to assignment policy {policy}.
Create an extension trigger for stage {trigger} on assignment policy {policy}.
GET
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings/{customExtensionStageSetting-id}
Get a custom extension stage on a policy · Get customExtensionStageSettings from identityGovernance
#
Ask an LLM
“What stage does one custom extension setting on an assignment policy fire at?”
“Can I read a single extension trigger of a policy by its ID?”
Tell an agent
Get custom extension stage setting {setting} of assignment policy {policy}.
Show extension trigger {setting} on assignment policy {policy}.
PATCH
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings/{customExtensionStageSetting-id}
Update a custom extension stage on a policy · Update the navigation property customExtensionStageSettings in…
#
Ask an LLM
“Can I move a policy's custom extension to run at a different stage?”
“Is it possible to swap which extension an assignment policy trigger calls?”
Tell an agent
Change extension trigger {setting} on assignment policy {policy} to stage {trigger}.
Point stage setting {setting} of assignment policy {policy} to custom extension {extension}.
DELETE
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings/{customExtensionStageSetting-id}
Remove a custom extension stage from a policy · Delete navigation property customExtensionStageSettings for identityGovernance
#
Ask an LLM
“Can I stop an assignment policy from calling a workflow extension at a stage?”
“Is removing an extension trigger from a policy permanent?”
Tell an agent destructive · confirm first
Delete custom extension stage setting {setting} from assignment policy {policy}.
Remove extension trigger {setting} on assignment policy {policy}.
GET
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings/{customExtensionStageSetting-id}/customExtension
Get the extension a policy stage runs · Get customExtension from identityGovernance
#
Ask an LLM
“Which custom workflow extension runs at this stage of an assignment policy?”
“Can I read the Logic App endpoint behind a policy's extension trigger?”
Tell an agent
Get the custom extension run by stage setting {setting} of assignment policy {policy}.
Show which workflow extension trigger {setting} on assignment policy {policy} calls.
GET
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/customExtensionStageSettings/$count
Count custom extension stages on a policy · Get the number of the resource
#
Ask an LLM
“How many custom extension triggers does an assignment policy have?”
“Can I get only the number of extension stage settings for a policy ID?”
Tell an agent
Count the custom extension stage settings on assignment policy {policy}.
Tell me how many extension triggers assignment policy {policy} has.
GET
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/questions
List requestor questions on a policy · Get questions from identityGovernance
#
Ask an LLM
“What questions does an assignment policy ask requestors?”
“Can I list a policy's questions in order without going through its package?”
Tell an agent
List the requestor questions on assignment policy {policy}.
Show every question assignment policy {policy} asks.
POST
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/questions
Add a requestor question to a policy · Create new navigation property to questions for identityGovernance
#
Ask an LLM
“How do I add a required question to an assignment policy by policy ID?”
“Can I set the display order of a new question on a policy?”
Tell an agent
Add question {text} to assignment policy {policy}.
Create question {text} in position {sequence} on assignment policy {policy}.
GET
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/questions/{accessPackageQuestion-id}
Get a requestor question on a policy · Get questions from identityGovernance
#
Ask an LLM
“Can I read one question of an assignment policy by its ID?”
“Is a particular policy question editable after the requestor answers?”
Tell an agent
Get question {question} on assignment policy {policy}.
Show whether policy question {question} on {policy} lets requestors edit answers.
PATCH
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/questions/{accessPackageQuestion-id}
Edit a requestor question on a policy · Update the navigation property questions in identityGovernance
#
Ask an LLM
“Can I reword a question on an assignment policy?”
“Is it possible to make an existing policy question required?”
Tell an agent
Reword question {question} on assignment policy {policy} to {text}.
Set isRequired to {isRequired} on question {question} of assignment policy {policy}.
DELETE
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/questions/{accessPackageQuestion-id}
Remove a requestor question from a policy · Delete navigation property questions for identityGovernance
#
Ask an LLM
“Can I delete a question from an assignment policy directly?”
“Will requestors stop seeing a question once it is removed from the policy?”
Tell an agent destructive · confirm first
Delete question {question} from assignment policy {policy}.
Drop requestor question {question} on assignment policy {policy}.
GET
/identityGovernance/entitlementManagement/assignmentPolicies/{accessPackageAssignmentPolicy-id}/questions/$count
Count requestor questions on a policy · Get the number of the resource
#
Ask an LLM
“How many questions does an assignment policy ask?”
“Can I get just the question count for a policy ID?”
Tell an agent
Count the questions on assignment policy {policy}.
Give me the requestor question total for assignment policy {policy}.
GET
/identityGovernance/entitlementManagement/assignmentPolicies/$count
Count access package assignment policies · Get the number of the resource
#
Ask an LLM
“How many access package assignment policies are defined in my Entra tenant?”
“Can I count only the assignment policies that match a filter?”
Tell an agent
Count the access package assignment policies in my tenant.
Count assignment policies matching {filter}.
GET
/identityGovernance/entitlementManagement/assignmentRequests
List access package requests · List assignmentRequests
#
Ask an LLM
“Where can I see every access package request, current and expired, across all catalogs?”
“Can I filter access package requests by state or requestor?”
Tell an agent
List every access package assignment request.
List access package requests matching {filter}.
POST
/identityGovernance/entitlementManagement/assignmentRequests
Request or assign an access package · Create accessPackageAssignmentRequest
#
Ask an LLM
“How do I request an access package for a user in Microsoft Entra?”
“Can an admin assign, update or remove someone's access package by filing a request?”
Tell an agent
Submit an access package request of type {requestType} with justification {justification}.
File a new access request, giving {justification} as the business reason.
GET
/identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequest-id}
Get an access package request · Get accessPackageAssignmentRequest
#
Ask an LLM
“What is the current state of one specific access package request?”
“Where do I see the answers and schedule submitted on a single access request?”
Tell an agent
Show access package request {request}.
Get the status and justification of access request {request}.
PATCH
/identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequest-id}
Update an access package request · Update the navigation property assignmentRequests in identityGovernance
#
Ask an LLM
“Can I edit the justification on an access package request after submitting it?”
“Is it possible to patch the state recorded on an existing access request?”
Tell an agent
Update access request {request} with justification {justification}.
Set the state of access request {request} to {state}.
DELETE
/identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequest-id}
Delete a denied or completed access request · Delete accessPackageAssignmentRequest
#
Ask an LLM
“Can I remove an access package request that was denied or already completed?”
“Why can't I delete an access request that still has assignments attached?”
Tell an agent destructive · confirm first
Delete access package request {request}.
Purge the denied access request {request}.
GET
/identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequest-id}/accessPackage
Get the package an access request is for · Get accessPackage from identityGovernance
#
Ask an LLM
“Which access package was a given access request asking for?”
“What package definition sits behind a user's pending request?”
Tell an agent
Show the access package that request {request} asks for.
Get package details behind access request {request}.
GET
/identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequest-id}/assignment
Get the assignment an access request affects · Get assignment from identityGovernance
#
Ask an LLM
“What assignment did an access package request create or remove?”
“Can I see the resulting assignment for an approved access request?”
Tell an agent
Show the assignment produced by access request {request}.
Get the access package assignment linked to request {request}.
POST
/identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequest-id}/microsoft.graph.cancel
Cancel a pending access package request · Invoke action cancel
#
Ask an LLM
“How do I cancel an access package request still awaiting approval?”
“Which request states can still be cancelled, like pendingApproval or accepted?”
Tell an agent destructive · confirm first
Cancel access package request {request}.
Withdraw the pending access request {request} before it is approved.
POST
/identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequest-id}/microsoft.graph.reprocess
Retry a failed access package request · Invoke action reprocess
#
Ask an LLM
“Can I retry a user's access request that ended in DeliveryFailed?”
“Is there a 14-day limit on reprocessing a partially delivered request?”
Tell an agent
Reprocess access request {request}.
Retry delivery of the failed access package request {request}.
POST
/identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequest-id}/microsoft.graph.resume
Resume a request waiting on a custom extension · Invoke action resume
#
Ask an LLM
“How do I resume an access request that's waiting for a custom extension callback?”
“Can my workflow tell entitlement management to continue a request stuck in WaitingForCallback?”
Tell an agent
Resume access request {request} now that the custom extension has finished.
Resume paused request {request} with callback source {source} and type {type}.
GET
/identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequest-id}/requestor
Get who submitted an access request · Get requestor from identityGovernance
#
Ask an LLM
“Who submitted a particular access package request?”
“For a direct admin assignment, which subject was assigned in the request?”
Tell an agent
Show who requested access in request {request}.
Get the requestor of access package request {request}.
GET
/identityGovernance/entitlementManagement/assignmentRequests/$count
Count access package requests · Get the number of the resource
#
Ask an LLM
“How many access package requests exist right now?”
“Can I count only the access requests matching a search phrase?”
Tell an agent
Count all access package assignment requests.
Count access requests matching {filter}.
GET
/identityGovernance/entitlementManagement/assignmentRequests/microsoft.graph.filterByCurrentUser(on='{on}')
List my own access package requests · Invoke function filterByCurrentUser
#
Ask an LLM
“Which access package requests did I personally submit?”
“Can I see only the access requests where I'm the target rather than the creator?”
Tell an agent
List access package requests filtered on me as {on}.
Show my own access requests where I am the {on}.
GET
/identityGovernance/entitlementManagement/assignments
List access package assignments · List assignments
#
Ask an LLM
“Who currently holds access package assignments in my tenant?”
“Do catalog-scoped admins need to filter assignments by a specific access package?”
Tell an agent
List all access package assignments.
List access package assignments matching {filter}.
POST
/identityGovernance/entitlementManagement/assignments
Create an access package assignment record · Create new navigation property to assignments for identityGovernance
#
Ask an LLM
“Can I add an access package assignment record directly instead of through a request?”
“Is it possible to set an expiry date when adding an assignment record?”
Tell an agent
Create an access package assignment expiring at {expires}.
Add a new assignment record in state {state}.
GET
/identityGovernance/entitlementManagement/assignments/{accessPackageAssignment-id}
Get an access package assignment · Get accessPackageAssignment
#
Ask an LLM
“What are the details of one specific access package assignment?”
“When does a particular user's access package assignment expire?”
Tell an agent
Show access package assignment {assignment}.
Get the schedule and state of assignment {assignment}.
PATCH
/identityGovernance/entitlementManagement/assignments/{accessPackageAssignment-id}
Update an access package assignment · Update the navigation property assignments in identityGovernance
#
Ask an LLM
“Can I change the expiration date on an existing access package assignment?”
“Is there a way to patch the state of an assignment?”
Tell an agent
Update assignment {assignment} to expire at {expires}.
Set assignment {assignment} state to {state}.
DELETE
/identityGovernance/entitlementManagement/assignments/{accessPackageAssignment-id}
Delete an access package assignment · Delete navigation property assignments for identityGovernance
#
Ask an LLM
“Can I delete an access package assignment record outright?”
“What's the way to clear a stale assignment out of entitlement management?”
Tell an agent destructive · confirm first
Delete access package assignment {assignment}.
Erase stale assignment {assignment}.
GET
/identityGovernance/entitlementManagement/assignments/{accessPackageAssignment-id}/accessPackage
Get the package an assignment grants · Get accessPackage from identityGovernance
#
Ask an LLM
“Which access package does a given assignment grant?”
“Where do I see the package behind a user's current assignment?”
Tell an agent
Show the access package granted by assignment {assignment}.
Get package details for assignment {assignment}.
GET
/identityGovernance/entitlementManagement/assignments/{accessPackageAssignment-id}/assignmentPolicy
Get the policy behind an assignment · Get assignmentPolicy from identityGovernance
#
Ask an LLM
“Which policy governs a given access package assignment?”
“What approval and expiry rules apply to one user's assignment?”
Tell an agent
Show the assignment policy behind assignment {assignment}.
Get the policy that assignment {assignment} was created under.
POST
/identityGovernance/entitlementManagement/assignments/{accessPackageAssignment-id}/microsoft.graph.reprocess
Re-evaluate and enforce an assignment · Invoke action reprocess
#
Ask an LLM
“Can I re-enforce a delivered access package assignment whose resource access drifted?”
“What role do I need to reprocess a user's assignment?”
Tell an agent
Reprocess assignment {assignment}.
Re-apply resource access for delivered assignment {assignment}.
GET
/identityGovernance/entitlementManagement/assignments/{accessPackageAssignment-id}/target
Get who an assignment is for · Get target from identityGovernance
#
Ask an LLM
“Who is the subject of an access package assignment?”
“Which user or service principal holds a particular assignment?”
Tell an agent
Show the target subject of assignment {assignment}.
Get who assignment {assignment} was granted to.
GET
/identityGovernance/entitlementManagement/assignments/$count
Count access package assignments · Get the number of the resource
#
Ask an LLM
“How many access package assignments are there in total?”
“Can I count only assignments that match a filter?”
Tell an agent
Count all access package assignments.
Count assignments matching {filter}.
GET
/identityGovernance/entitlementManagement/assignments/microsoft.graph.additionalAccess()
List assignments flagged as additional access · Invoke function additionalAccess
#
Ask an LLM
“Which access package assignments give users extra access through packages marked incompatible, across the whole tenant?”
“Can I page through every additional-access assignment without naming two specific packages?”
Tell an agent
List all access package assignments that count as additional access, without picking specific packages.
Show the first {top} additional-access assignments across entitlement management.
GET
/identityGovernance/entitlementManagement/assignments/microsoft.graph.additionalAccess(accessPackageId='{accessPackageId}',incompatibleAccessPackageId='{incompatibleAccessPackageId}')
Find users holding two specific access packages · Invoke function additionalAccess
#
Ask an LLM
“Can I check who holds a given access package and also a specific incompatible one?”
“Which targets are assigned both packages I plan to mark incompatible?”
Tell an agent
List users assigned {packageId} who also hold incompatible package {incompatibleId}.
Check overlap between access package {packageId} and {incompatibleId}.
GET
/identityGovernance/entitlementManagement/assignments/microsoft.graph.filterByCurrentUser(on='{on}')
List my own access package assignments · Invoke function filterByCurrentUser
#
Ask an LLM
“Which access package assignments do I personally have?”
“Can I see just the assignments targeted at me?”
Tell an agent
List my access package assignments filtered on {on}.
Show assignments where I am the {on}.
GET
/identityGovernance/entitlementManagement/availableAccessPackages
List access packages users can request · Get availableAccessPackages from identityGovernance
#
Ask an LLM
“Which access packages can end users browse and request?”
“What does the self-service list of requestable packages contain?”
Tell an agent
List the access packages available for users to request.
Show available access packages matching {filter}.
POST
/identityGovernance/entitlementManagement/availableAccessPackages
Add an available access package entry · Create new navigation property to availableAccessPackages for identityGovernance
#
Ask an LLM
“Can I add an entry to the list of requestable access packages?”
“Is it possible to give a new available package a description when adding it?”
Tell an agent
Add an available access package named {name}.
Create an available access package called {name} described as {description}.
GET
/identityGovernance/entitlementManagement/availableAccessPackages/{availableAccessPackage-id}
Get an available access package · Get availableAccessPackages from identityGovernance
#
Ask an LLM
“What does one requestable access package offer end users?”
“Where do I read the name and description of a single browsable package?”
Tell an agent
Show available access package {available}.
Get the name and description of requestable package {available}.
PATCH
/identityGovernance/entitlementManagement/availableAccessPackages/{availableAccessPackage-id}
Update an available access package · Update the navigation property availableAccessPackages in identityGovernance
#
Ask an LLM
“Can I rename a package on the requestable list?”
“Is there a way to fix the description users see on an available package?”
Tell an agent
Rename available access package {available} to {name}.
Update the description of available package {available} to {description}.
DELETE
/identityGovernance/entitlementManagement/availableAccessPackages/{availableAccessPackage-id}
Remove an available access package entry · Delete navigation property availableAccessPackages for identityGovernance
#
Ask an LLM
“Can I take a package off the list end users browse to request?”
“What happens if I delete an available access package entry?”
Tell an agent destructive · confirm first
Delete available access package {available}.
Take requestable package {available} off the browse list.
GET
/identityGovernance/entitlementManagement/availableAccessPackages/{availableAccessPackage-id}/resourceRoleScopes
List roles an available package grants · List resourceRoleScopes
#
Ask an LLM
“What resource roles and scopes does a requestable access package grant?”
“Before requesting a package, can a user see which roles it includes?”
Tell an agent
List resource role scopes of available package {available}.
Show which roles and scopes available access package {available} includes.
GET
/identityGovernance/entitlementManagement/availableAccessPackages/{availableAccessPackage-id}/resourceRoleScopes/{accessPackageResourceRoleScope-id}
Get one role scope of an available package · Get resourceRoleScopes from identityGovernance
#
Ask an LLM
“Can I inspect a single resource role scope on a requestable package?”
“What role and scope does one entry of an available package point to?”
Tell an agent
Show resource role scope {rrs} of available package {available}.
Get role scope entry {rrs} on requestable package {available}.
GET
/identityGovernance/entitlementManagement/availableAccessPackages/{availableAccessPackage-id}/resourceRoleScopes/$count
Count role scopes of an available package · Get the number of the resource
#
Ask an LLM
“How many resource role scopes does a requestable package bundle?”
“Can I count the role scopes in an available access package with a filter?”
Tell an agent
Count resource role scopes in available package {available}.
Tally role scopes of requestable package {available} matching {filter}.
GET
/identityGovernance/entitlementManagement/availableAccessPackages/$count
Count available access packages · Get the number of the resource
#
Ask an LLM
“How many access packages are available for users to request?”
“Can I count only the requestable packages matching a search?”
Tell an agent
Count the access packages available to request.
Count requestable packages matching {search}.
GET
/identityGovernance/entitlementManagement/catalogs
List access package catalogs · List catalogs
#
Ask an LLM
“Which access package catalogs exist in my tenant?”
“Can I filter catalogs by name or external visibility?”
Tell an agent
List all access package catalogs.
List catalogs matching {filter}.
POST
/identityGovernance/entitlementManagement/catalogs
Create an access package catalog · Create accessPackageCatalog
#
Ask an LLM
“How do I create a new catalog to hold access packages and resources?”
“Can I make a catalog visible to users from outside my organization when I create it?”
Tell an agent
Create an access package catalog named {name}.
Create catalog {name} with external visibility set to {external}.
GET
/identityGovernance/entitlementManagement/catalogs/{accessPackageCatalog-id}
Get an access package catalog · Get accessPackageCatalog
#
Ask an LLM
“What are the properties of one access package catalog?”
“Is a particular catalog published and externally visible?”
Tell an agent
Show access package catalog {catalog}.
Get the state and visibility of catalog {catalog}.