Microsoft Entra ID (formerly Azure AD)

Microsoft Entra ID (formerly Azure AD) Identity Governance.privileged Access Root API

The identityGovernance.privilegedAccessRoot API from Microsoft Entra ID (formerly Azure AD) — 64 operation(s) for identitygovernance.privilegedaccessroot.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 92

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /identityGovernance/privilegedAccess Get the privileged access root · Get privilegedAccess from identityGovernance #
Ask an LLM
“What does the privileged access root in identity governance expose?”
“Is PIM for Groups reachable under the privileged access object?”
Tell an agent
Show the privileged access root for identity governance.
Fetch privileged access, expanding {expand}.
PATCH /identityGovernance/privilegedAccess Update the privileged access root · Update the navigation property privilegedAccess in identityGovernance #
Ask an LLM
“Can I patch the privileged access root object?”
“What can I change on the top-level privileged access object?”
Tell an agent
Update the privileged access root with this group payload: {group}.
Patch the privileged access root in identity governance.
DELETE /identityGovernance/privilegedAccess Delete the privileged access root · Delete navigation property privilegedAccess for identityGovernance #
Ask an LLM
“Can I remove the privilegedAccess navigation property from identity governance?”
“Is it possible to delete the whole privileged access container?”
Tell an agent destructive · confirm first
Delete the privileged access root from identity governance.
Remove privileged access only if its ETag still matches {etag}.
GET /identityGovernance/privilegedAccess/group Get the PIM for Groups container · Get group from identityGovernance #
Ask an LLM
“Where do I find the groups governed by Privileged Identity Management?”
“What PIM for Groups data sits under privileged access?”
Tell an agent
Show the PIM for Groups container under privileged access.
Get the PIM group container and expand {expand}.
PATCH /identityGovernance/privilegedAccess/group Update the PIM for Groups container · Update the navigation property group in identityGovernance #
Ask an LLM
“Can I patch the PIM for Groups container in one request?”
“Which collections can I set when updating the PIM group container?”
Tell an agent
Update the PIM for Groups container with these eligibility schedules: {schedules}.
Replace the container's assignment schedules with {schedules}.
DELETE /identityGovernance/privilegedAccess/group Delete the PIM for Groups container · Delete navigation property group for identityGovernance #
Ask an LLM
“Can I delete the PIM for Groups navigation property?”
“Is there a way to clear the governed-group container under privileged access?”
Tell an agent destructive · confirm first
Delete the PIM for Groups container.
Delete the PIM group container if it matches ETag {etag}.
GET /identityGovernance/privilegedAccess/group/assignmentApprovals List PIM group assignment approvals · Get assignmentApprovals from identityGovernance #
Ask an LLM
“Which approvals exist for PIM group assignment requests?”
“Can I page through group assignment approvals with top and skip?”
Tell an agent
List all PIM group assignment approvals.
List group assignment approvals matching {filter}.
POST /identityGovernance/privilegedAccess/group/assignmentApprovals Create a PIM group assignment approval · Create new navigation property to assignmentApprovals for identityGovernance #
Ask an LLM
“Can I create a new approval object for PIM group assignments?”
“What fields does a new group assignment approval take?”
Tell an agent
Create a PIM group assignment approval with stages {stages}.
Add a new assignment approval under PIM for Groups.
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/{approval-id} Get a PIM group assignment approval · Get assignmentApprovals from identityGovernance #
Ask an LLM
“How do I look up a single PIM group assignment approval by ID?”
“Can I read one assignment approval and choose which properties come back?”
Tell an agent
Get PIM group assignment approval {approval}.
Show approval {approval} with only {select}.
PATCH /identityGovernance/privilegedAccess/group/assignmentApprovals/{approval-id} Update a PIM group assignment approval · Update the navigation property assignmentApprovals in identityGovernance #
Ask an LLM
“Can I change the stages on an existing group assignment approval?”
“Is patching a PIM assignment approval I already have supported?”
Tell an agent
Update the stages of assignment approval {approval} to {stages}.
Patch PIM group assignment approval {approval}.
DELETE /identityGovernance/privilegedAccess/group/assignmentApprovals/{approval-id} Delete a PIM group assignment approval · Delete navigation property assignmentApprovals for identityGovernance #
Ask an LLM
“Can I delete a PIM group assignment approval?”
“Is an ETag needed to remove a specific assignment approval?”
Tell an agent destructive · confirm first
Delete assignment approval {approval}.
Remove group assignment approval {approval} if ETag {etag} matches.
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/{approval-id}/stages List stages of an assignment approval · Get stages from identityGovernance #
Ask an LLM
“What stages does a PIM group assignment approval go through?”
“Can I filter an approval's stages by status?”
Tell an agent
List the stages of approval {approval}.
Show stages of approval {approval} matching {filter}.
POST /identityGovernance/privilegedAccess/group/assignmentApprovals/{approval-id}/stages Add a stage to an assignment approval · Create new navigation property to stages for identityGovernance #
Ask an LLM
“Can I add a stage to a PIM group assignment approval?”
“What can I set on a new approval stage, like justification or reviewer?”
Tell an agent
Add a stage named {name} to approval {approval}.
Create a stage on approval {approval} with justification {justification}.
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/{approval-id}/stages/{approvalStage-id} Get one stage of an assignment approval · Get stages from identityGovernance #
Ask an LLM
“How do I read one stage of an assignment approval?”
“Who reviewed a particular approval stage and when?”
Tell an agent
Get stage {stage} of approval {approval}.
Show the review result of stage {stage} in approval {approval}, selecting {select}.
PATCH /identityGovernance/privilegedAccess/group/assignmentApprovals/{approval-id}/stages/{approvalStage-id} Review a stage of an assignment approval · Update the navigation property stages in identityGovernance #
Ask an LLM
“How do I approve or deny a stage of a PIM group assignment approval?”
“Can I add my justification when reviewing an approval stage?”
Tell an agent
Set the review result of stage {stage} on approval {approval} to {result}.
Update stage {stage} of approval {approval} with justification {justification}.
DELETE /identityGovernance/privilegedAccess/group/assignmentApprovals/{approval-id}/stages/{approvalStage-id} Delete a stage from an assignment approval · Delete navigation property stages for identityGovernance #
Ask an LLM
“Can I delete a stage from an assignment approval?”
“Is it possible to remove one approval stage by its ID?”
Tell an agent destructive · confirm first
Delete stage {stage} from approval {approval}.
Remove approval stage {stage} on {approval} if ETag {etag} matches.
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/{approval-id}/stages/$count Count stages of an assignment approval · Get the number of the resource #
Ask an LLM
“How many stages does a given assignment approval have?”
“Can I count an approval's stages that match a filter?”
Tell an agent
Count the stages on approval {approval}.
Count stages of approval {approval} matching {filter}.
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/$count Count PIM group assignment approvals · Get the number of the resource #
Ask an LLM
“How many PIM group assignment approvals are there?”
“Can I get just the total of assignment approvals without the records?”
Tell an agent
Count all PIM group assignment approvals.
Count assignment approvals where {filter}.
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/microsoft.graph.filterByCurrentUser(on='{on}') List my assignment approvals · Invoke function filterByCurrentUser #
Ask an LLM
“Which PIM group assignment approvals are waiting on me?”
“Can I see only the approvals that are in scope for me as a reviewer?”
Tell an agent
List the assignment approvals in scope for me as {on}.
Show my group assignment approvals as {on}, top {top}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances List active PIM group assignment instances · List assignmentScheduleInstances #
Ask an LLM
“Who currently has active membership or ownership through PIM for Groups?”
“Can I filter active group assignment instances by group?”
Tell an agent
List all active PIM group assignment instances.
List active assignment instances where {filter}.
POST /identityGovernance/privilegedAccess/group/assignmentScheduleInstances Create an active assignment instance · Create new navigation property to assignmentScheduleInstances for… #
Ask an LLM
“Can I create an assignment schedule instance record directly?”
“What fields go into a new active assignment instance, like memberType?”
Tell an agent
Create an active assignment instance for principal {principal} in group {group}.
Add an assignment instance with access {access} for group {group}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstance-id} Get an active assignment instance · Get privilegedAccessGroupAssignmentScheduleInstance #
Ask an LLM
“How do I read one active group assignment instance?”
“Which properties can I select on a single active assignment instance?”
Tell an agent
Get active assignment instance {instance}.
Show assignment instance {instance} selecting {select}.
PATCH /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstance-id} Update an active assignment instance · Update the navigation property assignmentScheduleInstances in identityGovernance #
Ask an LLM
“Can I change the member type on an existing active assignment instance?”
“Is patching an active assignment instance supported?”
Tell an agent
Update assignment instance {instance} to member type {memberType}.
Patch active assignment instance {instance} with group {group}.
DELETE /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstance-id} Delete an active assignment instance · Delete navigation property assignmentScheduleInstances for identityGovernance #
Ask an LLM
“Can I delete an active assignment instance object?”
“Does removing an assignment instance record need an ETag?”
Tell an agent destructive · confirm first
Delete active assignment instance {instance}.
Remove assignment instance {instance} if ETag {etag} matches.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstance-id}/activatedUsing Get the eligibility behind an active instance · Get activatedUsing from identityGovernance #
Ask an LLM
“Which eligibility was used to activate this active assignment instance?”
“Was an active assignment instance activated from an eligible schedule?”
Tell an agent
Show the eligibility that activated assignment instance {instance}.
Get activatedUsing for active instance {instance}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstance-id}/group Get the group of an active assignment instance · Get group from identityGovernance #
Ask an LLM
“Which group does an active assignment instance grant access to?”
“Can I see the group behind a given active assignment instance?”
Tell an agent
Get the group for active assignment instance {instance}.
Get {select} from the group behind active instance {instance}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstance-id}/group/serviceProvisioningErrors List group errors for an active instance · Get serviceProvisioningErrors property value #
Ask an LLM
“Are there provisioning errors on the group of an active assignment instance?”
“Can I list service provisioning errors for the group behind an assignment instance?”
Tell an agent
List provisioning errors on the group of assignment instance {instance}.
Show group provisioning errors for active instance {instance} matching {filter}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstance-id}/group/serviceProvisioningErrors/$count Count group errors for an active instance · Get the number of the resource #
Ask an LLM
“How many provisioning errors does the group of an active assignment instance have?”
“Can I count group provisioning errors for one active assignment instance?”
Tell an agent
Count provisioning errors on the group behind assignment instance {instance}.
Count group errors for active instance {instance} where {filter}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstance-id}/principal Get the principal of an active assignment · Get principal from identityGovernance #
Ask an LLM
“Who is the user or principal on an active assignment instance?”
“Can I see which principal holds a specific active group assignment?”
Tell an agent
Get the principal of assignment instance {instance}.
Show who holds active instance {instance}, selecting {select}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/$count Count active PIM group assignment instances · Get the number of the resource #
Ask an LLM
“How many active PIM group assignment instances are there?”
“Can I count active assignment instances matching a filter?”
Tell an agent
Count active PIM group assignment instances.
Count active assignment instances where {filter}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/microsoft.graph.filterByCurrentUser(on='{on}') List my active group assignments · Invoke function filterByCurrentUser #
Ask an LLM
“Which PIM groups am I actively a member or owner of right now?”
“Can I list only my own active assignment instances?”
Tell an agent
List my active group assignment instances as {on}.
Show my active assignment instances as {on}, ordered by {orderby}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests List PIM group assignment requests · List assignmentScheduleRequests #
Ask an LLM
“What membership and ownership assignment requests have been made for PIM groups?”
“Can I filter group assignment requests by principal?”
Tell an agent
List all PIM group assignment requests.
List assignment requests matching {filter}, ordered by {orderby}.
POST /identityGovernance/privilegedAccess/group/assignmentScheduleRequests Request a PIM group assignment · Create assignmentScheduleRequest #
Ask an LLM
“How do I request membership or ownership of a PIM-governed group?”
“Can I assign a user as a group member through a PIM request?”
Tell an agent
Request a group assignment for principal {principal} in group {group} with access {access}.
Submit an assignment request adding {principal} to group {group}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequest-id} Get a PIM group assignment request · Get privilegedAccessGroupAssignmentScheduleRequest #
Ask an LLM
“How do I check a single group assignment request?”
“Which properties can I pull from one assignment request?”
Tell an agent
Get assignment request {request}.
Show group assignment request {request} expanding {expand}.
PATCH /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequest-id} Update a PIM group assignment request · Update the navigation property assignmentScheduleRequests in identityGovernance #
Ask an LLM
“Can I edit an assignment request after it was submitted?”
“Is it possible to change the target schedule on an assignment request?”
Tell an agent
Update assignment request {request} to target schedule {schedule}.
Patch group assignment request {request} with principal {principal}.
DELETE /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequest-id} Delete a PIM group assignment request · Delete navigation property assignmentScheduleRequests for identityGovernance #
Ask an LLM
“Can I delete a group assignment request record?”
“Does deleting an assignment request require an If-Match ETag?”
Tell an agent destructive · confirm first
Delete group assignment request {request}.
Remove assignment request {request} when ETag is {etag}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequest-id}/activatedUsing Get the eligibility behind an assignment request · Get activatedUsing from identityGovernance #
Ask an LLM
“Which eligibility policy did an assignment request activate against?”
“Was this assignment request an activation of an eligible membership?”
Tell an agent
Show the eligibility behind assignment request {request}.
Get activatedUsing for group assignment request {request}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequest-id}/group Get the group of an assignment request · Get group from identityGovernance #
Ask an LLM
“Which group is an assignment request for?”
“Can I see the target group of a pending assignment request?”
Tell an agent
Get the group targeted by assignment request {request}.
Return just {select} for the group an assignment request {request} targets.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequest-id}/group/serviceProvisioningErrors List group errors for an assignment request · Get serviceProvisioningErrors property value #
Ask an LLM
“Does the group in an assignment request have provisioning errors?”
“Can I list federated service errors for the group on an assignment request?”
Tell an agent
List provisioning errors for the group on assignment request {request}.
Show errors on the requested group for {request}, top {top}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequest-id}/group/serviceProvisioningErrors/$count Count group errors for an assignment request · Get the number of the resource #
Ask an LLM
“How many provisioning errors are on the group of an assignment request?”
“Can I count provisioning errors tied to an assignment request's group?”
Tell an agent
Count provisioning errors for the group on assignment request {request}.
Count errors on the requested group of {request} matching {filter}.
POST /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequest-id}/microsoft.graph.cancel Cancel a PIM group assignment request · Invoke action cancel #
Ask an LLM
“Can I cancel a pending PIM group assignment request?”
“How do I withdraw a membership or ownership request I made?”
Tell an agent destructive · confirm first
Cancel group assignment request {request}.
Withdraw PIM assignment request {request}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequest-id}/principal Get the principal of an assignment request · Get principal from identityGovernance #
Ask an LLM
“Who is the principal named in an assignment request?”
“Can I see which user an assignment request is for?”
Tell an agent
Get the principal on assignment request {request}.
Show who assignment request {request} is for, selecting {select}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequest-id}/targetSchedule Get the schedule an assignment request created · Get targetSchedule from identityGovernance #
Ask an LLM
“What schedule did an assignment request create?”
“Can I get the assignment schedule produced by a request?”
Tell an agent
Get the target schedule of assignment request {request}.
Show the assignment schedule created by request {request}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/$count Count PIM group assignment requests · Get the number of the resource #
Ask an LLM
“How many PIM group assignment requests exist?”
“Can I count assignment requests without listing them?”
Tell an agent
Count PIM group assignment requests.
Count assignment requests where {filter}.
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/microsoft.graph.filterByCurrentUser(on='{on}') List my group assignment requests · Invoke function filterByCurrentUser #
Ask an LLM
“What PIM group assignment requests have I made?”
“Can I see only my own membership or ownership requests?”
Tell an agent
List my PIM group assignment requests as {on}.
Show my assignment requests as {on}, top {top}.
GET /identityGovernance/privilegedAccess/group/assignmentSchedules List PIM group assignment schedules · List assignmentSchedules #
Ask an LLM
“What assignment schedules exist for PIM-governed groups?”
“Can I sort assignment schedules by a property?”
Tell an agent
List all PIM group assignment schedules.
List assignment schedules sorted by {orderby}.
POST /identityGovernance/privilegedAccess/group/assignmentSchedules Create a PIM group assignment schedule · Create new navigation property to assignmentSchedules for identityGovernance #
Ask an LLM
“Can I create an assignment schedule object directly?”
“Which values can I set on a new assignment schedule, such as assignmentType?”
Tell an agent
Create an assignment schedule for {principal} on group {group}.
Add an assignment schedule with type {type} and access {access}.
GET /identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentSchedule-id} Get a PIM group assignment schedule · Get privilegedAccessGroupAssignmentSchedule #
Ask an LLM
“How do I read one PIM group assignment schedule?”
“Can I expand related objects when fetching an assignment schedule?”
Tell an agent
Get assignment schedule {schedule}.
Show assignment schedule {schedule} expanding {expand}.
PATCH /identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentSchedule-id} Update a PIM group assignment schedule · Update the navigation property assignmentSchedules in identityGovernance #
Ask an LLM
“Can I change the assignment type on an assignment schedule?”
“Is patching an assignment schedule supported?”
Tell an agent
Update assignment schedule {schedule} to type {type}.
Patch assignment schedule {schedule} with member type {memberType}.
DELETE /identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentSchedule-id} Delete a PIM group assignment schedule · Delete navigation property assignmentSchedules for identityGovernance #
Ask an LLM
“Can I delete a PIM group assignment schedule?”
“Is an ETag check possible when removing an assignment schedule?”
Tell an agent destructive · confirm first
Delete assignment schedule {schedule}.
Remove assignment schedule {schedule} only if ETag {etag} matches.
GET /identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentSchedule-id}/activatedUsing Get the eligibility behind an assignment schedule · Get activatedUsing from identityGovernance #
Ask an LLM
“Which eligibility relationship activated this assignment schedule?”
“Did an assignment schedule come from activating an eligible membership?”
Tell an agent
Show the eligibility that activated schedule {schedule}.
Get activatedUsing on assignment schedule {schedule}.
GET /identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentSchedule-id}/group Get the group of an assignment schedule · Get group from identityGovernance #
Ask an LLM
“Which group does an assignment schedule cover?”
“Can I read the group scoped by an assignment schedule?”
Tell an agent
Get the group for assignment schedule {schedule}.
Fetch {select} from the group assignment schedule {schedule} applies to.
GET /identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentSchedule-id}/group/serviceProvisioningErrors List group errors for an assignment schedule · Get serviceProvisioningErrors property value #
Ask an LLM
“Are there provisioning errors on an assignment schedule's group?”
“Can I list service errors for the group of an assignment schedule?”
Tell an agent
List provisioning errors on the group of assignment schedule {schedule}.
Show assignment schedule {schedule} group errors that match {filter}.
GET /identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentSchedule-id}/group/serviceProvisioningErrors/$count Count group errors for an assignment schedule · Get the number of the resource #
Ask an LLM
“How many provisioning errors does an assignment schedule's group have?”
“Can I count group errors for an assignment schedule?”
Tell an agent
Count provisioning errors on the group behind assignment schedule {schedule}.
Count errors matching {filter} on the group of assignment schedule {schedule}.
GET /identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentSchedule-id}/principal Get the principal of an assignment schedule · Get principal from identityGovernance #
Ask an LLM
“Which principal is covered by an assignment schedule?”
“Can I see who an assignment schedule grants membership to?”
Tell an agent
Get the principal of assignment schedule {schedule}.
Show who schedule {schedule} covers, selecting {select}.
GET /identityGovernance/privilegedAccess/group/assignmentSchedules/$count Count PIM group assignment schedules · Get the number of the resource #
Ask an LLM
“How many PIM group assignment schedules are there?”
“Can I count assignment schedules that match a filter?”
Tell an agent
Count PIM group assignment schedules.
Count assignment schedules where {filter}.
GET /identityGovernance/privilegedAccess/group/assignmentSchedules/microsoft.graph.filterByCurrentUser(on='{on}') List my group assignment schedules · Invoke function filterByCurrentUser #
Ask an LLM
“What assignment schedules do I have for PIM groups?”
“Can I list just my own group assignment schedules?”
Tell an agent
List my group assignment schedules as {on}.
Show my assignment schedules as {on}, selecting {select}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleInstances List PIM group eligibility instances · List eligibilityScheduleInstances #
Ask an LLM
“Who is currently eligible for membership or ownership of PIM groups?”
“Can I filter eligibility instances by principal?”
Tell an agent
List all PIM group eligibility instances.
List eligibility instances where {filter}.
POST /identityGovernance/privilegedAccess/group/eligibilityScheduleInstances Create a group eligibility instance · Create new navigation property to eligibilityScheduleInstances for… #
Ask an LLM
“Can I create an eligibility schedule instance record?”
“What fields go into a new eligibility instance, like eligibilityScheduleId?”
Tell an agent
Create an eligibility instance for principal {principal} in group {group}.
Add an eligibility instance tied to schedule {schedule}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/{privilegedAccessGroupEligibilityScheduleInstance-id} Get a group eligibility instance · Get privilegedAccessGroupEligibilityScheduleInstance #
Ask an LLM
“How do I read one eligibility instance for a PIM group?”
“Which properties can I select on a single eligibility instance?”
Tell an agent
Get eligibility instance {instance}.
Show eligibility instance {instance} selecting {select}.
PATCH /identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/{privilegedAccessGroupEligibilityScheduleInstance-id} Update a group eligibility instance · Update the navigation property eligibilityScheduleInstances in… #
Ask an LLM
“Can I switch an eligibility instance between member and owner?”
“Is patching an eligibility instance supported?”
Tell an agent
Update eligibility instance {instance} to member type {memberType}.
Patch eligibility instance {instance} with group {group}.
DELETE /identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/{privilegedAccessGroupEligibilityScheduleInstance-id} Delete a group eligibility instance · Delete navigation property eligibilityScheduleInstances for identityGovernance #
Ask an LLM
“Can I delete an eligibility instance object?”
“Does removing an eligibility instance need an ETag?”
Tell an agent destructive · confirm first
Delete eligibility instance {instance}.
Remove eligibility instance {instance} if ETag {etag} matches.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/{privilegedAccessGroupEligibilityScheduleInstance-id}/group Get the group of an eligibility instance · Get group from identityGovernance #
Ask an LLM
“Which group does an eligibility instance make someone eligible for?”
“Can I read the group behind an eligibility instance?”
Tell an agent
Get the group for eligibility instance {instance}.
Show the group scoped by eligibility instance {instance}, selecting {select}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/{privilegedAccessGroupEligibilityScheduleInstance-id}/group/serviceProvisioningErrors List group errors for an eligibility instance · Get serviceProvisioningErrors property value #
Ask an LLM
“Are there provisioning errors on the group of an eligibility instance?”
“Can I list service provisioning errors for an eligibility instance's group?”
Tell an agent
List provisioning errors on the group of eligibility instance {instance}.
Show group provisioning errors for eligibility instance {instance} matching {filter}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/{privilegedAccessGroupEligibilityScheduleInstance-id}/group/serviceProvisioningErrors/$count Count group errors for an eligibility instance · Get the number of the resource #
Ask an LLM
“How many provisioning errors does the group of an eligibility instance have?”
“Can I count group provisioning errors for one eligibility instance?”
Tell an agent
Count provisioning errors on the group behind eligibility instance {instance}.
Count group errors for eligibility instance {instance} where {filter}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/{privilegedAccessGroupEligibilityScheduleInstance-id}/principal Get the principal of an eligibility instance · Get principal from identityGovernance #
Ask an LLM
“Who is the principal on an eligibility instance?”
“Can I see which principal is eligible through a specific eligibility instance?”
Tell an agent
Get the principal of eligibility instance {instance}.
Show who is eligible via instance {instance}, selecting {select}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/$count Count PIM group eligibility instances · Get the number of the resource #
Ask an LLM
“How many PIM group eligibility instances are there?”
“Can I count eligibility instances matching a filter?”
Tell an agent
Count PIM group eligibility instances.
Count eligibility instances where {filter}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleInstances/microsoft.graph.filterByCurrentUser(on='{on}') List my group eligibility instances · Invoke function filterByCurrentUser #
Ask an LLM
“Which PIM groups am I currently eligible to join or own?”
“Can I list only my own eligibility instances?”
Tell an agent
List my group eligibility instances as {on}.
Show my eligibility instances as {on}, ordered by {orderby}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests List PIM group eligibility requests · List eligibilityScheduleRequests #
Ask an LLM
“What eligibility requests have been made for PIM-governed groups?”
“Can I filter group eligibility requests by principal?”
Tell an agent
List all PIM group eligibility requests.
List eligibility requests matching {filter}, ordered by {orderby}.
POST /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests Request PIM group eligibility · Create eligibilityScheduleRequest #
Ask an LLM
“How do I make a user eligible for membership of a PIM group?”
“Can I grant eligible ownership of a group through a PIM request?”
Tell an agent
Request eligibility for principal {principal} in group {group} with access {access}.
Submit an eligibility request making {principal} eligible for group {group}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id} Get a PIM group eligibility request · Get privilegedAccessGroupEligibilityScheduleRequest #
Ask an LLM
“What's the status of a single group eligibility request?”
“Which properties can I pull from one eligibility request?”
Tell an agent
Get eligibility request {request}.
Show eligibility request {request} expanding {expand}.
PATCH /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id} Update a PIM group eligibility request · Update the navigation property eligibilityScheduleRequests in identityGovernance #
Ask an LLM
“Can I edit an eligibility request after submitting it?”
“Can I point an eligibility request at a different target schedule?”
Tell an agent
Update eligibility request {request} to target schedule {schedule}.
Patch group eligibility request {request} with principal {principal}.
DELETE /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id} Delete a PIM group eligibility request · Delete navigation property eligibilityScheduleRequests for identityGovernance #
Ask an LLM
“Can I delete a group eligibility request record?”
“Does deleting an eligibility request require an If-Match ETag?”
Tell an agent destructive · confirm first
Delete group eligibility request {request}.
Remove eligibility request {request} when ETag is {etag}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id}/group Get the group of an eligibility request · Get group from identityGovernance #
Ask an LLM
“Which group is an eligibility request for?”
“Can I see the target group of an eligibility request?”
Tell an agent
Get the group targeted by eligibility request {request}.
Show the group on eligibility request {request} with only {select}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id}/group/serviceProvisioningErrors List group errors for an eligibility request · Get serviceProvisioningErrors property value #
Ask an LLM
“Does the group in an eligibility request have provisioning errors?”
“Which service provisioning errors are reported for an eligibility request's group?”
Tell an agent
List provisioning errors for the group on eligibility request {request}.
Show errors on the requested group for eligibility request {request}, top {top}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id}/group/serviceProvisioningErrors/$count Count group errors for an eligibility request · Get the number of the resource #
Ask an LLM
“What's the provisioning error count for an eligibility request's group?”
“Can I count provisioning errors tied to an eligibility request's group?”
Tell an agent
Count provisioning errors for the group on eligibility request {request}.
Count errors on the requested group of eligibility request {request} matching {filter}.
POST /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id}/microsoft.graph.cancel Cancel a PIM group eligibility request · Invoke action cancel #
Ask an LLM
“Can I cancel a pending PIM group eligibility request?”
“How do I withdraw an eligibility request I submitted?”
Tell an agent destructive · confirm first
Cancel group eligibility request {request}.
Withdraw PIM eligibility request {request}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id}/principal Get the principal of an eligibility request · Get principal from identityGovernance #
Ask an LLM
“Who is the principal named in an eligibility request?”
“Can I see which user an eligibility request would make eligible?”
Tell an agent
Get the principal on eligibility request {request}.
Show who eligibility request {request} is for, selecting {select}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/{privilegedAccessGroupEligibilityScheduleRequest-id}/targetSchedule Get the schedule an eligibility request created · Get targetSchedule from identityGovernance #
Ask an LLM
“What eligibility schedule did a request create?”
“Can I get the schedule produced by an eligibility request?”
Tell an agent
Get the target schedule of eligibility request {request}.
Show the eligibility schedule created by request {request}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/$count Count PIM group eligibility requests · Get the number of the resource #
Ask an LLM
“How many PIM group eligibility requests exist?”
“Can I count eligibility requests without listing them?”
Tell an agent
Count PIM group eligibility requests.
Count eligibility requests where {filter}.
GET /identityGovernance/privilegedAccess/group/eligibilityScheduleRequests/microsoft.graph.filterByCurrentUser(on='{on}') List my group eligibility requests · Invoke function filterByCurrentUser #
Ask an LLM
“What PIM group eligibility requests have I made?”
“Can I see only my own eligibility requests for groups?”
Tell an agent
List my PIM group eligibility requests as {on}.
Show my eligibility requests as {on}, top {top}.
GET /identityGovernance/privilegedAccess/group/eligibilitySchedules List PIM group eligibility schedules · List eligibilitySchedules #
Ask an LLM
“What eligibility schedules exist for PIM-governed groups?”
“Can I sort eligibility schedules by a property?”
Tell an agent
List all PIM group eligibility schedules.
List eligibility schedules sorted by {orderby}.
POST /identityGovernance/privilegedAccess/group/eligibilitySchedules Create a PIM group eligibility schedule · Create new navigation property to eligibilitySchedules for identityGovernance #
Ask an LLM
“Can I create an eligibility schedule object directly?”
“Which values can I set on a new eligibility schedule, such as memberType?”
Tell an agent
Create an eligibility schedule for {principal} on group {group}.
Add an eligibility schedule with member type {memberType} and access {access}.
GET /identityGovernance/privilegedAccess/group/eligibilitySchedules/{privilegedAccessGroupEligibilitySchedule-id} Get a PIM group eligibility schedule · Get privilegedAccessGroupEligibilitySchedule #
Ask an LLM
“Where can I read one PIM group eligibility schedule?”
“Can I expand related objects when fetching an eligibility schedule?”
Tell an agent
Get eligibility schedule {schedule}.
Show eligibility schedule {schedule} expanding {expand}.
PATCH /identityGovernance/privilegedAccess/group/eligibilitySchedules/{privilegedAccessGroupEligibilitySchedule-id} Update a PIM group eligibility schedule · Update the navigation property eligibilitySchedules in identityGovernance #
Ask an LLM
“Can I change the member type on an eligibility schedule?”
“Is patching an eligibility schedule supported?”
Tell an agent
Update eligibility schedule {schedule} to member type {memberType}.
Patch eligibility schedule {schedule} with group {group}.
DELETE /identityGovernance/privilegedAccess/group/eligibilitySchedules/{privilegedAccessGroupEligibilitySchedule-id} Delete a PIM group eligibility schedule · Delete navigation property eligibilitySchedules for identityGovernance #
Ask an LLM
“Can I delete a PIM group eligibility schedule?”
“Is an ETag check possible when removing an eligibility schedule?”
Tell an agent destructive · confirm first
Delete eligibility schedule {schedule}.
Remove eligibility schedule {schedule} only if ETag {etag} matches.
GET /identityGovernance/privilegedAccess/group/eligibilitySchedules/{privilegedAccessGroupEligibilitySchedule-id}/group Get the group of an eligibility schedule · Get group from identityGovernance #
Ask an LLM
“Which group does an eligibility schedule cover?”
“Can I read the group scoped by an eligibility schedule?”
Tell an agent
Get the group for eligibility schedule {schedule}.
Show the scoped group of eligibility schedule {schedule}, selecting {select}.
GET /identityGovernance/privilegedAccess/group/eligibilitySchedules/{privilegedAccessGroupEligibilitySchedule-id}/group/serviceProvisioningErrors List group errors for an eligibility schedule · Get serviceProvisioningErrors property value #
Ask an LLM
“Are there provisioning errors on an eligibility schedule's group?”
“Can I list service errors for the group of an eligibility schedule?”
Tell an agent
List provisioning errors on the group of eligibility schedule {schedule}.
Show group provisioning errors for eligibility schedule {schedule} matching {filter}.
GET /identityGovernance/privilegedAccess/group/eligibilitySchedules/{privilegedAccessGroupEligibilitySchedule-id}/group/serviceProvisioningErrors/$count Count group errors for an eligibility schedule · Get the number of the resource #
Ask an LLM
“How many provisioning errors does an eligibility schedule's group have?”
“Can I count group errors for an eligibility schedule?”
Tell an agent
Count provisioning errors on the group behind eligibility schedule {schedule}.
Count group errors for eligibility schedule {schedule} where {filter}.
GET /identityGovernance/privilegedAccess/group/eligibilitySchedules/{privilegedAccessGroupEligibilitySchedule-id}/principal Get the principal of an eligibility schedule · Get principal from identityGovernance #
Ask an LLM
“Which principal is covered by an eligibility schedule?”
“Can I see who an eligibility schedule makes eligible?”
Tell an agent
Get the principal of eligibility schedule {schedule}.
Show who eligibility schedule {schedule} covers, selecting {select}.
GET /identityGovernance/privilegedAccess/group/eligibilitySchedules/$count Count PIM group eligibility schedules · Get the number of the resource #
Ask an LLM
“How many PIM group eligibility schedules are there?”
“Can I count eligibility schedules that match a filter?”
Tell an agent
Count PIM group eligibility schedules.
Count eligibility schedules where {filter}.
GET /identityGovernance/privilegedAccess/group/eligibilitySchedules/microsoft.graph.filterByCurrentUser(on='{on}') List my group eligibility schedules · Invoke function filterByCurrentUser #
Ask an LLM
“What eligibility schedules do I have for PIM groups?”
“Can I list just my own group eligibility schedules?”
Tell an agent
List my group eligibility schedules as {on}.
Show my eligibility schedules as {on}, selecting {select}.

Documentation

📖
Documentation
https://learn.microsoft.com/en-us/graph/api/overview
📖
Authentication
https://learn.microsoft.com/en-us/graph/auth/
📖
Documentation
https://learn.microsoft.com/en-us/graph/change-notifications-overview

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-identitygovernance-privilegedaccessroot-api-openapi.yml

Other Resources

🔗
SDKs
https://learn.microsoft.com/en-us/graph/sdks/sdks-overview
🔗
ChangeLog
https://developer.microsoft.com/en-us/graph/changelog
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/asyncapi/azure-ad-change-notifications-webhooks.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/azure-ad:azure-ad-identitygovernance-privilegedaccessroot-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

azure-ad-identitygovernance-privilegedaccessroot-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Identity.Governance Identity Governance.privileged Access…
  version: v1.0
servers:
- url: https://graph.microsoft.com/v1.0/
  description: Core
security:
- azureaadv2: []
tags:


# --- truncated at 32 KB (877 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-identitygovernance-privilegedaccessroot-api-openapi.yml