Microsoft Entra ID (formerly Azure AD)

Microsoft Entra ID (formerly Azure AD) Policies.permission Grant Policy API

The policies.permissionGrantPolicy API from Microsoft Entra ID (formerly Azure AD) — 9 operation(s) for policies.permissiongrantpolicy.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 18

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /policies/permissionGrantPolicies List permission grant policies · List permissionGrantPolicies #
Ask an LLM
“Which permission grant policies control app consent in my tenant?”
“Can I see both the built-in and custom consent policies in one list?”
Tell an agent
List the permission grant policies.
List permission grant policies matching {filter}.
POST /policies/permissionGrantPolicies Create a permission grant policy · Create permissionGrantPolicy #
Ask an LLM
“How do I define a custom policy for when users may consent to apps?”
“Can I create a consent policy first and add its include and exclude rules afterwards?”
Tell an agent
Create a new permission grant policy for app consent.
Create a permission grant policy with include condition sets {includes} and exclude condition sets {excludes}.
GET /policies/permissionGrantPolicies/{permissionGrantPolicy-id} Get a permission grant policy · Get permissionGrantPolicy #
Ask an LLM
“What conditions does a particular consent policy include and exclude?”
“How do I view one permission grant policy by its id?”
Tell an agent
Get permission grant policy {policy_id}.
Show {fields} of consent policy {policy_id}.
PATCH /policies/permissionGrantPolicies/{permissionGrantPolicy-id} Update a permission grant policy · Update permissionGrantPolicy #
Ask an LLM
“How do I replace the include and exclude conditions on an existing consent policy in one update?”
“Can I edit a permission grant policy's properties after it's created?”
Tell an agent
Update permission grant policy {policy_id} with include condition sets {includes}.
Replace the exclude condition sets on policy {policy_id} with {excludes}.
DELETE /policies/permissionGrantPolicies/{permissionGrantPolicy-id} Delete a permission grant policy · Delete permissionGrantPolicy #
Ask an LLM
“Can I remove a custom consent policy I no longer need?”
“What's required to delete a permission grant policy by id?”
Tell an agent destructive · confirm first
Delete permission grant policy {policy_id}.
Remove consent policy {policy_id} if its ETag is {etag}.
GET /policies/permissionGrantPolicies/{permissionGrantPolicy-id}/excludes List a consent policy's exclude conditions · List excludes collection of permissionGrantPolicy #
Ask an LLM
“Which condition sets are excluded from a permission grant policy?”
“What app consent scenarios does this policy carve out as exceptions?”
Tell an agent
List the exclude condition sets on permission grant policy {policy_id}.
Show the exceptions defined in consent policy {policy_id}.
POST /policies/permissionGrantPolicies/{permissionGrantPolicy-id}/excludes Add an exclude condition to a consent policy · Create permissionGrantConditionSet in excludes collection of… #
Ask an LLM
“How do I exclude a specific client app from a permission grant policy?”
“Can I carve out high-risk permissions so consent to them isn't covered by a policy?”
Tell an agent
Exclude client apps {client_app_ids} from permission grant policy {policy_id}.
Add an exclusion to policy {policy_id} for {permission_type} permissions classified {classification}.
GET /policies/permissionGrantPolicies/{permissionGrantPolicy-id}/excludes/{permissionGrantConditionSet-id} Get one exclude condition set of a policy · Get excludes from policies #
Ask an LLM
“What exactly does a single exclusion rule in a consent policy match?”
“How do I inspect one excluded condition set by id?”
Tell an agent
Get exclude condition set {condition_set_id} from policy {policy_id}.
Show the exception rule {condition_set_id} in consent policy {policy_id}.
PATCH /policies/permissionGrantPolicies/{permissionGrantPolicy-id}/excludes/{permissionGrantConditionSet-id} Edit an exclude condition set of a policy · Update the navigation property excludes in policies #
Ask an LLM
“Can I change which publishers an existing exclusion rule applies to?”
“How do I update the permissions listed in a policy's exclude condition set?”
Tell an agent
Set the publisher ids on exclude condition set {condition_set_id} of policy {policy_id} to {publisher_ids}.
Change the excluded permissions in rule {condition_set_id} on policy {policy_id} to {permissions}.
DELETE /policies/permissionGrantPolicies/{permissionGrantPolicy-id}/excludes/{permissionGrantConditionSet-id} Remove an exclude condition from a policy · Delete permissionGrantConditionSet from excludes collection of… #
Ask an LLM
“Can I drop an exception rule so a consent policy covers those apps again?”
“How do I delete one condition set from a policy's excludes?”
Tell an agent destructive · confirm first
Delete exclude condition set {condition_set_id} from policy {policy_id}.
Remove the exception {condition_set_id} from consent policy {policy_id}.
GET /policies/permissionGrantPolicies/{permissionGrantPolicy-id}/excludes/$count Count a consent policy's exclude conditions · Get the number of the resource #
Ask an LLM
“How many exception rules does a permission grant policy have?”
“What's the number of excluded condition sets matching a filter?”
Tell an agent
Count the exclude condition sets on policy {policy_id}.
Count exclusions on policy {policy_id} where {filter}.
GET /policies/permissionGrantPolicies/{permissionGrantPolicy-id}/includes List a consent policy's include conditions · List includes collection of permissionGrantPolicy #
Ask an LLM
“Which condition sets does a permission grant policy include?”
“What kinds of app consent does this policy actually allow?”
Tell an agent
List the include condition sets on permission grant policy {policy_id}.
Show the matching rules defined in consent policy {policy_id}.
POST /policies/permissionGrantPolicies/{permissionGrantPolicy-id}/includes Add an include condition to a consent policy · Create permissionGrantConditionSet in includes collection of… #
Ask an LLM
“How do I allow consent to low-risk delegated permissions from verified publishers only?”
“Can I add a matching rule for a specific resource application to a consent policy?”
Tell an agent
Add an include rule to policy {policy_id} for {permission_type} permissions classified {classification}.
Include only verified-publisher apps ({verified_only}) in consent policy {policy_id}.
GET /policies/permissionGrantPolicies/{permissionGrantPolicy-id}/includes/{permissionGrantConditionSet-id} Get one include condition set of a policy · Get includes from policies #
Ask an LLM
“What does a single matching rule in a consent policy allow?”
“How do I inspect one included condition set by its id?”
Tell an agent
Get include condition set {condition_set_id} from policy {policy_id}.
Show matching rule {condition_set_id} in consent policy {policy_id}.
PATCH /policies/permissionGrantPolicies/{permissionGrantPolicy-id}/includes/{permissionGrantConditionSet-id} Edit an include condition set of a policy · Update the navigation property includes in policies #
Ask an LLM
“Can I restrict an existing matching rule to apps from certain tenants?”
“How do I change the permission classification on a policy's include condition set?”
Tell an agent
Limit include rule {condition_set_id} on policy {policy_id} to client tenants {tenant_ids}.
Set the permission classification on matching rule {condition_set_id} in policy {policy_id} to {classification}.
DELETE /policies/permissionGrantPolicies/{permissionGrantPolicy-id}/includes/{permissionGrantConditionSet-id} Remove an include condition from a policy · Delete permissionGrantConditionSet from includes collection of… #
Ask an LLM
“Can I stop a consent policy from allowing a scenario by deleting one of its matching rules?”
“How do I delete a condition set from a policy's includes?”
Tell an agent destructive · confirm first
Delete include condition set {condition_set_id} from policy {policy_id}.
Remove matching rule {condition_set_id} from consent policy {policy_id}.
GET /policies/permissionGrantPolicies/{permissionGrantPolicy-id}/includes/$count Count a consent policy's include conditions · Get the number of the resource #
Ask an LLM
“How many matching rules are included in a permission grant policy?”
“What's the number of include condition sets that fit a filter?”
Tell an agent
Count the include condition sets on policy {policy_id}.
Count matching rules on policy {policy_id} where {filter}.
GET /policies/permissionGrantPolicies/$count Count permission grant policies · Get the number of the resource #
Ask an LLM
“How many permission grant policies exist in my tenant?”
“What's the total of consent policies that match a filter?”
Tell an agent
Count the permission grant policies.
Count consent policies where {filter}.

Documentation

📖
Documentation
https://learn.microsoft.com/en-us/graph/api/overview
📖
Authentication
https://learn.microsoft.com/en-us/graph/auth/
📖
Documentation
https://learn.microsoft.com/en-us/graph/change-notifications-overview

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-policies-permissiongrantpolicy-api-openapi.yml

Other Resources

🔗
SDKs
https://learn.microsoft.com/en-us/graph/sdks/sdks-overview
🔗
ChangeLog
https://developer.microsoft.com/en-us/graph/changelog
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/asyncapi/azure-ad-change-notifications-webhooks.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/azure-ad:azure-ad-policies-permissiongrantpolicy-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

azure-ad-policies-permissiongrantpolicy-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Identity.SignIns Policies.permission Grant Policy API
  version: v1.0
servers:
- url: https://graph.microsoft.com/v1.0/
  description: Core
security:
- azureaadv2: []
tags:


# --- truncated at 32 KB (33 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-policies-permissiongrantpolicy-api-openapi.yml