microsoft.graph.entitlementManagement

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-entitlement-management-schema.json",
  "title": "microsoft.graph.entitlementManagement",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-ad-identitygovernance-entitlementmanagement-api-openapi.yml#/components/schemas/microsoft.graph.entitlementManagement",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "entitlementManagement",
      "type": "object",
      "properties": {
        "accessPackageAssignmentApprovals": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.approval"
          },
          "description": "Approval stages for decisions associated with access package assignment requests.",
          "x-ms-navigationProperty": true
        },
        "accessPackages": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.accessPackage"
          },
          "description": "Access packages define the collection of resource roles and the policies for which subjects can request or be assigned access to those resources.",
          "x-ms-navigationProperty": true
        },
        "accessPackageSuggestions": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.accessPackageSuggestion"
          },
          "description": "Suggested access packages for end users based on various criteria such as related people insights and assignment history.",
          "x-ms-navigationProperty": true
        },
        "assignmentPolicies": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.accessPackageAssignmentPolicy"
          },
          "description": "Access package assignment policies govern which subjects can request or be assigned an access package via an access package assignment.",
          "x-ms-navigationProperty": true
        },
        "assignmentRequests": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.accessPackageAssignmentRequest"
          },
          "description": "Access package assignment requests created by or on behalf of a subject.",
          "x-ms-navigationProperty": true
        },
        "assignments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.accessPackageAssignment"
          },
          "description": "The assignment of an access package to a subject for a period of time.",
          "x-ms-navigationProperty": true
        },
        "availableAccessPackages": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.availableAccessPackage"
          },
          "description": "Access packages available for end users to browse and request.",
          "x-ms-navigationProperty": true
        },
        "catalogs": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.accessPackageCatalog"
          },
          "description": "A container for access packages.",
          "x-ms-navigationProperty": true
        },
        "connectedOrganizations": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.connectedOrganization"
          },
          "description": "References to a directory or domain of another organization whose users can request access.",
          "x-ms-navigationProperty": true
        },
        "controlConfigurations": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.controlConfiguration"
          },
          "description": "Configuration settings that control the lifecycle and access policies of entitlement management within a tenant.",
          "x-ms-navigationProperty": true
        },
        "resourceEnvironments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.accessPackageResourceEnvironment"
          },
          "description": "A reference to the geolocation environments in which a resource is located.",
          "x-ms-navigationProperty": true
        },
        "resourceRequests": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.accessPackageResourceRequest"
          },
          "description": "Represents a request to add or remove a resource to or from a catalog respectively.",
          "x-ms-navigationProperty": true
        },
        "resourceRoleScopes": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.accessPackageResourceRoleScope"
          },
          "x-ms-navigationProperty": true
        },
        "resources": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.accessPackageResource"
          },
          "description": "The resources associated with the catalogs.",
          "x-ms-navigationProperty": true
        },
        "settings": {
          "$ref": "#/$defs/microsoft.graph.entitlementManagementSettings"
        },
        "subjects": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.accessPackageSubject"
          },
          "x-ms-navigationProperty": true
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    }
  ],
  "$defs": {
    "microsoft.graph.Json": {
      "title": "Json",
      "type": "object",
      "additionalProperties": {
        "type": "object"
      },
      "description": "Standard way to represent a Json blob on Graph."
    },
    "microsoft.graph.accessAction": {
      "title": "accessAction",
      "type": "object",
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.accessPackage": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "accessPackage",
          "type": "object",
          "properties": {
            "createdDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.",
              "format": "date-time"
            },
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "The description of the access package."
            },
            "displayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "Required. The display name of the access package. Supports $filter (eq, contains)."
            },
            "isHidden": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "Indicates whether the access package is hidden from the requestor."
            },
            "modifiedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.",
              "format": "date-time"
            },
            "accessPackagesIncompatibleWith": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.accessPackage"
              },
              "description": "The access packages that are incompatible with this package. Read-only.",
              "x-ms-navigationProperty": true
            },
            "assignmentPolicies": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.accessPackageAssignmentPolicy"
              },
              "description": "Read-only. Nullable. Supports $expand.",
              "x-ms-navigationProperty": true
            },
            "catalog": {
              "$ref": "#/$defs/microsoft.graph.accessPackageCatalog"
            },
            "incompatibleAccessPackages": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.accessPackage"
              },
              "description": "The access packages whose assigned users are ineligible to be assigned this access package.",
              "x-ms-navigationProperty": true
            },
            "incompatibleGroups": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.group"
              },
              "description": "The groups whose members are ineligible to be assigned this access package.",
              "x-ms-navigationProperty": true
            },
            "resourceRoleScopes": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.accessPackageResourceRoleScope"
              },
              "description": "The resource roles and scopes in this access package.",
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.accessPackageAnswer": {
      "title": "accessPackageAnswer",
      "type": "object",
      "properties": {
        "displayValue": {
          "type": [
            "string",
            "null"
          ],
          "description": "The localized display value shown to the requestor and approvers."
        },
        "answeredQuestion": {
          "$ref": "#/$defs/microsoft.graph.accessPackageQuestion"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.accessPackageApprovalStage": {
      "title": "accessPackageApprovalStage",
      "type": "object",
      "properties": {
        "approverInformationVisibility": {
          "$ref": "#/$defs/microsoft.graph.approverInformationVisibility"
        },
        "durationBeforeAutomaticDenial": {
          "pattern": "^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$",
          "type": [
            "string",
            "null"
          ],
          "description": "The number of days that a request can be pending a response before it is automatically denied.",
          "format": "duration"
        },
        "durationBeforeEscalation": {
          "pattern": "^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$",
          "type": [
            "string",
            "null"
          ],
          "description": "If escalation is required, the time a request can be pending a response from a primary approver.",
          "format": "duration"
        },
        "escalationApprovers": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.subjectSet"
          },
          "description": "If escalation is enabled and the primary approvers do not respond before the escalation time, the escalationApprovers are the users who are asked to approve requests."
        },
        "fallbackEscalationApprovers": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.subjectSet"
          },
          "description": "The subjects, typically users, who are the fallback escalation approvers."
        },
        "fallbackPrimaryApprovers": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.subjectSet"
          },
          "description": "The subjects, typically users, who are the fallback primary approvers."
        },
        "isApproverJustificationRequired": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates whether the approver is required to provide a justification for approving a request."
        },
        "isEscalationEnabled": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "If true, then one or more escalationApprovers are configured in this approval stage."
        },
        "primaryApprovers": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.subjectSet"
          },
          "description": "The subjects, typically users, who are asked to approve requests. A collection of singleUser, groupMembers, requestorManager, internalSponsors, externalSponsors, or targetUserSponsors."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.accessPackageAssignment": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "accessPackageAssignment",
          "type": "object",
          "properties": {
            "customExtensionCalloutInstances": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.customExtensionCalloutInstance"
              },
              "description": "Information about all the custom extension calls that were made during the access package assignment workflow."
            },
            "expiredDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.",
              "format": "date-time"
            },
            "schedule": {
              "$ref": "#/$defs/microsoft.graph.entitlementManagementSchedule"
            },
            "state": {
              "$ref": "#/$defs/microsoft.graph.accessPackageAssignmentState"
            },
            "status": {
              "type": [
                "string",
                "null"
              ],
              "description": "More information about the assignment lifecycle. Possible values include Delivering, Delivered, AutoAssignmentInGracePeriod, NearExpiry1DayNotificationTriggered, or ExpiredNotificationTriggered. Read-only."
            },
            "accessPackage": {
              "$ref": "#/$defs/microsoft.graph.accessPackage"
            },
            "assignmentPolicy": {
              "$ref": "#/$defs/microsoft.graph.accessPackageAssignmentPolicy"
            },
            "target": {
              "$ref": "#/$defs/microsoft.graph.accessPackageSubject"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.accessPackageAssignmentApprovalSettings": {
      "title": "accessPackageAssignmentApprovalSettings",
      "type": "object",
      "properties": {
        "isApprovalRequiredForAdd": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "If false, then approval isn't required for new requests in this policy."
        },
        "isApprovalRequiredForUpdate": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "If false, then approval isn't required for updates to requests in this policy."
        },
        "isRequestorJustificationRequired": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "If false, then requestor justification isn't required for updates to requests in this policy."
        },
        "stages": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.accessPackageApprovalStage"
          },
          "description": "If approval is required, the one, two or three elements of this collection define each of the stages of approval. An empty array is present if no approval is required."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.accessPackageAssignmentPolicy": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "accessPackageAssignmentPolicy",
          "type": "object",
          "properties": {
            "allowedTargetScope": {
              "$ref": "#/$defs/microsoft.graph.allowedTargetScope"
            },
            "automaticRequestSettings": {
              "$ref": "#/$defs/microsoft.graph.accessPackageAutomaticRequestSettings"
            },
            "createdDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.",
              "format": "date-time"
            },
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "The description of the policy."
            },
            "displayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "The display name of the policy."
            },
            "expiration": {
              "$ref": "#/$defs/microsoft.graph.expirationPattern"
            },
            "modifiedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.",
              "format": "date-time"
            },
            "notificationSettings": {
              "$ref": "#/$defs/microsoft.graph.accessPackageNotificationSettings"
            },
            "requestApprovalSettings": {
              "$ref": "#/$defs/microsoft.graph.accessPackageAssignmentApprovalSettings"
            },
            "requestorSettings": {
              "$ref": "#/$defs/microsoft.graph.accessPackageAssignmentRequestorSettings"
            },
            "reviewSettings": {
              "$ref": "#/$defs/microsoft.graph.accessPackageAssignmentReviewSettings"
            },
            "specificAllowedTargets": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.subjectSet"
              },
              "description": "The principals that can be assigned access from an access package through this policy."
            },
            "accessPackage": {
              "$ref": "#/$defs/microsoft.graph.accessPackage"
            },
            "catalog": {
              "$ref": "#/$defs/microsoft.graph.accessPackageCatalog"
            },
            "customExtensionStageSettings": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.customExtensionStageSetting"
              },
              "description": "The collection of stages when to execute one or more custom access package workflow extensions. Supports $expand.",
              "x-ms-navigationProperty": true
            },
            "questions": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.accessPackageQuestion"
              },
              "description": "Questions that are posed to the  requestor.",
              "x-ms-navigationProperty": true
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.accessPackageAssignmentRequest": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "accessPackageAssignmentRequest",
          "type": "object",
          "properties": {
            "answers": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.accessPackageAnswer"
              },
              "description": "Answers provided by the requestor to accessPackageQuestions asked of them at the time of request."
            },
            "completedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The date of the end of processing, either successful or failure, of a request. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.",
              "format": "date-time"
            },
            "createdDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. Supports $filter.",
              "format": "date-time"
            },
            "customExtensionCalloutInstances": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.customExtensionCalloutInstance"
              },
              "description": "Information about all the custom extension calls that were made during the access package assignment workflow."
            },
            "justification": {
              "type": [
                "string",
                "null"
              ],
              "description": "The requestor's supplied justification."
            },
            "requestType": {
              "$ref": "#/$defs/microsoft.graph.accessPackageRequestType"
            },
            "schedule": {
              "$ref": "#/$defs/microsoft.graph.entitlementManagementSchedule"
            },
            "state": {
              "$ref": "#/$defs/microsoft.graph.accessPackageRequestState"
            },
            "status": {
              "type": [
                "string",
                "null"
              ],
              "description": "More information on the request processing status. Read-only."
            },
            "accessPackage": {
              "$ref": "#/$defs/microsoft.graph.accessPackage"
            },
            "assignment": {
              "$ref": "#/$defs/microsoft.graph.accessPackageAssignment"
            },
            "requestor": {
              "$ref": "#/$defs/microsoft.graph.accessPackageSubject"
            }
          },
          "additionalProperties": {
            "type": "object"
          }
        }
      ]
    },
    "microsoft.graph.accessPackageAssignmentRequestorSettings": {
      "title": "accessPackageAssignmentRequestorSettings",
      "type": "object",
      "properties": {
        "allowCustomAssignmentSchedule": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "False indicates that the requestor isn't permitted to include a schedule in their request."
        },
        "enableOnBehalfRequestorsToAddAccess": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "True allows on-behalf-of requestors to create a request to add access for another principal."
        },
        "enableOnBehalfRequestorsToRemoveAccess": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "True allows on-behalf-of requestors to create a request to remove access for another principal."
        },
        "enableOnBehalfRequestorsToUpdateAccess": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "True allows on-behalf-of requestors to create a request to update access for another principal."
        },
        "enableTargetsToSelfAddAccess": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "True allows requestors to create a request to add access for themselves."
        },
        "enableTargetsToSelfRemoveAccess": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "True allows requestors to create a request to remove their access."
        },
        "enableTargetsToSelfUpdateAccess": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "True allows requestors to create a request to update their access."
        },
        "onBehalfRequestors": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.subjectSet"
          },
          "description": "The principals who can request on-behalf-of others."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.accessPackageAssignmentReviewSettings": {
      "title": "accessPackageAssignmentReviewSettings",
      "type": "object",
      "properties": {
        "expirationBehavior": {
          "$ref": "#/$defs/microsoft.graph.accessReviewExpirationBehavior"
        },
        "fallbackReviewers": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.subjectSet"
          },
          "description": "This collection specifies the users who will be the fallback reviewers when the primary reviewers don't respond."
        },
        "isEnabled": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "If true, access reviews are required for assignments through this policy."
        },
        "isRecommendationEnabled": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Specifies whether to display recommendations to the reviewer. The default value is true."
        },
        "isReviewerJustificationRequired": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Specifies whether the reviewer must provide justification for the approval. The default value is true."
        },
        "isSelfReview": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Specifies whether the principals can review their own assignments."
        },
        "primaryReviewers": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.subjectSet"
          },
          "description": "This collection specifies the users or group of users who will review the access package assignments."
        },
        "schedule": {
          "$ref": "#/$defs/microsoft.graph.entitlementManagementSchedule"
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.accessPackageAssignmentState": {
      "title": "accessPackageAssignmentState",
      "enum": [
        "delivering",
        "partiallyDelivered",
        "delivered",
        "expired",
        "deliveryFailed",
        "unknownFutureValue"
      ],
      "type": "string"
    },
    "microsoft.graph.accessPackageAutomaticRequestSettings": {
      "title": "accessPackageAutomaticRequestSettings",
      "type": "object",
      "properties": {
        "gracePeriodBeforeAccessRemoval": {
          "pattern": "^-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+([.][0-9]+)?S)?)?$",
          "type": [
            "string",
            "null"
          ],
          "description": "The duration for which access must be retained before the target's access is revoked once they leave the allowed target scope.",
          "format": "duration"
        },
        "removeAccessWhenTargetLeavesAllowedTargets": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "Indicates whether automatic assignment must be removed for targets who move out of the allowed target scope."
        },
        "requestAccessForAllowedTargets": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "If set to true, automatic assignments will be created for targets in the allowed target scope."
        }
      },
      "additionalProperties": {
        "type": "object"
      }
    },
    "microsoft.graph.accessPackageCatalog": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "accessPackageCatalog",
          "type": "object",
          "properties": {
            "catalogType": {
              "$ref": "#/$defs/microsoft.graph.accessPackageCatalogType"
            },
            "createdDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.",
              "format": "date-time"
            },
            "description": {
              "type": [
                "string",
                "null"
              ],
              "description": "The description of the access package catalog."
            },
            "displayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "The display name of the access package catalog."
            },
            "isExternallyVisible": {
              "type": [
                "boolean",
                "null"
              ],
              "description": "Whether the access packages in this catalog can be requested by users outside of the tenant."
            },
            "modifiedDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.",
              "format": "date-time"
            },
            "state": {
              "$ref": "#/$defs/microsoft.graph.accessPackageCatalogState"
            },
            "accessPackages": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.accessPackage"
              },
              "description": "The access packages in this catalog. Read-only. Nullable.",
              "x-ms-navigationProperty": true
            },
            "customWorkflowExtensions": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/microsoft.graph.customCalloutExtension"
              },
              "x-ms-navigationProperty": true
            },
            "resourceRoles": {
              "type": "array",
              "items": 

# --- truncated at 32 KB (955 KB total) ---
# Full source: https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-entitlement-management-schema.json