List accessReviews


APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported.

Retrieve the accessReview objects for a particular businessFlowTemplate. A list of zero or more accessReview objects are returned, for each one-time and recurring access review that was created with that business flow template.


If any of the access reviews that match the filter is a recurring access review, one accessReview object will be returned to represent each recurring series as a whole. For example, if there is a monthly recurring access review of guest members of group A, a quarterly recurring access review of guest members of group B, and a one-time access review of guest members of group C, and the caller queries for access reviews with a business flow template of reviews of guest members of groups, three objects will be returned. To retrieve the instances of a recurring access review, or the access review instance scheduled for a particular month or quarter, the caller can subsequently navigate the instance relationship of the recurring accessReview object. The instance relationship links to the accessReview objects for a current or the past instances of the recurring access review.


One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.

Permission type Permissions (from least to most privileged)
Delegated (work or school account) AccessReview.Read.All, AccessReview.ReadWrite.Membership, AccessReview.ReadWrite.All
Delegated (personal Microsoft account) Not supported.
Application AccessReview.Read.All, AccessReview.ReadWrite.Membership

The signed in user must also be in a directory role that permits them to read an access review.

HTTP request

GET /accessReviews?$filter=businessFlowTemplateId eq {businessFlowTemplate-id}

Request headers

Name Type Description
Authorization string Bearer {token}. Required.

Request body

Do not supply a request body.


If successful, this method returns a 200, OK response code and an array of accessReview objects in the response body.



The following example shows a request to retrieve all the one-time and recurring access reviews for a business flow template '6E4F3D20-C5C3-407F-9695-8460952BCC68'.



Note: The response object shown here might be shortened for readability. All the properties will be returned from an actual call.

HTTP/1.1 200 OK
Content-type: application/json

         "id": "2b83cc42-09db-46f6-8c6e-16fec466a82d",
         "displayName": "review",
         "startDateTime": "2017-11-14T01:14:54.89Z",
         "endDateTime": "2017-12-14T01:14:54.89Z",
         "status": "InProgress",
         "businessFlowTemplateId": "6e4f3d20-c5c3-407f-9695-8460952bcc68",
         "reviewerType": "self",
         "description": "",

See also