Update accessReviewInstanceDecisionItem

Namespace: microsoft.graph

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Update access decisions, known as accessReviewInstanceDecisionItems, for which the user is the reviewer.

Note

Any updates made to an accessReviewInstanceDecisionItem can only be made by calling users who are listed as reviewer for the parent accessReviewInstance.

This API is available in the following national cloud deployments.

Global service US Government L4 US Government L5 (DOD) China operated by 21Vianet

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

Permission type Least privileged permissions Higher privileged permissions
Delegated (work or school account) AccessReview.ReadWrite.All Not available.
Delegated (personal Microsoft account) Not supported. Not supported.
Application Not supported. Not supported.

For delegated scenarios, the signed-in user must have at least one of the following Microsoft Entra roles.

Write access reviews of a group or app Write access reviews of a Microsoft Entra role
User Administrator
Identity Governance Administrator
Identity Governance Administrator
Privileged Role Administrator

HTTP request

To update a decision on an accessReviewInstance:

PATCH /identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinitionId}/instances/{accessReviewInstanceId}/decisions/{accessReviewInstanceDecisionItemId}

To update a decision on a stage of an accessReviewInstance that has multiple stages:

PATCH /identityGovernance/accessReviews/definitions/{accessReviewScheduleDefinitionId}/instances/{accessReviewInstanceId}/stages/{accessReviewStageId}/decisions/{accessReviewInstanceDecisionItemId}

Request headers

Name Description
Authorization Bearer {token}. Required. Learn more about authentication and authorization.
Content-type application/json. Required.

Request body

The following table shows the properties accepted to update an accessReviewInstanceDecisionItem.

Property Type Description
decision String Access decision for the entity being reviewed. Possible values are: Approve Deny NotReviewed DontKnow. Required.
justification String Context of the review provided to admins. Required if justificationRequiredOnApproval is True on the accessReviewScheduleDefinition.

Response

If successful, this method returns a 204 No Content response code and no response body.

Examples

Example 1: Update a decision on an accessReviewInstance

Request

The following is an example of a decision to approve access for a user.

PATCH https://graph.microsoft.com/beta/identityGovernance/accessReviews/definitions/5eac5a70-7cd7-4f20-92b0-f9dba70dd7f0/instances/6444d4fd-ab55-4608-8cf9-c6702d172bcc/stages/9458f255-dff2-4d86-9a05-69438f49d7f8/decisions/e6cafba0-cbf0-4748-8868-0810c7f4cc06
Content-Type: application/json

{
  "decision": "Approve",
  "justification": "This person is still on my team",
}

Response

HTTP/1.1 204 Accepted

Example 2: Update a decision on an stage in a multi-stage access review

Request

PATCH https://graph.microsoft.com/beta/identityGovernance/accessReviews/definitions/5eac5a70-7cd7-4f20-92b0-f9dba70dd7f0/instances/6444d4fd-ab55-4608-8cf9-c6702d172bcc/stages/9458f255-dff2-4d86-9a05-69438f49d7f8/decisions/e6cafba0-cbf0-4748-8868-0810c7f4cc06
Content-Type: application/json

{
  "decision": "Approve",
  "justification": "This person is still on my team",
}

Response

HTTP/1.1 204 Accepted