accessPackage: getApplicablePolicyRequirements

Article
03/09/2024

Namespace: microsoft.graph

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

In Microsoft Entra entitlement management, this action retrieves a list of accessPackageAssignmentRequestRequirements objects that the currently signed-in user can use to create an accessPackageAssignmentRequest. Each requirement object corresponds to an access package assignment policy that the currently signed-in user is allowed to request an assignment for.

This API is available in the following national cloud deployments.

Global service	US Government L4	US Government L5 (DOD)	China operated by 21Vianet
✅	✅	✅	❌

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

Permission type	Least privileged permissions	Higher privileged permissions
Delegated (work or school account)	EntitlementManagement.Read.All	EntitlementManagement.ReadWrite.All
Delegated (personal Microsoft account)	Not supported.	Not supported.
Application	Not supported.	Not supported.

HTTP request

POST /identityGovernance/entitlementManagement/accessPackages/{id}/getApplicablePolicyRequirements

Function parameters

None.

Request headers

Name	Description
Authorization	Bearer {token}. Required. Learn more about authentication and authorization.

Request body

Don't supply a request body for this method if you wish to retrieve a list of access package requirements as in example 1. If you want to get policy requirements for user scope as in example 2, you must supply a request body.

Response

If successful, this method returns a 200 OK response code and an accessPackageAssignmentRequestRequirements collection in the response body, one object for each policy for which the user is an allowedRequestor. If there's a policy with no requirements, the accessPackageAssignmentRequestRequirements has false and null values. If there are no policies where the user is an allowedRequestor, an empty collection is returned instead.

Examples

Example 1: Retrieve a list of access package requirements to create an access package

Request

The following example shows a request.

POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/fb449cf8-3a59-4d86-bdfd-a1b7299681de/getApplicablePolicyRequirements


// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackages["{accessPackage-id}"].GetApplicablePolicyRequirements.PostAsGetApplicablePolicyRequirementsPostResponseAsync();

Important

Microsoft Graph SDKs use the v1.0 version of the API by default, and do not support all the types, properties, and APIs available in the beta version. For details about accessing the beta API with the SDK, see Use the Microsoft Graph SDKs with the beta API.

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


// THE CLI IS IN PREVIEW. NON-PRODUCTION USE ONLY
mgc-beta identity-governance entitlement-management access-packages get-applicable-policy-requirements post --access-package-id {accessPackage-id}

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)



getApplicablePolicyRequirements, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackages().ByAccessPackageId("accessPackage-id").GetApplicablePolicyRequirements().PostAsGetApplicablePolicyRequirementsPostResponse(context.Background(), nil)

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

var result = graphClient.identityGovernance().entitlementManagement().accessPackages().byAccessPackageId("{accessPackage-id}").getApplicablePolicyRequirements().post();

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


const options = {
	authProvider,
};

const client = Client.init(options);

await client.api('/identityGovernance/entitlementManagement/accessPackages/fb449cf8-3a59-4d86-bdfd-a1b7299681de/getApplicablePolicyRequirements')
	.version('beta')
	.post();

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


<?php
use Microsoft\Graph\GraphServiceClient;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);


$result = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackages()->byAccessPackageId('accessPackage-id')->getApplicablePolicyRequirements()->post()->wait();

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


Import-Module Microsoft.Graph.Beta.Identity.Governance

Get-MgBetaEntitlementManagementAccessPackageApplicablePolicyRequirement -AccessPackageId $accessPackageId

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


from msgraph import GraphServiceClient

graph_client = GraphServiceClient(credentials, scopes)


result = await graph_client.identity_governance.entitlement_management.access_packages.by_access_package_id('accessPackage-id').get_applicable_policy_requirements.post()

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 200 OK
Content-Type: application/json

{
    "value": [
        {
            "policyId": "d6322c23-04d6-eb11-b22b-c8d9d21f4e9a",
            "policyDisplayName": "Initial Policy",
            "policyDescription": "Initial Policy",
            "isApprovalRequired": false,
            "isApprovalRequiredForExtension": false,
            "isRequestorJustificationRequired": false,
            "questions": [
                {
                    "@odata.type": "#microsoft.graph.textInputQuestion",
                    "id": "0fd349e2-a3a7-4712-af08-660f29c12b90",
                    "isRequired": true,
                    "isAnswerEditable": null,
                    "sequence": 0,
                    "isSingleLineQuestion": true,
                    "text": {
                        "defaultText": "What is your display name",
                        "localizedTexts": []
                    }
                }
            ],
            "existingAnswers": [],
            "schedule": []
        }
    ]
}

Example 2: Get policy requirements for a given user scope

Request

The following example shows a request.

POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/b15419bb-5ffc-ea11-b207-c8d9d21f4e9a/getApplicablePolicyRequirements

{
        "subject": {
            "objectId": "5acd375c-8acb-45de-a958-fa0dd89259ad"
        }
    }


// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Beta.IdentityGovernance.EntitlementManagement.AccessPackages.Item.GetApplicablePolicyRequirements;

var requestBody = new GetApplicablePolicyRequirementsPostRequestBody
{
	AdditionalData = new Dictionary<string, object>
	{
		{
			"subject" , new 
			{
				ObjectId = "5acd375c-8acb-45de-a958-fa0dd89259ad",
			}
		},
	},
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackages["{accessPackage-id}"].GetApplicablePolicyRequirements.PostAsGetApplicablePolicyRequirementsPostResponseAsync(requestBody);

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


// THE CLI IS IN PREVIEW. NON-PRODUCTION USE ONLY
mgc-beta identity-governance entitlement-management access-packages get-applicable-policy-requirements post --access-package-id {accessPackage-id}

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
	  graphidentitygovernance "github.com/microsoftgraph/msgraph-beta-sdk-go/identitygovernance"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphidentitygovernance.NewGetApplicablePolicyRequirementsPostRequestBody()
additionalData := map[string]interface{}{
subject := graphmodels.New()
objectId := "5acd375c-8acb-45de-a958-fa0dd89259ad"
subject.SetObjectId(&objectId) 
	requestBody.SetSubject(subject)
}
requestBody.SetAdditionalData(additionalData)

getApplicablePolicyRequirements, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackages().ByAccessPackageId("accessPackage-id").GetApplicablePolicyRequirements().PostAsGetApplicablePolicyRequirementsPostResponse(context.Background(), requestBody, nil)

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

com.microsoft.graph.beta.identitygovernance.entitlementmanagement.accesspackages.item.getapplicablepolicyrequirements.GetApplicablePolicyRequirementsPostRequestBody getApplicablePolicyRequirementsPostRequestBody = new com.microsoft.graph.beta.identitygovernance.entitlementmanagement.accesspackages.item.getapplicablepolicyrequirements.GetApplicablePolicyRequirementsPostRequestBody();
HashMap<String, Object> additionalData = new HashMap<String, Object>();
 subject = new ();
subject.setObjectId("5acd375c-8acb-45de-a958-fa0dd89259ad");
additionalData.put("subject", subject);
getApplicablePolicyRequirementsPostRequestBody.setAdditionalData(additionalData);
var result = graphClient.identityGovernance().entitlementManagement().accessPackages().byAccessPackageId("{accessPackage-id}").getApplicablePolicyRequirements().post(getApplicablePolicyRequirementsPostRequestBody);

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


const options = {
	authProvider,
};

const client = Client.init(options);

const accessPackageAssignmentRequestRequirements = {
        subject: {
            objectId: '5acd375c-8acb-45de-a958-fa0dd89259ad'
        }
    };

await client.api('/identityGovernance/entitlementManagement/accessPackages/b15419bb-5ffc-ea11-b207-c8d9d21f4e9a/getApplicablePolicyRequirements')
	.version('beta')
	.post(accessPackageAssignmentRequestRequirements);

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Models\GetApplicablePolicyRequirementsPostRequestBody;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestBody = new GetApplicablePolicyRequirementsPostRequestBody();
$additionalData = [
	'subject' => [
		'objectId' => '5acd375c-8acb-45de-a958-fa0dd89259ad',
	],
];
$requestBody->setAdditionalData($additionalData);

$result = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackages()->byAccessPackageId('accessPackage-id')->getApplicablePolicyRequirements()->post($requestBody)->wait();

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


Import-Module Microsoft.Graph.Beta.Identity.Governance

$params = @{
	subject = @{
		objectId = "5acd375c-8acb-45de-a958-fa0dd89259ad"
	}
}

Get-MgBetaEntitlementManagementAccessPackageApplicablePolicyRequirement -AccessPackageId $accessPackageId -BodyParameter $params

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


from msgraph import GraphServiceClient
from msgraph.generated.models.get_applicable_policy_requirements_post_request_body import GetApplicablePolicyRequirementsPostRequestBody

graph_client = GraphServiceClient(credentials, scopes)

request_body = GetApplicablePolicyRequirementsPostRequestBody(
	additional_data = {
			"subject" : {
					"object_id" : "5acd375c-8acb-45de-a958-fa0dd89259ad",
			},
	}
)

result = await graph_client.identity_governance.entitlement_management.access_packages.by_access_package_id('accessPackage-id').get_applicable_policy_requirements.post(request_body)

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

Response

The following example shows the response.

HTTP/1.1 200 OK
Content-Type: application/json

{
    "value": [
        {
            "policyId": "d6322c23-04d6-eb11-b22b-c8d9d21f4e9a",
            "policyDisplayName": "Initial Policy",
            "policyDescription": "Initial Policy",
            "isApprovalRequired": false,
            "isApprovalRequiredForExtension": false,
            "isRequestorJustificationRequired": false,
            "questions": [
                {
                    "@odata.type": "#microsoft.graph.textInputQuestion",
                    "id": "5a7f2a8f-b802-4438-bec6-09599bc43e13",
                    "isRequired": false,
                    "isAnswerEditable": true,
                    "sequence": 0,
                    "isSingleLineQuestion": true,
                    "text": {
                        "defaultText": "Enter your mail",
                        "localizedTexts": []
                    }
                }
            ],
            "existingAnswers": [
                {
                    "@odata.type": "#microsoft.graph.answerString",
                    "displayValue": "admin@contoso.com",
                    "value": "admin@contoso.com",
                    "answeredQuestion": {
                        "@odata.type": "#microsoft.graph.textInputQuestion",
                        "id": "5a7f2a8f-b802-4438-bec6-09599bc43e13",
                        "isRequired": false,
                        "isAnswerEditable": true,
                        "sequence": 0,
                        "isSingleLineQuestion": true,
                        "text": {
                            "defaultText": "Enter your mail",
                            "localizedTexts": []
                        }
                    }
                }
            ],
            "schedule": []
        }
    ]
}

Example 3: Get policy requirements for verifiable credential status requirements

Request

The following example shows a request.

POST /identityGovernance/entitlementManagement/accessPackages(‘b15419bb-5ffc-ea11-b207-c8d9d21f4e9a’)/getApplicablePolicyRequirements

Response

The following example shows the response if it is the first time credentials are requested and the requestor didn't scanned the QR code or clicked the URL.

HTTP/1.1 200 OK
Content-Type: application/json

{
  "value": [
        {
            "policyId": "a93f6641-bcba-ec11-9d14-001a7dda7113",
            "policyDisplayName": "VC Policy 1",
            "policyDescription": "VC Policy Description 1",
            "isApprovalRequiredForAdd": false,
            "isApprovalRequiredForUpdate": false,
            "isApprovalRequired": false,
            "isApprovalRequiredForExtension": false,
            "isCustomAssignmentScheduleAllowed": true,
            "allowCustomAssignmentSchedule": true,
            "isRequestorJustificationRequired": false,
            "schedule": {
                "startDateTime": null,
                "duration": "P365D",
                "stopDateTime": null,
                "expiration": {
                "endDateTime": null,
                "duration": "P365D",
                "type": "afterDuration"
                },
                "recurrence": null
            },
            "questions": [],
            "existingAnswers": [],
            "verifiableCredentialRequirementStatus": {
                "@odata.type": "#microsoft.graph.verifiableCredentialRequired",
                "expiryDateTime": "2022-05-10T23:32:47.8232759Z",
                "url": "openid://vc/?request_uri=https://beta.did.msidentity.com/v1.0/87654321-0000-0000-0000-000000000000/verifiablecredentials/request/e4ef27ca-eb8c-4b63-823b-3b95140eac11",
            }
        }
    ]
}

If the requestor has scanned the QR code or clicked the URL, the verifiableCredentialRequirementStatus property is in the following format.

"verifiableCredentialRequirementStatus": {
    "@odata.type": "#microsoft.graph.verifiableCredentialRetrieved",
    "expiryDateTime": "2022-05-10T23:32:47.8232759Z"
}

If the requestor presented valid credential, the verifiableCredentialRequirementStatus property is in the following format.

"verifiableCredentialRequirementStatus": {
    "@odata.type": "#microsoft.graph.verifiableCredentialVerified"
}

accessPackage: getApplicablePolicyRequirements

Permissions

HTTP request

Function parameters

Request headers

Request body

Response

Examples

Example 1: Retrieve a list of access package requirements to create an access package

Request

Response

Example 2: Get policy requirements for a given user scope

Request

Response

Example 3: Get policy requirements for verifiable credential status requirements

Request

Response

Feedback

Feedback

Additional resources