Scope multiple groups in same Azure access review (API)

user_11657321 0
Viewed 54

I'm trying to create an access review using the Microsoft Graph API. I can't figure out how to scope (target) multiple groups in the same access review using the available documentation and samples. This is easily done when creating one in the Azure portal.

My goal is to have one access review that scope two or three Azure AD groups. These groups are granting access to Reader, Contributor and Owner role within a subscription.

Here is a sample code that I used to create an access review that scope one group.

{
  "displayName": "Testing",
  "descriptionForAdmins": "Testing",
  "descriptionForReviewers": "Testing",
  "scope": {
    "@odata.type": "#microsoft.graph.accessReviewQueryScope",
    "query": "/groups/<groupid>/transitiveMembers",
    "queryType": "MicrosoftGraph"
  },
  "reviewers": [
    {
      "query": "/groups/<groupid>/owners",
      "queryType": "MicrosoftGraph"
    }
  ],  
  "settings": {
    "mailNotificationsEnabled": true,
    "reminderNotificationsEnabled": true,
    "justificationRequiredOnApproval": true,
    "defaultDecisionEnabled": false,
    "defaultDecision": "None",
    "instanceDurationInDays": 3,
    "recommendationsEnabled": false,
    "recurrence": {
      "pattern": {
        "type": "weekly",
        "interval": 1
      },
      "range": {
        "type": "noEnd",
        "startDate": "2022-02-25T12:02:30.667Z"
      }
    }
  }
}

Any ideas?

azure
1 Answers

I will answer my own question.

I see now in the browser when I create an access review with two groups in scope that it actually creates two separate access reviews, one for each group. It seems that it's not possible to create one access review for multiple groups when posting this.

user_116573210
Related