ESC
Type to search...

PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup

Export JSON
Export CSV
Copy URL
Print
ApplicationDelegated Read/Write User Scope

Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, without a signed-in user.

Permission data: April 6, 2026 at 4:06 AM UTC
Delegated Access App-Only Access

Permission Details

Application Permission

Read, create, and delete assignment schedules for access to Azure AD groups

Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, without a signed-in user.

Delegated Permission Admin consent required

Read, create, and delete assignment schedules for access to Azure AD groups

Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user.

Properties

Microsoft Graph v1.0 endpoint-derived-docs

Properties is shown from stable Microsoft Graph v1.0 metadata.

Property Type Description
accessReviews object
appConsent object
entitlementManagement object
lifecycleWorkflows object
privilegedAccess object
termsOfUse object

JSON Representation

Microsoft Graph v1.0 endpoint-derived-docs

JSON representation is shown from stable Microsoft Graph v1.0 metadata.

JSON representation
{
  "accessReviews": {
    "sample": "value"
  },
  "appConsent": {
    "sample": "value"
  },
  "entitlementManagement": {
    "sample": "value"
  },
  "lifecycleWorkflows": {
    "sample": "value"
  },
  "privilegedAccess": {
    "sample": "value"
  },
  "termsOfUse": {
    "sample": "value"
  }
}

Relationships

Microsoft Graph v1.0 endpoint-derived-docs

Relationships is shown from stable Microsoft Graph v1.0 metadata.

Relationship Type Description
accessReviews accessReviewSet Container for the base resources that expose the access reviews API and features.
appConsent appConsent Container for base resources that expose the app consent request API and features. Currently exposes only the appConsentRequests resource.
entitlementManagement entitlementManagement Container for entitlement management resources, including accessPackageCatalog, connectedOrganization, and entitlementManagementSettings.
termsOfUse termsOfUseContainer Container for the resources that expose the terms of use API and its features, including agreements and agreementAcceptances.
lifecycleWorkflows identityGovernance.lifecycleWorkflowsContainer Container for Lifecycle Workflow resources, including workflow, customTaskExtension, and lifecycleManagementSettings.
privilegedAccess privilegedAccessRoot Container for the base resources that expose the API and features related to Privileged Identity Management (PIM) for Groups.
catalogs accessPackageCatalog collection Related catalogs data exposed by this resource.
permissionsAnalytics permissionsAnalyticsAggregation Related permissionsAnalytics data exposed by this resource.

Graph Methods

Delegated access App-only access
Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{accessPackageAssignmentRequestId}
GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{accessPackageAssignmentRequestId}/stages
GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{accessPackageAssignmentRequestId}/stages/{approvalStageId}
GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/filterByCurrentUser(on='approver')
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/{privilegedaccessgroupassignmentschedulerequestId}
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/{privilegedaccessgroupassignmentschedulerequestId}/stages
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/{privilegedaccessgroupassignmentschedulerequestId}/stages/{approvalStageId}
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/filterByCurrentUser(on='approver')
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances?$filter=groupId eq '{groupId}'
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances?$filter=principalId eq '{principalId}'
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstanceId}
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/filterByCurrentUser(on=parameterValue)
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests?$filter=groupId eq '{groupId}'
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests?$filter=principalId eq '{principalId}'
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequestId}
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/filterByCurrentUser(on='parameterValue')
GET /identityGovernance/privilegedAccess/group/assignmentSchedules?$filter=groupId eq '{groupId}'
GET /identityGovernance/privilegedAccess/group/assignmentSchedules?$filter=principalId eq '{principalId}'
GET /identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentScheduleId}
GET /identityGovernance/privilegedAccess/group/assignmentSchedules/filterByCurrentUser(on='parameterValue')
POST /identityGovernance/privilegedAccess/group/assignmentScheduleRequests
POST /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequestId}/cancel
PATCH /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{accessPackageAssignmentRequestId}/stages/{approvalStageId}
PATCH /identityGovernance/privilegedAccess/group/assignmentApprovals/{privilegedaccessgroupassignmentschedulerequestId}/stages/{approvalStageId}
Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{id}
GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{id}/steps
GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{id}/steps/{id}
GET /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/filterByCurrentUser(on='approver')
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/{id}
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/{id}/steps
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/{id}/steps/{id}
GET /identityGovernance/privilegedAccess/group/assignmentApprovals/filterByCurrentUser(on='approver')
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances?$filter=groupId eq '{groupId}'
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances?$filter=principalId eq '{principalId}'
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstanceId}
GET /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/filterByCurrentUser(on=parameterValue)
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests?$filter=groupId eq '{groupId}'
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests?$filter=principalId eq '{principalId}'
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequestId}
GET /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/filterByCurrentUser(on='parameterValue')
GET /identityGovernance/privilegedAccess/group/assignmentSchedules?$filter=groupId eq '{groupId}'
GET /identityGovernance/privilegedAccess/group/assignmentSchedules?$filter=principalId eq '{principalId}'
GET /identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentScheduleId}
GET /identityGovernance/privilegedAccess/group/assignmentSchedules/filterByCurrentUser(on='parameterValue')
GET /roleManagement/directory/roleAssignmentApprovals/{id}
GET /roleManagement/directory/roleAssignmentApprovals/{id}/steps
GET /roleManagement/directory/roleAssignmentApprovals/{id}/steps/{id}
POST /identityGovernance/privilegedAccess/group/assignmentScheduleRequests
POST /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequestId}/cancel
PATCH /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{id}/steps/{id}
PATCH /identityGovernance/privilegedAccess/group/assignmentApprovals/{id}/steps/{id}
PATCH /roleManagement/directory/roleAssignmentApprovals/{id}/steps/{id}
Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
Get-MgEntitlementManagementAccessPackageAssignmentApprovalStage /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{accessPackageAssignmentRequestId}/stages
List approval stages
Get-MgEntitlementManagementAccessPackageAssignmentApprovalStage /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{accessPackageAssignmentRequestId}/stages/{approvalStageId}
Get approvalStage
Get-MgIdentityGovernancePrivilegedAccessGroupAssignmentSchedule /identityGovernance/privilegedAccess/group/assignmentSchedules?$filter=groupId eq '{groupId}'
List assignmentSchedules
Get-MgIdentityGovernancePrivilegedAccessGroupAssignmentSchedule /identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentScheduleId}
Get privilegedAccessGroupAssignmentSchedule
Get-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleInstance /identityGovernance/privilegedAccess/group/assignmentScheduleInstances?$filter=groupId eq '{groupId}'
List assignmentScheduleInstances
Get-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleInstance /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstanceId}
Get privilegedAccessGroupAssignmentScheduleInstance
Get-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleRequest /identityGovernance/privilegedAccess/group/assignmentScheduleRequests?$filter=groupId eq '{groupId}'
List assignmentScheduleRequests
Get-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleRequest /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequestId}
Get privilegedAccessGroupAssignmentScheduleRequest
Invoke-MgFilterEntitlementManagementAccessPackageAssignmentApprovalByCurrentUser /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/filterByCurrentUser(on='approver')
approval: filterByCurrentUser
Invoke-MgFilterIdentityGovernancePrivilegedAccessGroupAssignmentApprovalByCurrentUser /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/filterByCurrentUser(on='approver')
approval: filterByCurrentUser
Invoke-MgFilterIdentityGovernancePrivilegedAccessGroupAssignmentScheduleByCurrentUser /identityGovernance/privilegedAccess/group/assignmentSchedules/filterByCurrentUser(on='parameterValue')
privilegedAccessGroupAssignmentSchedule: filterByCurrentUser
Invoke-MgFilterIdentityGovernancePrivilegedAccessGroupAssignmentScheduleInstanceByCurrentUser /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/filterByCurrentUser(on=parameterValue)
privilegedAccessGroupAssignmentScheduleInstance: filterByCurrentUser
Invoke-MgFilterIdentityGovernancePrivilegedAccessGroupAssignmentScheduleRequestByCurrentUser /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/filterByCurrentUser(on='parameterValue')
privilegedAccessGroupAssignmentScheduleRequest: filterByCurrentUser
New-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleRequest /identityGovernance/privilegedAccess/group/assignmentScheduleRequests
Create assignmentScheduleRequest
Update-MgEntitlementManagementAccessPackageAssignmentApprovalStage /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{accessPackageAssignmentRequestId}/stages/{approvalStageId}
Update approvalStage
Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
Get-MgBetaIdentityGovernancePrivilegedAccessGroupAssignmentSchedule /identityGovernance/privilegedAccess/group/assignmentSchedules?$filter=groupId eq '{groupId}'
List assignmentSchedules
Get-MgBetaIdentityGovernancePrivilegedAccessGroupAssignmentSchedule /identityGovernance/privilegedAccess/group/assignmentSchedules/{privilegedAccessGroupAssignmentScheduleId}
Get privilegedAccessGroupAssignmentSchedule
Get-MgBetaIdentityGovernancePrivilegedAccessGroupAssignmentScheduleInstance /identityGovernance/privilegedAccess/group/assignmentScheduleInstances?$filter=groupId eq '{groupId}'
List assignmentScheduleInstances
Get-MgBetaIdentityGovernancePrivilegedAccessGroupAssignmentScheduleInstance /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/{privilegedAccessGroupAssignmentScheduleInstanceId}
Get privilegedAccessGroupAssignmentScheduleInstance
Get-MgBetaIdentityGovernancePrivilegedAccessGroupAssignmentScheduleRequest /identityGovernance/privilegedAccess/group/assignmentScheduleRequests?$filter=groupId eq '{groupId}'
List assignmentScheduleRequests
Get-MgBetaIdentityGovernancePrivilegedAccessGroupAssignmentScheduleRequest /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/{privilegedAccessGroupAssignmentScheduleRequestId}
Get privilegedAccessGroupAssignmentScheduleRequest
Invoke-MgBetaFilterEntitlementManagementAccessPackageAssignmentApprovalByCurrentUser /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/filterByCurrentUser(on='approver')
approval: filterByCurrentUser
Invoke-MgBetaFilterIdentityGovernancePrivilegedAccessGroupAssignmentApprovalByCurrentUser /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/filterByCurrentUser(on='approver')
approval: filterByCurrentUser
Invoke-MgBetaFilterIdentityGovernancePrivilegedAccessGroupAssignmentScheduleByCurrentUser /identityGovernance/privilegedAccess/group/assignmentSchedules/filterByCurrentUser(on='parameterValue')
privilegedAccessGroupAssignmentSchedule: filterByCurrentUser
Invoke-MgBetaFilterIdentityGovernancePrivilegedAccessGroupAssignmentScheduleInstanceByCurrentUser /identityGovernance/privilegedAccess/group/assignmentScheduleInstances/filterByCurrentUser(on=parameterValue)
privilegedAccessGroupAssignmentScheduleInstance: filterByCurrentUser
Invoke-MgBetaFilterIdentityGovernancePrivilegedAccessGroupAssignmentScheduleRequestByCurrentUser /identityGovernance/privilegedAccess/group/assignmentScheduleRequests/filterByCurrentUser(on='parameterValue')
privilegedAccessGroupAssignmentScheduleRequest: filterByCurrentUser
Update-MgBetaEntitlementManagementAccessPackageAssignmentApprovalStep /identityGovernance/entitlementManagement/accessPackageAssignmentApprovals/{id}/steps/{id}
Update approvalStep

Code Examples

C# / .NET SDK
Create assignmentScheduleRequest
// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Models;

var requestBody = new PrivilegedAccessGroupAssignmentScheduleRequest
{
	AccessId = PrivilegedAccessGroupRelationships.Member,
	PrincipalId = "3cce9d87-3986-4f19-8335-7ed075408ca2",
	GroupId = "68e55cce-cf7e-4a2d-9046-3e4e75c4bfa7",
	Action = ScheduleRequestActions.AdminAssign,
	ScheduleInfo = new RequestSchedule
	{
		StartDateTime = DateTimeOffset.Parse("2022-12-08T07:43:00.000Z"),
		Expiration = new ExpirationPattern
		{
			Type = ExpirationPatternType.AfterDuration,
			Duration = TimeSpan.Parse("PT2H"),
		},
	},
	Justification = "Assign active member access.",
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.IdentityGovernance.PrivilegedAccess.Group.AssignmentScheduleRequests.PostAsync(requestBody);
JavaScript
Create assignmentScheduleRequest
const options = {
	authProvider,
};

const client = Client.init(options);

const privilegedAccessGroupAssignmentScheduleRequest = {
  accessId: 'member', 
  principalId: '3cce9d87-3986-4f19-8335-7ed075408ca2', 
  groupId: '68e55cce-cf7e-4a2d-9046-3e4e75c4bfa7', 
  action: 'adminAssign', 
  scheduleInfo: { 
    startDateTime: '2022-12-08T07:43:00.000Z', 
    expiration: { 
      type: 'afterDuration', 
      duration: 'PT2H' 
    } 
  }, 
  justification: 'Assign active member access.'
};

await client.api('/identityGovernance/privilegedAccess/group/assignmentScheduleRequests')
	.post(privilegedAccessGroupAssignmentScheduleRequest);
PowerShell
Create assignmentScheduleRequest
Import-Module Microsoft.Graph.Identity.Governance

$params = @{
	accessId = "member"
	principalId = "3cce9d87-3986-4f19-8335-7ed075408ca2"
	groupId = "68e55cce-cf7e-4a2d-9046-3e4e75c4bfa7"
	action = "adminAssign"
	scheduleInfo = @{
		startDateTime = [System.DateTime]::Parse("2022-12-08T07:43:00.000Z")
		expiration = @{
			type = "afterDuration"
			duration = "PT2H"
		}
	}
	justification = "Assign active member access."
}

New-MgIdentityGovernancePrivilegedAccessGroupAssignmentScheduleRequest -BodyParameter $params
Python
Create assignmentScheduleRequest
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.privileged_access_group_assignment_schedule_request import PrivilegedAccessGroupAssignmentScheduleRequest
from msgraph.generated.models.privileged_access_group_relationships import PrivilegedAccessGroupRelationships
from msgraph.generated.models.schedule_request_actions import ScheduleRequestActions
from msgraph.generated.models.request_schedule import RequestSchedule
from msgraph.generated.models.expiration_pattern import ExpirationPattern
from msgraph.generated.models.expiration_pattern_type import ExpirationPatternType
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = PrivilegedAccessGroupAssignmentScheduleRequest(
	access_id = PrivilegedAccessGroupRelationships.Member,
	principal_id = "3cce9d87-3986-4f19-8335-7ed075408ca2",
	group_id = "68e55cce-cf7e-4a2d-9046-3e4e75c4bfa7",
	action = ScheduleRequestActions.AdminAssign,
	schedule_info = RequestSchedule(
		start_date_time = "2022-12-08T07:43:00.000Z",
		expiration = ExpirationPattern(
			type = ExpirationPatternType.AfterDuration,
			duration = "PT2H",
		),
	),
	justification = "Assign active member access.",
)

result = await graph_client.identity_governance.privileged_access.group.assignment_schedule_requests.post(request_body)

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or delegated permissions and search for PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup

4

Grant Admin Consent

Application permissions always require admin consent.