Entra Access Reviews
Integration Context Contract
- Canonical contract:
docs/integration-context.md
| Workflow | tenantId | subscriptionId | environmentCloud | principalType | scopesOrRoles |
|---|---|---|---|---|---|
| Entra Access Reviews operations | required | optional | AzureCloud* |
delegated-user or service-principal | AccessReview.ReadWrite.All, RoleManagement.Read.All, Directory.Read.All |
- Use sovereign cloud values from the canonical contract when applicable.
Fail fast before API calls when required context is missing or malformed. Redact tenant, subscription, and object identifiers.
Command Surface
| Command | Purpose |
|---|---|
access-reviews-setup |
Deterministic workflow for access reviews setup. |
access-reviews-stale-privileged |
Deterministic workflow for access reviews stale privileged. |
access-reviews-cycle-draft |
Deterministic workflow for access reviews cycle draft. |
access-reviews-remediation-tickets |
Deterministic workflow for access reviews remediation tickets. |
access-reviews-status-report |
Deterministic workflow for access reviews status report. |
Guardrails
- Validate context schema and minimum grants before any API call.
- Run read-only discovery first whenever possible.
- Require explicit confirmation for destructive actions.
- Re-query and verify post-action state.
- Return structured, redacted output.
Progressive Disclosure - Reference Files
| Topic | File |
|---|---|
| Endpoint and permission reference | references/api-reference.md |