Access Package Policy via script

Joshua_Reynolds 

Hey Josh,

I came across your thread whilst trying to solve another issue, and thought I would share code I have used that successfully works (if I have understood your challenge correctly).

Please forgive my inefficient coding skills - in my current role I don't write much anymore, but very much enjoy opportunities to get back to the tools! 🙂

# 1.3.7 Create Access Package Policies
    # T1requestorSettings
    $T1requestorSettings = @"
        {
        "acceptRequests": true,
        "allowedRequestors": [
            {
            "@odata.type": "#microsoft.graph.groupMembers",
            "id": "$($T1allowedRequestors.id)",
            "description": "$($T1allowedRequestors.displayName)",
            "isBackup": false
            }
        ],
        "scopeType": "SpecificDirectorySubjects"
        }
"@
    $T1requestorSettingsJSON = ConvertFrom-Json $T1requestorSettings

    # T1requestApprovalSettings
    $T1requestApprovalSettings = @"
        {
        "approvalMode": "Serial",
        "approvalStages": [
            {
            "approvalStageTimeOutInDays": 7,
            "escalationApprovers": [ ],
            "escalationTimeInMinutes": 0,
            "isApproverJustificationRequired": true,
            "isEscalationEnabled": false,
            "primaryApprovers": [
                {
                "@odata.type": "#microsoft.graph.groupMembers",
                "id": "$($T1primaryApprovers.id)",
                "description": "$($T1primaryApprovers.displayName)",
                "isBackup": true
                },
                {
                "@odata.type": "#microsoft.graph.requestorManager",
                "managerLevel": 1,
                "isBackup": false
                }
            ]
            },
            {
            "approvalStageTimeOutInDays": 7,
            "escalationApprovers": [ ],
            "escalationTimeInMinutes": 0,
            "isApproverJustificationRequired": true,
            "isEscalationEnabled": false,
            "primaryApprovers": [
                {
                "@odata.type": "#microsoft.graph.groupMembers",
                "id": "$($T1secondaryApprovers.id)",
                "description": "$($T1secondaryApprovers.displayName)",
                "isBackup": false
                }
            ]
            }
        ],
        "isApprovalRequired": true,
        "isApprovalRequiredForExtension": false,
        "isRequestorJustificationRequired": true
        }
"@
    $T1requestApprovalSettingsJSON = ConvertFrom-Json $T1requestApprovalSettings

    # T1accessReviewSettings
    $T1accessReviewSettings = @{
        "accessReviewTimeoutBehavior" = 'acceptAccessRecommendation'
        "durationInDays" =25
        "isAccessRecommendationEnabled" = $true
        "isApprovalJustificationRequired" = $true
        "isEnabled" = $true
        "recurrenceType" = 'quarterly'
        "reviewers" = '[ ]'
        "reviewerType" = 'Self'
        }

$T1policy = New-MgBetaEntitlementManagementAccessPackageAssignmentPolicy -AccessPackageId $T1accessPackage.id -DisplayName $T1AccessPackagePolicyName -Description $T1AccessPackagePolicyDesc -DurationInDays $duration -RequestorSettings ($T1requestorSettingsJSON | ConvertTo-Json -Depth 😎 -RequestApprovalSettings ($T1requestApprovalSettingsJSON | convertto-json -Depth 😎 -AccessReviewSettings $T1accessReviewSettings | Format-List

It certainly took some time to get this working and as you can see I broke down each individual component to feed into the powershell cmdelet instead of a single body parameter. 

I believe the area of expiration falls under the $accessreviewsettings part of the code above. I have used days for my configuration, but after a quick look believe that hours should be possible using something like the below (however this would need to be verified):

# T1accessReviewSettings
    $T1accessReviewSettings = @{
        "accessReviewTimeoutBehavior" = 'acceptAccessRecommendation'
        "durationInHours" =12
        "isAccessRecommendationEnabled" = $true
        "isApprovalJustificationRequired" = $true
        "isEnabled" = $true
        "recurrenceType" = 'daily'
        "reviewers" = '[ ]'
        "reviewerType" = 'Self'
        }

I hope this might give you some further avenues to investigate if you have not already managed to sort it.

Happy days,

adrian