@@ -409,3 +409,304 @@ Content-type: application/json
409409 "modifiedDateTime": "2019-12-11T01:35:26.4754081Z"
410410}
411411```
412+
413+ ### Example 5: Add an Active Subscription scoped to a Resource Group Resource Role to an access package
414+
415+ #### Request
416+
417+ The following example shows a request to add an active Subscription scoped to a Resource Group Resource Role to an access package.
418+
419+ Before this request, you must have already added the access package resource ` b09a0288-a83e-4ae6-8a53-bc09aeb966ea ` for the Subscription ` 828b526f-c769-4b19-9797-734b4843b978 ` to the access package catalog containing this access package. The resource could have been added to the catalog by [ creating an access package resource request] ( /graph/api/entitlementmanagement-post-accesspackageresourcerequests?view=graph-rest-beta ) .
420+
421+ # [ HTTP] ( #tab/http )
422+ <!-- {
423+ "blockType": "request",
424+ "name": "create_accesspackageresourcerolescope_from_accesspackage_subscription"
425+ }-->
426+
427+ ``` http
428+ POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/5f7f4c7d-b3f5-4988-a17b-3f09b6f5a9ee/accessPackageResourceRoleScopes
429+ Content-type: application/json
430+
431+ {
432+ "accessPackageResourceRole": {
433+ "originId": "/subscriptions/828b526f-c769-4b19-9797-734b4843b978/providers/Microsoft.Authorization/roleDefinitions/76cc9ee4-d5d3-4a45-a930-26add3d73475",
434+ "displayName": "Access Review Operator Service Role",
435+ "description": "Lets you grant Access Review System app permissions to discover and revoke access as needed by the access review process.",
436+ "accessPackageResource": {
437+ "id": "b09a0288-a83e-4ae6-8a53-bc09aeb966ea",
438+ "description": "Dev",
439+ "displayName": "Dev",
440+ "resourceType": "Subscription",
441+ "originId": "/subscriptions/828b526f-c769-4b19-9797-734b4843b978",
442+ "originSystem": "AzureResources"
443+ },
444+ "originSystem": "AzureResources",
445+ "type": "active"
446+ },
447+ "accessPackageResourceScope": {
448+ "id": "e1e0ec8c-472d-4ec5-a8f9-29e0bc275640",
449+ "description": "/resourceGroups/rg",
450+ "displayName": "/resourceGroups/rg",
451+ "isRootScope": false,
452+ "originSystem": "AzureResources",
453+ "originId": "/subscriptions/828b526f-c769-4b19-9797-734b4843b978/resourceGroups/rg"
454+ }
455+ }
456+ ```
457+
458+ # [ C#] ( #tab/csharp )
459+ [ !INCLUDE [ sample-code] ( ../includes/snippets/csharp/create-accesspackageresourcerolescope-from-accesspackage-subscription-csharp-snippets.md )]
460+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
461+
462+ # [ Go] ( #tab/go )
463+ [ !INCLUDE [ sample-code] ( ../includes/snippets/go/create-accesspackageresourcerolescope-from-accesspackage-subscription-go-snippets.md )]
464+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
465+
466+ # [ Java] ( #tab/java )
467+ [ !INCLUDE [ sample-code] ( ../includes/snippets/java/create-accesspackageresourcerolescope-from-accesspackage-subscription-java-snippets.md )]
468+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
469+
470+ # [ JavaScript] ( #tab/javascript )
471+ [ !INCLUDE [ sample-code] ( ../includes/snippets/javascript/create-accesspackageresourcerolescope-from-accesspackage-subscription-javascript-snippets.md )]
472+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
473+
474+ # [ PHP] ( #tab/php )
475+ [ !INCLUDE [ sample-code] ( ../includes/snippets/php/create-accesspackageresourcerolescope-from-accesspackage-subscription-php-snippets.md )]
476+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
477+
478+ # [ PowerShell] ( #tab/powershell )
479+ [ !INCLUDE [ sample-code] ( ../includes/snippets/powershell/create-accesspackageresourcerolescope-from-accesspackage-subscription-powershell-snippets.md )]
480+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
481+
482+ # [ Python] ( #tab/python )
483+ [ !INCLUDE [ sample-code] ( ../includes/snippets/python/create-accesspackageresourcerolescope-from-accesspackage-subscription-python-snippets.md )]
484+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
485+
486+ ---
487+
488+ #### Response
489+
490+ The following example shows the response.
491+
492+ > ** Note:** The response object shown here might be shortened for readability.
493+
494+ <!-- {
495+ "blockType": "response",
496+ "truncated": true,
497+ "@odata.type": "microsoft.graph.accessPackageResourceRoleScope"
498+ } -->
499+
500+ ``` http
501+ HTTP/1.1 201 Created
502+ Content-type: application/json
503+
504+ {
505+ "id": "34b2d7de-e8d6-4ba8-843e-a03546feac63_e1e0ec8c-472d-4ec5-a8f9-29e0bc275640",
506+ "createdBy": "admin@example.com",
507+ "createdDateTime": "2026-02-09T22:31:55.3690356Z",
508+ "modifiedBy": "admin@example.com",
509+ "modifiedDateTime": "2026-02-09T22:31:55.3690356Z"
510+ }
511+ ```
512+
513+ ### Example 6: Add Eligible Management Group Resource Role to an access package
514+
515+ #### Request
516+
517+ The following example shows a request to add an eligible Management Group scoped to a Resource Role to an access package.
518+
519+ Before this request, you must have already added the access package resource ` c347ca9b-a9cc-4df9-bc3c-00c8e0297692 ` for the Management Group ` test-mgmtgroup ` to the access package catalog containing this access package. The resource could have been added to the catalog by [ creating an access package resource request] ( /graph/api/entitlementmanagement-post-accesspackageresourcerequests?view=graph-rest-beta ) .
520+
521+ # [ HTTP] ( #tab/http )
522+ <!-- {
523+ "blockType": "request",
524+ "name": "create_accesspackageresourcerolescope_from_accesspackage_subscription_management_group"
525+ }-->
526+
527+ ``` http
528+ POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/5f7f4c7d-b3f5-4988-a17b-3f09b6f5a9ee/accessPackageResourceRoleScopes
529+ Content-type: application/json
530+
531+ {
532+ "accessPackageResourceRole": {
533+ "id": "055c76c1-a466-4f1a-9279-4a2ccaa7ac3e",
534+ "originId": "/providers/Microsoft.Authorization/roleDefinitions/76cc9ee4-d5d3-4a45-a930-26add3d73475",
535+ "displayName": "Access Review Operator Service Role",
536+ "description": "Lets you grant Access Review System app permissions to discover and revoke access as needed by the access review process.",
537+ "accessPackageResource": {
538+ "id": "c347ca9b-a9cc-4df9-bc3c-00c8e0297692",
539+ "description": "test-mgmtgroup",
540+ "displayName": "test-mgmtgroup",
541+ "resourceType": "ManagementGroup",
542+ "originId": "/providers/Microsoft.Management/managementGroups/test-mgmtgroup",
543+ "originSystem": "AzureResources"
544+ },
545+ "originSystem": "AzureResources",
546+ "type": "eligible"
547+ },
548+ "accessPackageResourceScope": {
549+ "id": "338613b3-b410-4c6d-b5e9-45590bc8a357",
550+ "displayName": "Root",
551+ "description": "Root Scope",
552+ "originId": "/providers/Microsoft.Management/managementGroups/test-mgmtgroup",
553+ "originSystem": "AzureResources",
554+ "isRootScope": true
555+ }
556+ }
557+ ```
558+
559+ # [ C#] ( #tab/csharp )
560+ [ !INCLUDE [ sample-code] ( ../includes/snippets/csharp/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-group-csharp-snippets.md )]
561+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
562+
563+ # [ Go] ( #tab/go )
564+ [ !INCLUDE [ sample-code] ( ../includes/snippets/go/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-group-go-snippets.md )]
565+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
566+
567+ # [ Java] ( #tab/java )
568+ [ !INCLUDE [ sample-code] ( ../includes/snippets/java/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-group-java-snippets.md )]
569+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
570+
571+ # [ JavaScript] ( #tab/javascript )
572+ [ !INCLUDE [ sample-code] ( ../includes/snippets/javascript/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-group-javascript-snippets.md )]
573+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
574+
575+ # [ PHP] ( #tab/php )
576+ [ !INCLUDE [ sample-code] ( ../includes/snippets/php/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-group-php-snippets.md )]
577+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
578+
579+ # [ PowerShell] ( #tab/powershell )
580+ [ !INCLUDE [ sample-code] ( ../includes/snippets/powershell/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-group-powershell-snippets.md )]
581+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
582+
583+ # [ Python] ( #tab/python )
584+ [ !INCLUDE [ sample-code] ( ../includes/snippets/python/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-group-python-snippets.md )]
585+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
586+
587+ ---
588+
589+ #### Response
590+
591+ The following example shows the response.
592+
593+ > ** Note:** The response object shown here might be shortened for readability.
594+
595+ <!-- {
596+ "blockType": "response",
597+ "truncated": true,
598+ "@odata.type": "microsoft.graph.accessPackageResourceRoleScope"
599+ } -->
600+
601+ ``` http
602+ HTTP/1.1 201 Created
603+ Content-type: application/json
604+
605+ {
606+ "id": "055c76c1-a466-4f1a-9279-4a2ccaa7ac3e_338613b3-b410-4c6d-b5e9-45590bc8a357",
607+ "createdBy": "admin@example.com",
608+ "createdDateTime": "2026-02-09T22:23:14.8561335Z",
609+ "modifiedBy": "admin@example.com",
610+ "modifiedDateTime": "2026-02-09T22:23:14.8561335Z"
611+ }
612+ ```
613+
614+ ### Example 7: Add Active Subscription Resource Role to access package
615+
616+ #### Request
617+
618+ The following example shows a request to Add Active Subscription Resource Role to an access package scoped to a Resource Role to an access package.
619+
620+ Before this request, you must have already added the access package resource ` b09a0288-a83e-4ae6-8a53-bc09aeb966ea ` for the Subscription ` 828b526f-c769-4b19-9797-734b4843b978 ` to the access package catalog containing this access package. The resource could have been added to the catalog by [ creating an access package resource request] ( /graph/api/entitlementmanagement-post-accesspackageresourcerequests?view=graph-rest-beta ) .
621+
622+ # [ HTTP] ( #tab/http )
623+ <!-- {
624+ "blockType": "request",
625+ "name": "create_accesspackageresourcerolescope_from_accesspackage_subscription_management_active"
626+ }-->
627+
628+ ``` http
629+ POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/5f7f4c7d-b3f5-4988-a17b-3f09b6f5a9ee/accessPackageResourceRoleScopes
630+ Content-type: application/json
631+
632+ {
633+ "accessPackageResourceRole": {
634+ "originId": "/subscriptions/828b526f-c769-4b19-9797-734b4843b978/providers/Microsoft.Authorization/roleDefinitions/76cc9ee4-d5d3-4a45-a930-26add3d73475",
635+ "displayName": "Access Review Operator Service Role",
636+ "description": "Lets you grant Access Review System app permissions to discover and revoke access as needed by the access review process.",
637+ "accessPackageResource": {
638+ "id": "b09a0288-a83e-4ae6-8a53-bc09aeb966ea",
639+ "description": "Dev",
640+ "displayName": "Dev",
641+ "resourceType": "Subscription",
642+ "originId": "/subscriptions/828b526f-c769-4b19-9797-734b4843b978",
643+ "originSystem": "AzureResources"
644+ },
645+ "originSystem": "AzureResources",
646+ "type": "active"
647+ },
648+ "accessPackageResourceScope": {
649+ "id": "c66c1e22-1093-46fb-a8a8-c0e334113ca4",
650+ "description": "Root",
651+ "displayName": "Root",
652+ "isRootScope": true,
653+ "originSystem": "AzureResources",
654+ "originId": "/subscriptions/828b526f-c769-4b19-9797-734b4843b978"
655+ }
656+ }
657+ ```
658+
659+ # [ C#] ( #tab/csharp )
660+ [ !INCLUDE [ sample-code] ( ../includes/snippets/csharp/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-active-csharp-snippets.md )]
661+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
662+
663+ # [ Go] ( #tab/go )
664+ [ !INCLUDE [ sample-code] ( ../includes/snippets/go/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-active-go-snippets.md )]
665+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
666+
667+ # [ Java] ( #tab/java )
668+ [ !INCLUDE [ sample-code] ( ../includes/snippets/java/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-active-java-snippets.md )]
669+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
670+
671+ # [ JavaScript] ( #tab/javascript )
672+ [ !INCLUDE [ sample-code] ( ../includes/snippets/javascript/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-active-javascript-snippets.md )]
673+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
674+
675+ # [ PHP] ( #tab/php )
676+ [ !INCLUDE [ sample-code] ( ../includes/snippets/php/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-active-php-snippets.md )]
677+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
678+
679+ # [ PowerShell] ( #tab/powershell )
680+ [ !INCLUDE [ sample-code] ( ../includes/snippets/powershell/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-active-powershell-snippets.md )]
681+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
682+
683+ # [ Python] ( #tab/python )
684+ [ !INCLUDE [ sample-code] ( ../includes/snippets/python/create-accesspackageresourcerolescope-from-accesspackage-subscription-management-active-python-snippets.md )]
685+ [ !INCLUDE [ sdk-documentation] ( ../includes/snippets/snippets-sdk-documentation-link.md )]
686+
687+ ---
688+
689+ #### Response
690+
691+ The following example shows the response.
692+
693+ > ** Note:** The response object shown here might be shortened for readability.
694+
695+ <!-- {
696+ "blockType": "response",
697+ "truncated": true,
698+ "@odata.type": "microsoft.graph.accessPackageResourceRoleScope"
699+ } -->
700+
701+ ``` http
702+ HTTP/1.1 201 Created
703+ Content-type: application/json
704+
705+ {
706+ "id": "34b2d7de-e8d6-4ba8-843e-a03546feac63_c66c1e22-1093-46fb-a8a8-c0e334113ca4",
707+ "createdBy": "admin@example.com",
708+ "createdDateTime": "2026-02-09T22:29:40.3420825Z",
709+ "modifiedBy": "admin@example.com",
710+ "modifiedDateTime": "2026-02-09T22:29:40.3420825Z"
711+ }
712+ ```
0 commit comments