XAccessPackage¶
Experimental
This API is experimental and may change without notice.
An Entra access package that references a same-namespace catalog by catalogRef.name and includes a subset of its registered groupIds without owning catalog associations. It creates a request policy with primary and secondary escalation approvers referenced by same-namespace XSecurityGroup names, and reviews assignments quarterly. The secondary group is notified after seven days; requests are denied after fourteen days without approval. The default 14-day review window removes access if reviewers do not respond.
API¶
| Property | Value |
|---|---|
| Group | entraid.platform.example.org |
| Kind | XAccessPackage |
| Plural | xaccesspackages |
| Scope | Namespaced |
| Versions | v1alpha1 (referenceable) |
| Source | compositions/apis/entraid/accesspackage/schema.yaml |
Spec¶
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
approvalTimeoutDays |
integer |
no | 14 |
Days before an unapproved request is denied. Constraints: min: 1. |
catalogRef |
object |
yes | — | — |
catalogRef.name |
string |
yes | — | Logical name of the XAccessPackageCatalog in this namespace. Constraints: minLength: 1. |
description |
string |
yes | — | Description of the access package and assignment policy. Constraints: minLength: 1. |
escalationAfterDays |
integer |
no | 7 |
Days primary approvers have before escalation. Constraints: min: 1. |
groupIds |
[]string |
no | [] |
Object IDs from XSecurityGroup.status.objectId already registered in catalogRef to include as package resources. |
groupRefs |
[]object |
no | [] |
Same-namespace XSecurityGroup names to include as package resources. Register these groups in catalogRef first. |
groupRefs[].name |
string |
yes | — | Constraints: minLength: 1. |
name |
string |
yes | — | Display name of the access package and assignment policy. Constraints: minLength: 1. |
primaryApproverGroupRef |
object |
yes | — | — |
primaryApproverGroupRef.name |
string |
yes | — | Same-namespace XSecurityGroup used for primary approvals. Constraints: minLength: 1. |
requestorScope |
string |
no | AllExistingDirectoryMemberUsers |
Who may request access: AllExistingDirectoryMemberUsers or AllExternalSubjects. Constraints: pattern: ^(AllExistingDirectoryMemberUsers|AllExternalSubjects)$. |
reviewDurationDays |
integer |
no | 14 |
Days reviewers have to complete each access review. Constraints: min: 1. |
reviewFrequency |
string |
no | quarterly |
How often access assignments are reviewed. Defaults to quarterly. Constraints: pattern: ^(weekly|monthly|quarterly|halfyearly|annual)$. |
secondaryApproverGroupRef |
object |
yes | — | — |
secondaryApproverGroupRef.name |
string |
yes | — | Same-namespace XSecurityGroup used for escalation and reviews. Constraints: minLength: 1. |
Status¶
Populated by Crossplane once the underlying Azure resources exist. Every
composite in this repository exposes the provisioned Azure resource ID as
status.id.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
assignmentPolicyId |
string |
no | — | Provider ID of the access package assignment policy. |
id |
string |
no | — | Provider ID of the Entra access package. |
Common problems¶
The AccessPackage, AssignmentPolicy, or association is never created.
Cause. The corresponding provider-azuread managed resource definition is not activated.
Fix. Add accesspackages.identitygovernance.azuread.m.upbound.io, accesspackageassignmentpolicies.identitygovernance.azuread.m.upbound.io, accesspackageresourcecatalogassociations.identitygovernance.azuread.m.upbound.io, and accesspackageresourcepackageassociations.identitygovernance.azuread.m.upbound.io to the managed resource activation policy.
A requested group is missing or the package stays not Ready.
Cause. The referenced catalog has not registered the group, or its catalog association is not Ready or has no provider ID yet.
Fix. Register the group object ID in XAccessPackageCatalog.spec.groupIds once, wait for status.groupAssociations to report its ID and ready: true, then select it in each package's groupIds. Missing requested groups are not silently skipped. See examples/entraid-accesspackages.yaml.
The assignment policy or group associations report Authorization_RequestDenied.
Cause. The service principal lacks the Microsoft Graph application permission EntitlementManagement.ReadWrite.All, or admin consent is missing.
Fix. Re-run the bootstrap script as a Global Administrator or Privileged Role Administrator, or grant EntitlementManagement.ReadWrite.All manually.
Guests cannot request the access package.
Cause. The package uses AllExternalSubjects but its catalog is not externally visible.
Fix. Set externallyVisible: true on the XAccessPackageCatalog.