XAccessPackageCatalog¶
Experimental
This API is experimental and may change without notice.
An Entra entitlement management catalog. Optional XSecurityGroup object IDs can be granted the built-in Catalog Reader role; no write-enabled catalog roles are assigned. Register groupIds once here; the catalog owns their associations and publishes status.groupAssociations. Multiple packages reference this catalog by catalogRef.name and select groups without owning or deleting these shared associations.
API¶
| Property | Value |
|---|---|
| Group | entraid.platform.example.org |
| Kind | XAccessPackageCatalog |
| Plural | xaccesspackagecatalogs |
| Scope | Namespaced |
| Versions | v1alpha1 (referenceable) |
| Source | compositions/apis/entraid/accesspackagecatalog/schema.yaml |
Spec¶
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
description |
string |
yes | — | Description of the access package catalog. Constraints: minLength: 1. |
externallyVisible |
boolean |
no | false |
Whether guests can request packages in this catalog. |
groupIds |
[]string |
no | [] |
Object IDs from XSecurityGroup.status.objectId to register once as shared catalog resources. Packages may select any subset. |
groupRefs |
[]object |
no | [] |
Same-namespace XSecurityGroup names to register once as shared catalog resources. Object IDs are resolved from group status. |
groupRefs[].name |
string |
yes | — | Constraints: minLength: 1. |
name |
string |
yes | — | Display name of the access package catalog. Constraints: minLength: 1. |
readerGroupIds |
[]string |
no | [] |
Object IDs from XSecurityGroup.status.objectId to grant the Catalog Reader role. |
Status¶
Populated by Crossplane once the underlying Azure resources exist. Every
composite in this repository exposes the provisioned Azure resource ID as
status.id.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
groupAssociations |
[]object |
no | — | Catalog-owned group associations referenced by packages. |
groupAssociations[].groupId |
string |
no | — | Entra group object ID. |
groupAssociations[].id |
string |
no | — | Provider ID of the catalog resource association. |
groupAssociations[].ready |
boolean |
no | — | Whether the association is Ready. |
id |
string |
no | — | Provider ID of the Entra access package catalog. |
Common problems¶
The Catalog or CatalogRoleAssignment is never created.
Cause. The corresponding provider-azuread managed resource definition is not activated.
Fix. Add accesspackagecatalogs.identitygovernance.azuread.m.upbound.io, accesspackagecatalogroleassignments.identitygovernance.azuread.m.upbound.io and accesspackageresourcecatalogassociations.identitygovernance.azuread.m.upbound.io to the managed resource activation policy.
The catalog or reader role assignment reports Authorization_RequestDenied.
Cause. The service principal lacks the Microsoft Graph application permission EntitlementManagement.ReadWrite.All, or admin consent is missing.
Fix. Re-run the bootstrap script as a Global Administrator or Privileged Role Administrator, or grant EntitlementManagement.ReadWrite.All manually.
A reader role assignment is rejected.
Cause. A readerGroupIds value is not an Entra security group's object ID.
Fix. Use the value from the group's XSecurityGroup status.objectId.
Removing a catalog group breaks packages that still use it.
Cause. Catalog associations are shared and their lifecycle belongs to the catalog, not any individual package.
Fix. Remove the group from all package groupIds before removing it from the catalog groupIds. Keep the catalog while any packages reference it.