Microsoft Entra ID Governance
GovernanceInclude custom data provided resource in the catalog for catalog user Access Reviews
In brief
The guide removes the Preview label and adds steps for creating the resource and Logic App, automatic upload notifications, manual result application, and new resource parameters.
What Entra admins need to know
Administrators can follow the updated setup and automation guidance; remediation applies only to custom-resource decisions without an Approve outcome.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Include custom data provided resource in the catalog for catalog user Access Reviews (Preview)
Organizations often have applications that aren’t yet integrated with Microsoft Entra but still need to be governed. Using custom data provided resources, you can include these disconnected applications in Microsoft Entra ID access reviews by uploading their access data directly into a catalog.
If you do not yet have a catalog, then create a new catalog. If you have a catalog already, then continue at the next section.
- Sign in to the Microsoft Entra admin center as at least an Identity Governance Administrator or catalog creator.
Browse to ID Governance > Catalogs.
Select New catalog.
Enter a unique name for the catalog and provide a description. Users see this information in an access package's details.
Select Create to create the catalog.
For more information on creating a catalog and adding resources, see Create and manage a catalog of resources.
Select Add resources.
Select the resource type: custom data provided resource.
:::image type="content" source="media/custom-data-resource-access-reviews/
custom-data-provided-information.catalog-resources.png" alt-text="Screenshot of addingcustom access resource data extension information.resources to a catalog.":::On the
resource page,Basics tab, enter:Resource nameName – A name for the resource.- Description – A description for the resource.
:::image type="content" source="media/custom-data-resource-access-reviews/custom-resource-basic-information.png" alt-text="Screenshot of entering basic information for the custom data provided resource.":::
Select Next: Details.
On the Details tab, enter:
- Subscription - Select the subscription.
- Resource group - Select the resource group.
- Logic app name - A name for the logic app.
:::image type="content" source="media/custom-data-resource-access-reviews/custom-resource-details-information.png" alt-text="Screenshot of entering the details for the logic app as part of the custom data provided resource.":::
Select Create a logic app to deploy the new logic app.
Select Save.
Select Add.
Create a User Access Review
Sign in to the Microsoft Entra admin center
Sign in to the Microsoft Entra admin center as at least an Identity Governance Administrator.
Browse to ID Governance > Access Reviews > new access review.
Select Create.
You can also create an access review programmatically using Microsoft Graph. For more information, see Create a single stage access review on a catalog.
Get Access Review ObjectLogic app integration
:::image type="content" source="media/custom-data-resource-access-reviews/logic-app-trigger.png" alt-text="Screenshot of the logic app trigger history.":::
The Logic App will receive a notification when the access review is initiated and Instance IDcan be configured to automatically upload custom data for the review. The Logic App will also receive a notification when the review completes and can be configured to set the apply result on the not reviewed or deny decisions. For more information, see Configuring logic app for uploading and remediating decisions.
Manually upload custom data
After creating the catalog access review, but before uploading your custom data, you must get both the Access Review object ID, and the Access Review instance object ID. To get this information, you'd do the following:
Select the catalog access review you created.
On the Access Review overview screen, copy the Object ID.
:::image type="content" source="media/custom-data-resource-access-reviews/access-review-object-id.png" alt-text="Screenshot of finding the access review object ID.":::
Select the current instance of the access review on the access review overview screen.
On the access review instance screen, save the instance Object ID.
:::image type="content" source="media/custom-data-resource-access-reviews/access-review-instance-object-id.png" alt-text="Screenshot of finding the access review instance object ID.":::
Upload custom data
After copying both the access review object and access review instance object IDs, note that the status of the access review shows as Initializing.
:::image type="content" source="media/custom-data-resource-access-reviews/initializing-access-review-status.png" alt-text="Initializing access review status.":::
Return to the catalog you created, and select Resources.
On the resource screen for the catalog, select the custom data access resource you created, and select Upload custom access data.
:::image type="content" source="media/custom-data-resource-access-reviews/upload-custom-access-data.png" alt-text="Screenshot of the upload custom access data option.":::
On the Upload access data for custom resource screen under Basics, enter both the access review object ID, and the Access review instance object
ID found in the section Get Access Review Object and Instance ID.ID.:::image type="content" source="media/custom-data-resource-access-reviews/upload-access-data-basics.png" alt-text="Screenshot of basic information for custom data access.":::
Under Upload files select up to 10 CSVs to include in the access data and select Save.
:::image type="content" source="media/custom-data-resource-access-reviews/upload-access-data-files.png" alt-text="Screenshot of uploading files to custom access data.":::
- You have up to two hours from the time the review enters the Initializing state to complete the upload.
Custom data for access CSV fieldsManually apply results
When uploading CSVsa review is complete, remediation can be set for any decision items for the custom data provided resource that do not have an Approve outcome.
Browse to
be included inID Governance > Access Reviews.Select the catalog access review you created.
Select the current instance of the access
data,review on thefollowing parameters are included inaccess review overview screen.On results page, you can select one or more decisions to remediate.
:::image type="content" source="media/custom-data-resource-access-reviews/apply-results.png" alt-text="Screenshot of selecting decisions to remediate.":::
Select the
template:Apply results to set the apply result to Applied successfully.
Custom data for access CSV fields
When uploading CSVs to be included in the access data, the following parameters are included in the template:
| Parameter | Description |
|---|---|
| PrincipalId | The Microsoft Entra ID User ID of the user whose access needs to be reviewed. This value must match a valid Microsoft Entra user. |
| PrincipalType | Specifies the type of principal. For access reviews this will always be EntraIdUser. |
| PermissionName | The display name of the permission that the user has in the application. Example: Read, Write, and Admin. |
| PermissionDescription | A brief explanation of what this permission allows within the application. This provides reviewers with context when deciding whether access should be continued. |
| PermissionType | Indicates the category of permission. |
| ScopeId | A unique identifier for the application. |
| ScopeDisplayName | The display name of the application. |
| EntitlementOwners_Users | A comma separated list of the Microsoft Entra ID User ID owners of the permission. |
| EntitlementOwners_Groups | A comma separated list of the Microsoft Entra ID Group ID group owners of the permission. |
| CustomData | Any additional information that could provide more context to a reviewer when making a decision. |
You can also upload custom data via Graph by creating an upload session and then uploading a CSV file. For more information, see customDataProvidedResourceUploadSession.
- Reviewers receive an email notification.
- They can sign in to the My Access portal to view and complete their review decisions.
Applying stage
In the Applying stage, you can get a list of denied users by making the list decisions API call:
The review transition to the **Applied** state once all the custom data provided decisions have been applied. For example, if you have five decisions that must be made from the data, you must apply using PATCH each of five decision items before the review transitions to **Applied**.
## Review status
As reviewers take actions, the review progresses through several states:
| Applying | Review decisions are being remediated. |
| Applied | All decisions are marked as applied. |
## Timeframes summary
| Action | When | Time limit |
| Review decisions | During *Active* | Until the review end date. |
| Apply decisions | During *Applying* | 30 days and review remains in applying status until all decisions are marked as applied.|
## Related content
- [Catalog Access Reviews (Preview)]Reviews](catalog-access-reviews.md)
- [Create and manage a catalog of resources in entitlement management](entitlement-management-catalog-create.md)
@@ -1,5 +1,5 @@ ----title: Include custom data provided resource in the catalog for catalog user Access Reviews (Preview)+title: Include custom data provided resource in the catalog for catalog user Access Reviews ms.reviewer: jgangadhar description: Learn how to include custom data provided resource in Microsoft Entra catalogs to create user Access Reviews for disconnected applications. ms.subservice: access-reviews@@ -9,7 +9,7 @@ ms.date: 03/12/2026 #Customer Intent: As an Identity Governance Administrator, I want to create a catalog in Microsoft Entra so that I can manage custom data provided resource for User Access Reviews. --- -# Include custom data provided resource in the catalog for catalog user Access Reviews (Preview)+# Include custom data provided resource in the catalog for catalog user Access Reviews Organizations often have applications that aren’t yet integrated with Microsoft Entra but still need to be governed. Using custom data provided resources, you can include these disconnected applications in Microsoft Entra ID access reviews by uploading their access data directly into a catalog. @@ -25,15 +25,16 @@ This feature requires Microsoft Entra ID Governance or Microsoft Entra Suite su If you do not yet have a catalog, then create a new catalog. If you have a catalog already, then continue at the [next section](#add-a-custom-data-provided-resource-to-a-catalog). 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Identity Governance Administrator](../identity/role-based-access-control/permissions-reference.md#identity-governance-administrator) or catalog creator.+ > [!TIP] > Users who were assigned to the User Administrator role will no longer be able to create catalogs or manage access packages in a catalog they don't own. If users in your organization were assigned to the User Administrator role to configure catalogs, access packages, or policies in entitlement management, you should instead assign these users the Identity Governance Administrator role.+ 1. Browse to **ID Governance** > **Catalogs**. 1. Select **New catalog**. -1. Enter a unique name for the catalog and provide a description.-- Users see this information in an access package's details.+1. Enter a unique name for the catalog and provide a description. Users see this information in an access package's details.+ 1. Select **Create** to create the catalog. For more information on creating a catalog and adding resources, see [Create and manage a catalog of resources](entitlement-management-catalog-create.md).@@ -53,18 +54,30 @@ With a catalog created, you can add custom data provided resources to it by doin 1. Select **Add resources**. 1. Select the resource type: **custom data provided resource**.- :::image type="content" source="media/custom-data-resource-access-reviews/custom-data-provided-information.png" alt-text="Screenshot of adding custom access resource data extension information.":::-1. On the resource page, enter:- - **Resource name** – A name for the resource. - - **Description** – A description for the resource. + + :::image type="content" source="media/custom-data-resource-access-reviews/catalog-resources.png" alt-text="Screenshot of adding resources to a catalog.":::+ +1. On the **Basics** tab, enter:+ - **Name** – A name for the resource. + - **Description** – A description for the resource.+ + :::image type="content" source="media/custom-data-resource-access-reviews/custom-resource-basic-information.png" alt-text="Screenshot of entering basic information for the custom data provided resource.":::+ +1. Select **Next: Details**.++1. On the **Details** tab, enter:+ - **Subscription** - Select the subscription.+ - **Resource group** - Select the resource group.+ - **Logic app name** - A name for the logic app.+ + :::image type="content" source="media/custom-data-resource-access-reviews/custom-resource-details-information.png" alt-text="Screenshot of entering the details for the logic app as part of the custom data provided resource.":::++1. Select **Create a logic app** to deploy the new logic app. 1. Select **Save**.+1. Select **Add**. ## Create a User Access Review -> [!IMPORTANT]-> Custom data resource reviews currently support **single-stage reviews** where **managers** are the only available reviewers.-- 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Identity Governance Administrator](../identity/role-based-access-control/permissions-reference.md#identity-governance-administrator). 1. Browse to **ID Governance** > **Access Reviews** > **new access review**.@@ -79,10 +92,15 @@ With a catalog created, you can add custom data provided resources to it by doin 1. Select **Create**. - You can also create an access review programmatically using Microsoft Graph. For more information, see [Create a single stage access review on a catalog](/graph/api/accessreviewset-post-definitions?view=graph-rest-beta&tabs=http&preserve-view=true#example-6-create-a-single-stage-access-review-on-a-catalog). -## Get Access Review Object and Instance ID+## Logic app integration++:::image type="content" source="media/custom-data-resource-access-reviews/logic-app-trigger.png" alt-text="Screenshot of the logic app trigger history.":::++The Logic App will receive a notification when the access review is initiated and can be configured to automatically upload custom data for the review. The Logic App will also receive a notification when the review completes and can be configured to set the apply result on the not reviewed or deny decisions. For more information, see [Configuring logic app for uploading and remediating decisions](https://github.com/Azure/azure-quickstart-templates/blob/master/application-workloads/identity-governance/byod-logic-app/README.md).++## Manually upload custom data After creating the catalog access review, but before uploading your custom data, you must get both the Access Review object ID, and the Access Review instance object ID. To get this information, you'd do the following: @@ -91,33 +109,60 @@ After creating the catalog access review, but before uploading your custom data, 1. Select the catalog access review you created. 1. On the Access Review overview screen, copy the **Object ID**.+ :::image type="content" source="media/custom-data-resource-access-reviews/access-review-object-id.png" alt-text="Screenshot of finding the access review object ID.":::+ 1. Select the current instance of the access review on the access review overview screen. 1. On the access review instance screen, save the instance **Object ID**.+ :::image type="content" source="media/custom-data-resource-access-reviews/access-review-instance-object-id.png" alt-text="Screenshot of finding the access review instance object ID."::: + After copying both the access review object and access review instance object IDs, note that the status of the access review shows as **Initializing**. --## Upload custom data--After copying both the access review object and access review instance object IDs, note that the status of the access review shows as **Initializing**. :::image type="content" source="media/custom-data-resource-access-reviews/initializing-access-review-status.png" alt-text="Initializing access review status."::: - 1. Return to the catalog you created, and select **Resources**. 1. On the resource screen for the catalog, select the custom data access resource you created, and select **Upload custom access data**.+ :::image type="content" source="media/custom-data-resource-access-reviews/upload-custom-access-data.png" alt-text="Screenshot of the upload custom access data option."::: -1. On the Upload access data for custom resource screen under **Basics**, enter both the access review object ID, and the Access review instance object ID found in the section [Get Access Review Object and Instance ID](custom-data-resource-access-reviews.md#get-access-review-object-and-instance-id).+1. On the Upload access data for custom resource screen under **Basics**, enter both the access review object ID, and the Access review instance object ID.+ :::image type="content" source="media/custom-data-resource-access-reviews/upload-access-data-basics.png" alt-text="Screenshot of basic information for custom data access.":::-1. Under **Upload files** select up to 10 CSVs to include in the access data and select **Save**. + +1. Under **Upload files** select up to 10 CSVs to include in the access data and select **Save**.+ :::image type="content" source="media/custom-data-resource-access-reviews/upload-access-data-files.png" alt-text="Screenshot of uploading files to custom access data.":::+ > [!NOTE] > To confirm all CSVs were uploaded successfully, view the [audit logs](entitlement-management-logs-and-reporting.md).+ 1. You have **up to two hours** from the time the review enters the *Initializing* state to complete the upload. +> [!NOTE]+> Another option to automatically upload files when a review starts is through the use of a logic app: [logic app template](https://github.com/Azure/azure-quickstart-templates/blob/master/application-workloads/identity-governance/byod-logic-app/README.md).++## Manually apply results++When a review is complete, remediation can be set for any decision items for the custom data provided resource that do not have an **Approve** outcome.++1. Browse to **ID Governance** > **Access Reviews**.++1. Select the catalog access review you created.++1. Select the current instance of the access review on the access review overview screen.++1. On results page, you can select one or more decisions to remediate.++ :::image type="content" source="media/custom-data-resource-access-reviews/apply-results.png" alt-text="Screenshot of selecting decisions to remediate.":::++1. Select the **Apply results** to set the apply result to **Applied successfully**.++> [!NOTE]+> Remediation can only be done for decisions that are for a custom data provided resource and where the outcome is not **Approve**.+ ## Custom data for access CSV fields When uploading CSVs to be included in the access data, the following parameters are included in the template:@@ -125,7 +170,7 @@ When uploading CSVs to be included in the access data, the following parameters > [!NOTE] > All columns are mandatory. -|Parameter |Description |+|Parameter | Description | |---------|---------| |PrincipalId | The **Microsoft Entra ID User ID** of the user whose access needs to be reviewed. This value must match a valid Microsoft Entra user. | |PrincipalType | Specifies the type of principal. For access reviews this will always be **EntraIdUser**. |@@ -133,7 +178,14 @@ When uploading CSVs to be included in the access data, the following parameters |PermissionName | The display name of the permission that the user has in the application. Example: Read, Write, and Admin. | |PermissionDescription | A brief explanation of what this permission allows within the application. This provides reviewers with context when deciding whether access should be continued. | |PermissionType | Indicates the category of permission. |+|ScopeId | A unique identifier for the application. |+|ScopeDisplayName | The display name of the application. |+|EntitlementOwners_Users | A comma separated list of the **Microsoft Entra ID User ID** owners of the permission. |+|EntitlementOwners_Groups | A comma separated list of the **Microsoft Entra ID Group ID** group owners of the permission. |+|CustomData | Any additional information that could provide more context to a reviewer when making a decision. | +> [!NOTE]+> For resource owner reviews, the resource owners are determined from the **EntitlementOwners_Users** and/or **EntitlementOwners_Groups** columns and must be specified. You can also upload custom data via Graph by creating an upload session and then uploading a CSV file. For more information, see [customDataProvidedResourceUploadSession](/graph/api/resources/customdataprovidedresourceuploadsession?view=graph-rest-beta&preserve-view=true). @@ -143,10 +195,8 @@ At the **Active** stage: - Reviewers receive an email notification. - They can sign in to the [My Access portal](https://myaccess.microsoft.com) to view and complete their review decisions. - ## Applying stage - In the **Applying** stage, you can get a list of denied users by making the [list decisions](/graph/api/accessreviewinstance-list-decisions?view=graph-rest-beta&tabs=http&preserve-view=true) API call: ``` http@@ -169,9 +219,6 @@ Content-Type: application/json The review transition to the **Applied** state once all the custom data provided decisions have been applied. For example, if you have five decisions that must be made from the data, you must apply using PATCH each of five decision items before the review transitions to **Applied**. --- ## Review status As reviewers take actions, the review progresses through several states:@@ -183,8 +230,6 @@ As reviewers take actions, the review progresses through several states: | Applying | Review decisions are being remediated. | | Applied | All decisions are marked as applied. | -- ## Timeframes summary | Action | When | Time limit |@@ -193,12 +238,10 @@ As reviewers take actions, the review progresses through several states: | Review decisions | During *Active* | Until the review end date. | | Apply decisions | During *Applying* | 30 days and review remains in applying status until all decisions are marked as applied.| -- ## Related content -- [Catalog Access Reviews (Preview)](catalog-access-reviews.md)+- [Catalog Access Reviews](catalog-access-reviews.md) - [Create and manage a catalog of resources in entitlement management](entitlement-management-catalog-create.md)