I'm trying to access the below endpoint of Graph API using $expand and getting error Parsing OData Select and Expand failed: The result of parsing $expand was at least 3 items deep, but the maximum allowed is 2.

Endpoint :

?$expand=accessPackageCatalog, accessPackageResourceRoleScopes($expand=accessPackageResourceRole($expand=accessPackageResource),accessPackageResourceScope),accessPackageAssignmentPolicies

I need accessPackageResource to get the applications or groups linked to the accessPackage. Help me on how I can access that.

I'm trying to access the below endpoint of Graph API using $expand and getting error Parsing OData Select and Expand failed: The result of parsing $expand was at least 3 items deep, but the maximum allowed is 2.

Endpoint :

https://graph.microsoft/beta/identityGovernance/entitlementManagement/accessPackages/f2b3c168-e756-40c1-8532-ad08f9fe0a77?$expand=accessPackageCatalog, accessPackageResourceRoleScopes($expand=accessPackageResourceRole($expand=accessPackageResource),accessPackageResourceScope),accessPackageAssignmentPolicies

I need accessPackageResource to get the applications or groups linked to the accessPackage. Help me on how I can access that.

• azure-active-directory
• microsoft-graph-api
• microsoft-entra-id

• To retrieve applications or groups linked to an Access Package, you need to fetch accessPackageResource. Since $expand depth is limited to 2 levels, you'll need to make multiple API calls. – Pratik Jadhav Commented Mar 27 at 6:28
• @PratikJadhav For an accessPackageResource of any accessPackageResourceRole we should call an API of accessPackageResourceRole/{accessPackageResourceRoleId} which is not supported in Graph APIs, it supports only GET ALL of accessPackageResourceRole. How we can achieve it then? – Debbie Johnson Commented Mar 27 at 6:34

1 Answer 1

To work around this, you will have to make multiple API calls to retrieve the neccesary data. You can try the following steps:
1.Retrieve Access Package Details
GEThttps://graph.microsoft/beta/identityGovernance/entitlementManagement/accessPackages/f2b3c168=e756=40c1=8532=ad08f9fe0a77$expand=accessPackageResourceRoleScopes,PackageAssignmentPolicies
2.Retrieve Resource Role Scopes- for each accessPackageResourceRoleScope retrieved in the first call, make the following call:
GEThttps://graph.microsoft/beta/identityGovernance/entitlementManagement/accessPackageResourceRoleScopes/{resourceRoleScopeId}?$expand=accessResourceRole,accessPackageResourceScope
3.Retrieve Resource Roles-For each accessPackageResourceRole retrieved in the second call, make the following call:
GEThttps://graph.microsoft/beta/identityGovernance/entitlementManagement/accessPackageResourceRoles/{resourceRoleId}?$expand=accessPackageResource