Microsoft Graph Beta: customDataProvidedResourceUploadSession – referenceId & files

Microsoft Entra ID lets you run Access Reviews — periodic checks to validate who should still have access to a resource. Normally a reviewer clicks Approve or Deny manually. But there's a powerful twist: you can feed external data (HR systems, ITSM tools, third-party Identity Governance) into the review engine so decisions happen automatically. The plumbing that makes this work is customDataProvidedResourceUploadSession.

This article explains the full pipeline — what the API does, what changed in April 2026, how the session lifecycle works, and how everything fits together — with diagrams for every step.

Big Picture — How the Pipeline Works

Before diving into API details, here's the full architecture from data source to final review decision:

What Is an Access Review? (Quick primer)

An Access Review in Entra ID is a scheduled process that asks: "Should this person still have this access?" Without custom data, a human reviewer clicks Approve or Deny for each user. With customDataProvidedResourceUploadSession, your system answers that question automatically by uploading a file that contains pre-computed decisions or signals.

Upload Session Lifecycle

Every upload session goes through a strict state machine. Understanding it prevents the most common failure — data that silently never gets processed.

Step-by-Step: How to Use the API

1. Create the upload session
   POST to your custom data provider's uploadSessions endpoint. Get back a session id.

   POST /beta/identityGovernance/accessReviews
        /customDataProviders/{providerId}/uploadSessions
   
   {
     "source": "MyHRSystem",       // must match provider name
     "referenceId": "{reviewInstanceId}"  // NEW April 2026
   }

2. Upload your data file(s)
   POST the file payload to the session. Repeat for multiple files. Each call appends data.

   POST /beta/.../uploadSessions/{sessionId}/upload
   
   // Body: your CSV / JSON with user decisions or signals
   // e.g. userId + recommended action (approve/deny)

3. Signal that upload is complete
   PATCH the session — this is the trigger that moves the session to complete and starts Entra processing.

   PATCH /beta/.../uploadSessions/{sessionId}
   
   {
     "isUploadDone": true   // ← CRITICAL. Never skip this.
   }

4. (Optional) Inspect uploaded files
   Use the new files relationship to debug what was actually received.

   GET /beta/.../uploadSessions/{sessionId}?$expand=files
   
   // Filter & sort within expand:
   ?$expand=files($filter=status eq 'processed';$orderby=createdDateTime desc)

What Changed in April 2026 NEW

Resource Properties Reference

Permissions & Licensing

Why Build This?

Here are the real-world scenarios this unlocks:

Building in Production — Beta Caveats

Quick Reference