Feature: Add the option for second-level manager as escalation/alternate approver

[svjauffred]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

The alternative_approver block should be configured to allow setting manager_level along with subject_type if subject_type is "requestorManager", to allow escalating to the manager of the manager.

Using the following endpoint: https://learn.microsoft.com/en-us/graph/api/resources/accesspackageassignmentpolicy?view=graph-rest-1.0
under requestApprovalSettings.stages.escalationApprovers when manager of manager is set as escalation approver, Graph returns:

Name                           Value
----                           -----
@odata.type                    #microsoft.graph.requestorManager
managerLevel                   2

This affects:
azuread_access_package_assignment_policy

Potential Terraform Configuration

resource "azuread_access_package_assignment_policy" "dummy"{
  access_package_id = azuread_access_package.dummy.id
  display_name      = "All Users"
  description       = "All Users"
  duration_in_days  = 365
  extension_enabled = true
  requestor_settings {
    scope_type        = "AllExistingDirectorySubjects"
    requests_accepted = true
  }

  approval_settings {
    approval_required               = true
    approval_required_for_extension = false
        approval_stage {
            approval_timeout_in_days = 14
            primary_approver {
                subject_type = "requestorManager"
            } 
            alternative_approver{
                subject_type = "requestorManager"
                manager_level = 2
            } 
        }
  }
}

[svjauffred]

Under the beta endpoint (which is used for some parts of the provider?), the request is under https://learn.microsoft.com/en-us/graph/api/resources/accesspackageassignmentpolicy?view=graph-rest-beta
And the Graph response:

Name                           Value
----                           -----
id                             ffffffff-bbbb-4444-9999-444444444444
@odata.type                    #microsoft.graph.singleUser
isBackup                       True
description                    Redacted
@odata.type                    #microsoft.graph.requestorManager
managerLevel                   2
isBackup                       False

[kkotov]

A naive question from a layman passing by: why the feature wouldn't already work with minimal changes of #1453?