New-AzureADMSPermissionGrantConditionSet
Create a new Azure Active Directory permission grant condition set in a given policy.
Syntax
New-AzureADMSPermissionGrantConditionSet
-PolicyId <String>
-ConditionSetType <String>
[-PermissionType <String>]
[-PermissionClassification <String>]
[-ResourceApplication <String>]
[-Permissions <System.Collections.Generic.List`1[System.String]>]
[-ClientApplicationIds <System.Collections.Generic.List`1[System.String]>]
[-ClientApplicationTenantIds <System.Collections.Generic.List`1[System.String]>]
[-ClientApplicationPublisherIds <System.Collections.Generic.List`1[System.String]>]
[-ClientApplicationsFromVerifiedPublisherOnly <Boolean>]
[<CommonParameters>]
Description
Create a new Azure Active Directory permission grant condition set object in an existing policy.
Examples
Example 1: Create a basic permission grant condition set in an existing policy with all build in values
New-AzureADMSPermissionGrantConditionSet -PolicyId "test1" -ConditionSetType "includes" -PermissionType "delegated"
Id : cab65448-9ec4-43a5-b575-d1f4d32fefa5
PermissionType : delegated
PermissionClassification : all
ResourceApplication : any
Permissions : {all}
ClientApplicationIds : {all}
ClientApplicationTenantIds : {all}
ClientApplicationPublisherIds : {all}
ClientApplicationsFromVerifiedPublisherOnly : False
Example 2: Create a permission grant condition set in an existing policy that includes specific permissions for a resource application
New-AzureADMSPermissionGrantConditionSet -PolicyId "test1" -ConditionSetType "includes" -PermissionType "delegated" -Permissions @("8b590330-0eb2-45d0-baca-a00ecf7e7b87", "dac1c8fa-e6e4-47b8-a128-599660b8cd5c", "f6db0cc3-88cd-4c74-a374-3d8c7cc4c50b") -ResourceApplication "ec8d61c9-1cb2-4edb-afb0-bcda85645555"
Id : 64032dc4-8423-4fd7-930c-a9ed3bb1dbb4
PermissionType : delegated
PermissionClassification : all
ResourceApplication : ec8d61c9-1cb2-4edb-afb0-bcda85645555
Permissions : {8b590330-0eb2-45d0-baca-a00ecf7e7b87, dac1c8fa-e6e4-47b8-a128-599660b8cd5c,
f6db0cc3-88cd-4c74-a374-3d8c7cc4c50b}
ClientApplicationIds : {all}
ClientApplicationTenantIds : {all}
ClientApplicationPublisherIds : {all}
ClientApplicationsFromVerifiedPublisherOnly : False
Example 3: Create a permission grant condition set in an existing policy that is excluded
New-AzureADMSPermissionGrantConditionSet -PolicyId "test1" -ConditionSetType "excludes" -PermissionType "delegated" -Permissions @("8b590330-0eb2-45d0-baca-a00ecf7e7b87", "dac1c8fa-e6e4-47b8-a128-599660b8cd5c", "f6db0cc3-88cd-4c74-a374-3d8c7cc4c50b") -ResourceApplication "ec8d61c9-1cb2-4edb-afb0-bcda85645555" -PermissionClassification "low" -ClientApplicationsFromVerifiedPublisherOnly $true -ClientApplicationIds @("4a6c40ea-edc1-4202-8620-dd4060ee6583", "17a961bd-e743-4e6f-8097-d7e6612999a7") -ClientApplicationTenantIds @("17a961bd-e743-4e6f-8097-d7e6612999a8", "17a961bd-e743-4e6f-8097-d7e6612999a9", "17a961bd-e743-4e6f-8097-d7e6612999a0") -ClientApplicationPublisherIds @("verifiedpublishermpnid")
Id : 0f81cce0-a766-4db6-a7e2-4e5f10f6abf8
PermissionType : delegated
PermissionClassification : low
ResourceApplication : ec8d61c9-1cb2-4edb-afb0-bcda85645555
Permissions : {8b590330-0eb2-45d0-baca-a00ecf7e7b87, dac1c8fa-e6e4-47b8-a128-599660b8cd5c,
f6db0cc3-88cd-4c74-a374-3d8c7cc4c50b}
ClientApplicationIds : {4a6c40ea-edc1-4202-8620-dd4060ee6583, 17a961bd-e743-4e6f-8097-d7e6612999a7}
ClientApplicationTenantIds : {17a961bd-e743-4e6f-8097-d7e6612999a8, 17a961bd-e743-4e6f-8097-d7e6612999a9, 17a961bd-e743-4e6f-8097-d7e6612999a0}
ClientApplicationPublisherIds : {verifiedpublishermpnid}
ClientApplicationsFromVerifiedPublisherOnly : True
Parameters
-ClientApplicationIds
The set of client application ids to scope consent operation down to. It could be @("All") or a list of client application Ids.
Note
There is a hard limit of 100 Application IDs that can be added per tenant.
Type: | List<T>[String] |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-ClientApplicationPublisherIds
The set of client applications publisher ids to scope consent operation down to. It could be @("All") or a list of client application publisher ids.
Type: | List<T>[String] |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-ClientApplicationsFromVerifiedPublisherOnly
A value indicates whether to only includes client applications from verified publishers.
Type: | Boolean |
Position: | Named |
Default value: | False |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-ClientApplicationTenantIds
The set of client application tenant ids to scope consent operation down to. It could be @("All") or a list of client application tenant ids.
Type: | List<T>[String] |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-ConditionSetType
The value indicates whether the condition sets are included in the policy or excluded.
Type: | String |
Position: | Named |
Default value: | None |
Required: | True |
Accept pipeline input: | True |
Accept wildcard characters: | False |
-PermissionClassification
Specific classification (all, low, medium, high) to scope consent operation down to.
Type: | String |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-Permissions
The identifier of the resource application to scope consent operation down to. It could be @("All") or a list of permission ids.
Type: | List<T>[String] |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-PermissionType
Specific type of permissions (application, delegated) to scope consent operation down to.
Type: | String |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-PolicyId
The unique identifier of an Azure Active Directory permission grant policy object.
Type: | String |
Position: | Named |
Default value: | None |
Required: | True |
Accept pipeline input: | True |
Accept wildcard characters: | False |
-ResourceApplication
The identifier of the resource application to scope consent operation down to. It could be "Any" or a specific resource application id.
Type: | String |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
Inputs
string
string
Outputs
Microsoft.Open.MSGraph.Model.PermissionGrantConditionSet
Related Links
Σχόλια
https://aka.ms/ContentUserFeedback.
Σύντομα διαθέσιμα: Καθ' όλη τη διάρκεια του 2024 θα καταργήσουμε σταδιακά τα ζητήματα GitHub ως μηχανισμό ανάδρασης για το περιεχόμενο και θα το αντικαταστήσουμε με ένα νέο σύστημα ανάδρασης. Για περισσότερες πληροφορίες, ανατρέξτε στο θέμα:Υποβολή και προβολή σχολίων για