Update governanceRoleSetting

Article
09/27/2023

Namespace: microsoft.graph

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Caution

This version of the Privileged Identity Management (PIM) API for Azure resources will be deprecated soon. Please use the new Azure REST PIM API for Azure resource roles.

Update the properties of governanceRoleSetting.

This API is supported in the following national cloud deployments.

Global service	US Government L4	US Government L5 (DOD)	China operated by 21Vianet
✅	✅	✅	❌

Permissions

The following table shows the least privileged permission or permissions required to call this API on each supported resource type. Follow best practices to request least privileged permissions. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

Supported resource	Delegated (work or school account)	Delegated (personal Microsoft account)	Application
Azure AD	PrivilegedAccess.ReadWrite.AzureAD	Not supported.	Not supported.
Azure resources	PrivilegedAccess.ReadWrite.AzureResources	Not supported.	Not supported.
group	PrivilegedAccess.ReadWrite.AzureADGroup	Not supported.	Not supported.

The requester must also have at least one active administrator role assignment (owner or user access administrator) on the resource.

HTTP request

PATCH /privilegedAccess/azureResources/roleSettings/{id}

Request headers

Name	Description
Authorization	Bearer {token}
Content-type	application/json

Request body

In the request body, supply the values for governanceRuleSettings that need to be updated.

Property	Type	Description
adminEligibleSettings	governanceRuleSetting collection	The rule settings that are evaluated when an administrator tries to add an eligible role assignment.
adminMemberSettings	governanceRuleSetting collection	The rule settings that are evaluated when an administrator tries to add a direct member role assignment.
userEligibleSettings	governanceRuleSetting collection	The rule settings that are evaluated when a user tries to add an eligible role assignment.
userMemberSettings	governanceRuleSetting collection	The rule settings that are evaluated when a user tries to activate his role assignment.

Response

If successful, this method returns a 204 NoContent response code. It does not return anything in the response body.

Error codes

This API returns the standard HTTP error codes. In addition, it returns the following custom error codes.

Error code	Error message	Details
400 BadRequest	RoleSettingNotFound	The governanceRoleSetting does not exist in system.
400 BadRequest	InvalidRoleSetting	The governanceRuleSettings values provided in the request body are not valid.

Example

This example updates the role setting for Custom Role 3 in the subscription Wingtip Toys - Prod.

Request

PATCH https://graph.microsoft.com/beta/privilegedAccess/azureResources/roleSettings/5fb5aef8-1081-4b8e-bb16-9d5d0385bab5
Content-type: application/json

{
   "adminEligibleSettings":[
      {
         "ruleIdentifier":"ExpirationRule",
         "setting":"{\"permanentAssignment\":false,\"maximumGrantPeriodInMinutes\":129600}"
      }
   ]
}


// Code snippets are only available for the latest version. Current version is 5.x

var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new GovernanceRoleSetting
{
	AdminEligibleSettings = new List<GovernanceRuleSetting>
	{
		new GovernanceRuleSetting
		{
			RuleIdentifier = "ExpirationRule",
			Setting = "{\"permanentAssignment\":false,\"maximumGrantPeriodInMinutes\":129600}",
		},
	},
};
var result = await graphClient.PrivilegedAccess["{privilegedAccess-id}"].RoleSettings["{governanceRoleSetting-id}"].PatchAsync(requestBody);

Important

Microsoft Graph SDKs use the v1.0 version of the API by default, and do not support all the types, properties, and APIs available in the beta version. For details about accessing the beta API with the SDK, see Use the Microsoft Graph SDKs with the beta API.

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


// THE CLI IS IN PREVIEW. NON-PRODUCTION USE ONLY
mgc-beta privileged-access role-settings patch --privileged-access-id {privilegedAccess-id} --governance-role-setting-id {governanceRoleSetting-id} --body '{\
   "adminEligibleSettings":[\
      {\
         "ruleIdentifier":"ExpirationRule",\
         "setting":"{\"permanentAssignment\":false,\"maximumGrantPeriodInMinutes\":129600}"\
      }\
   ]\
}\
'

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.



import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
	  //other-imports
)

graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestBody := graphmodels.NewGovernanceRoleSetting()


governanceRuleSetting := graphmodels.NewGovernanceRuleSetting()
ruleIdentifier := "ExpirationRule"
governanceRuleSetting.SetRuleIdentifier(&ruleIdentifier) 
setting := "{\"permanentAssignment\":false,\"maximumGrantPeriodInMinutes\":129600}"
governanceRuleSetting.SetSetting(&setting) 

adminEligibleSettings := []graphmodels.GovernanceRuleSettingable {
	governanceRuleSetting,
}
requestBody.SetAdminEligibleSettings(adminEligibleSettings)

roleSettings, err := graphClient.PrivilegedAccess().ByPrivilegedAccessId("privilegedAccess-id").RoleSettings().ByGovernanceRoleSettingId("governanceRoleSetting-id").Patch(context.Background(), requestBody, nil)

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

GovernanceRoleSetting governanceRoleSetting = new GovernanceRoleSetting();
LinkedList<GovernanceRuleSetting> adminEligibleSettingsList = new LinkedList<GovernanceRuleSetting>();
GovernanceRuleSetting adminEligibleSettings = new GovernanceRuleSetting();
adminEligibleSettings.ruleIdentifier = "ExpirationRule";
adminEligibleSettings.setting = "{\"permanentAssignment\":false,\"maximumGrantPeriodInMinutes\":129600}";
adminEligibleSettingsList.add(adminEligibleSettings);
governanceRoleSetting.adminEligibleSettings = adminEligibleSettingsList;

graphClient.privilegedAccess("azureResources").roleSettings("5fb5aef8-1081-4b8e-bb16-9d5d0385bab5")
	.buildRequest()
	.patch(governanceRoleSetting);

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


const options = {
	authProvider,
};

const client = Client.init(options);

const governanceRoleSetting = {
   adminEligibleSettings: [
      {
         ruleIdentifier: 'ExpirationRule',
         setting: '{\"permanentAssignment\':false,\'maximumGrantPeriodInMinutes\':129600}"
      }
   ]
};

await client.api('/privilegedAccess/azureResources/roleSettings/5fb5aef8-1081-4b8e-bb16-9d5d0385bab5')
	.version('beta')
	.update(governanceRoleSetting);

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


<?php

// THIS SNIPPET IS A PREVIEW VERSION OF THE SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestBody = new GovernanceRoleSetting();
$adminEligibleSettingsGovernanceRuleSetting1 = new GovernanceRuleSetting();
$adminEligibleSettingsGovernanceRuleSetting1->setRuleIdentifier('ExpirationRule');
$adminEligibleSettingsGovernanceRuleSetting1->setSetting('{\"permanentAssignment\":false,\"maximumGrantPeriodInMinutes\":129600}');
$adminEligibleSettingsArray []= $adminEligibleSettingsGovernanceRuleSetting1;
$requestBody->setAdminEligibleSettings($adminEligibleSettingsArray);


$result = $graphServiceClient->privilegedAccess()->byPrivilegedAccessId('privilegedAccess-id')->roleSettings()->byGovernanceRoleSettingId('governanceRoleSetting-id')->patch($requestBody)->wait();

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


Import-Module Microsoft.Graph.Beta.Identity.Governance

$params = @{
	adminEligibleSettings = @(
		@{
			ruleIdentifier = "ExpirationRule"
			setting = '{"permanentAssignment":false,"maximumGrantPeriodInMinutes":129600}'
		}
	)
}

Update-MgBetaPrivilegedAccessRoleSetting -PrivilegedAccessId $privilegedAccessId -GovernanceRoleSettingId $governanceRoleSettingId -BodyParameter $params

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.


# THE PYTHON SDK IS IN PREVIEW. FOR NON-PRODUCTION USE ONLY

graph_client = GraphServiceClient(request_adapter)

request_body = GovernanceRoleSetting(
	admin_eligible_settings = [
		GovernanceRuleSetting(
			rule_identifier = "ExpirationRule",
			setting = "{\"permanentAssignment\":false,\"maximumGrantPeriodInMinutes\":129600}",
		),
	]
)

result = await graph_client.privileged_access.by_privileged_acce_id('privilegedAccess-id').role_settings.by_role_setting_id('governanceRoleSetting-id').patch(body = request_body)

Important

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

Response

HTTP/1.1 204 No Content

Update governanceRoleSetting

Permissions

HTTP request

Request headers

Request body

Response

Error codes

Example

Request

Response

Feedback

Additional resources

Additional resources