New-EntraBetaPermissionGrantConditionSet
Create a new Microsoft Entra ID permission grant condition set in a given policy.
Syntax
Default (Default)
New-EntraBetaPermissionGrantConditionSet
-PolicyId <String>
-ConditionSetType <String>
[-Permissions <System.Collections.Generic.List`1[System.String]>]
[-ClientApplicationTenantIds <System.Collections.Generic.List`1[System.String]>]
[-ClientApplicationsFromVerifiedPublisherOnly <Boolean>]
[-ClientApplicationIds <System.Collections.Generic.List`1[System.String]>]
[-ResourceApplication <String>]
[-ClientApplicationPublisherIds <System.Collections.Generic.List`1[System.String]>]
[-PermissionClassification <String>]
[-PermissionType <String>]
[<CommonParameters>]
Description
Create a new Microsoft Entra ID permission grant condition set object in an existing policy.
Examples
Example 1: Create a basic permission grant condition set in an existing policy with all build in values
Connect-Entra -Scopes 'Policy.ReadWrite.PermissionGrant'
$permissionGrantPolicy = Get-EntraBetaPermissionGrantPolicy | Where-Object {$_.Id -eq 'my-custom-consent-policy'}
New-EntraBetaPermissionGrantConditionSet -PolicyId $permissionGrantPolicy.Id -ConditionSetType 'includes' -PermissionType 'delegated'
Id CertifiedClientApplicationsOnly ClientApplicationIds ClientApplicationPublisherIds ClientApplicationTenantIds ClientApplicationsFromVerifiedPublisherOnly PermissionClassification
-- ------------------------------- -------------------- ----------------------------- -------------------------- ------------------------------------------- -------------------
aaaa0000-bb11-2222-33cc-444444dddddd False {all} {all} {all} False all all delegated {all}
This command creates a basic permission grant condition set in an existing policy with all build in values.
-PolicyIdparameter specifies the unique identifier of a permission grant policy.-ConditionSetTypeparameter indicates whether the condition sets are included in the policy or excluded.-PermissionTypeparameter specifies the type of permissions (application, delegated) to scope consent operation down to.
Example 2: Create a permission grant condition set in an existing policy that includes specific permissions for a resource application
Connect-Entra -Scopes 'Policy.ReadWrite.PermissionGrant'
$permission = (Get-EntraBetaServicePrincipal -Filter "DisplayName eq 'Box'").AppRoles.Id
$permissionGrantPolicy = Get-EntraBetaPermissionGrantPolicy | Where-Object { $_.Id -eq 'my-custom-consent-policy' }
New-EntraBetaPermissionGrantConditionSet -PolicyId $permissionGrantPolicy.Id -ConditionSetType 'includes' -PermissionType 'delegated' -Permissions @($permission) -ResourceApplication 'resource-application-id'
Id CertifiedClientApplicationsOnly ClientApplicationIds ClientApplicationPublisherIds ClientApplicationTenantIds ClientApplicationsFromVerifiedPublisherOnly PermissionClassification
-- ------------------------------- -------------------- ----------------------------- -------------------------- ------------------------------------------- -------------------
bbbb1111-cc22-3333-44dd-555555eeeeee False {all} {all} {all} False all all delegated {all}
This command creates a permission grant condition set in an existing policy that includes specific permissions for a resource application.
-PolicyIdparameter specifies the unique identifier of a permission grant policy.-ConditionSetTypeparameter indicates whether the condition sets are included in the policy or excluded.-PermissionTypeparameter specifies the type of permissions (application, delegated) to scope consent operation down to.-Permissionsparameter specifies the identifier of the resource application to scope consent operation down to. It could be @("All") or a list of permission IDs.-ResourceApplicationparameter specifies identifier of the resource application to scope consent operation down to. It could be "Any" or a specific resource application ID.
Example 3: Create a permission grant condition set in an existing policy that is excluded
Connect-Entra -Scopes 'Policy.ReadWrite.PermissionGrant'
$permissionGrantPolicy = Get-EntraBetaPermissionGrantPolicy | Where-Object { $_.Id -eq 'my-custom-consent-policy' }
$params = @{
PolicyId = $permissionGrantPolicy.Id
ConditionSetType = 'excludes'
PermissionType = 'delegated'
Permissions = @('All')
ResourceApplication = 'a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1'
PermissionClassification = 'low'
ClientApplicationsFromVerifiedPublisherOnly = $true
ClientApplicationIds = @('All')
ClientApplicationTenantIds = @('All')
ClientApplicationPublisherIds = @('All')
}
New-EntraBetaPermissionGrantConditionSet @params
Id CertifiedClientApplicationsOnly ClientApplicationIds ClientApplicationPublisherIds ClientApplicationTenantIds ClientApplicationsFromVerifiedPublisherOnly PermissionClassification
-- ------------------------------- -------------------- ----------------------------- -------------------------- ------------------------------------------- -------------------
dddd3333-ee44-5555-66ff-777777aaaaaa False {all} {all} {all} True low
This command creates a permission grant condition set in an existing policy that is excluded.
-PolicyIdparameter specifies the unique identifier of a permission grant policy.-ConditionSetTypeparameter indicates whether the condition sets are included in the policy or excluded.-PermissionTypeparameter specifies the type of permissions (application, delegated) to scope consent operation down to.-Permissionsparameter specifies the identifier of the resource application to scope consent operation down to. It could be @("All") or a list of permission IDs.-ResourceApplicationparameter specifies identifier of the resource application to scope consent operation down to. It could be "Any" or a specific resource application ID.-PermissionClassificationparameter specifies the specific classification (all, low, medium, high) to scope consent operation down to.-ClientApplicationsFromVerifiedPublisherOnlyparameter indicates whether to only includes client applications from verified publishers.-ClientApplicationIdsparameter specifies the set of client application IDs to scope consent operation down to. It could be @("All") or a list of client application IDs.-ClientApplicationTenantIdsparameter specifies the set of client applications publisher IDs to scope consent operation down to. It could be @("All") or a list of client application publisher IDs.-ClientApplicationPublisherIdsparameter specifies the set of client applications publisher IDs to scope consent operation down to. It could be @("All") or a list of client application publisher IDs.
Example 4: Create a permission grant condition set in an existing policy that is excluded
Connect-Entra -Scopes 'Policy.ReadWrite.PermissionGrant'
$permissionGrantPolicy = Get-EntraBetaPermissionGrantPolicy | Where-Object { $_.Id -eq 'my-custom-consent-policy' }
$permission = (Get-EntraBetaServicePrincipal -Filter "DisplayName eq '<service-principal-displayname>'").AppRoles.Id
$params = @{
PolicyId = $permissionGrantPolicy.Id
ConditionSetType = 'excludes'
PermissionType = 'delegated'
Permissions = @($permission)
ResourceApplication = 'a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1'
PermissionClassification = 'low'
ClientApplicationsFromVerifiedPublisherOnly = $true
ClientApplicationIds = @('00001111-aaaa-2222-bbbb-3333cccc4444', '11112222-bbbb-3333-cccc-4444dddd5555')
ClientApplicationTenantIds = @('aaaabbbb-0000-cccc-1111-dddd2222eeee', 'bbbbcccc-1111-dddd-2222-eeee3333ffff', 'ccccdddd-2222-eeee-3333-ffff4444aaaa')
ClientApplicationPublisherIds = @('33334444-dddd-5555-eeee-6666ffff7777')
}
New-EntraBetaPermissionGrantConditionSet @params
Id CertifiedClientApplicationsOnly ClientApplicationIds ClientApplicationPublisherIds ClientApplicationTenantIds
-- ------------------------------- -------------------- ----------------------------- --------------------
cccccccc-2222-3333-4444-dddddddddddd False {33334444-dddd-5555-eeee-6666ffff7777} {d5aec55f-2d12-4442-8d2f-ccca95d4390e} {aaaabbbb-0000-cccc-1111-dddd2222eeee}
This command creates a permission grant condition set in an existing policy that is excluded.
-PolicyIdparameter specifies the unique identifier of a permission grant policy.-ConditionSetTypeparameter indicates whether the condition sets are included in the policy or excluded.-PermissionTypeparameter specifies the type of permissions (application, delegated) to scope consent operation down to.-Permissionsparameter specifies the identifier of the resource application to scope consent operation down to. It could be @("All") or a list of permission IDs.-ResourceApplicationparameter specifies identifier of the resource application to scope consent operation down to. It could be "Any" or a specific resource application ID.-PermissionClassificationparameter specifies the specific classification (all, low, medium, high) to scope consent operation down to.-ClientApplicationsFromVerifiedPublisherOnlyparameter indicates whether to only includes client applications from verified publishers.-ClientApplicationIdsparameter specifies the set of client application IDs to scope consent operation down to. It could be @("All") or a list of client application IDs.-ClientApplicationTenantIdsparameter specifies the set of client applications publisher IDs to scope consent operation down to. It could be @("All") or a list of client application publisher IDs.-ClientApplicationPublisherIdsparameter specifies the set of client applications publisher IDs to scope consent operation down to. It could be @("All") or a list of client application publisher IDs.
Parameters
-ClientApplicationIds
The set of client application IDs to scope consent operation down to. It could be @("All") or a list of client application IDs.
Parameter properties
| Type: | System.Collections.Generic.List`1[System.String] |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-ClientApplicationPublisherIds
The set of client applications publisher IDs to scope consent operation down to. It could be @("All") or a list of client application publisher IDs.
Parameter properties
| Type: | System.Collections.Generic.List`1[System.String] |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-ClientApplicationsFromVerifiedPublisherOnly
A value indicates whether to only includes client applications from verified publishers.
Parameter properties
| Type: | System.Boolean |
| Default value: | False |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-ClientApplicationTenantIds
The set of client application tenant IDs to scope consent operation down to. It could be @("All") or a list of client application tenant IDs.
Parameter properties
| Type: | System.Collections.Generic.List`1[System.String] |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-ConditionSetType
The value indicates whether the condition sets are included in the policy or excluded.
Parameter properties
| Type: | System.String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | True |
| Value from pipeline: | True |
| Value from pipeline by property name: | True |
| Value from remaining arguments: | False |
-PermissionClassification
Specific classification (all, low, medium, high) to scope consent operation down to.
Parameter properties
| Type: | System.String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-Permissions
The identifier of the resource application to scope consent operation down to. It could be @("All") or a list of permission IDs.
Parameter properties
| Type: | System.Collections.Generic.List`1[System.String] |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-PermissionType
Specific type of permissions (application, delegated) to scope consent operation down to.
Parameter properties
| Type: | System.String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
-PolicyId
The unique identifier of a Microsoft Entra ID permission grant policy object.
Parameter properties
| Type: | System.String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | True |
| Value from pipeline: | True |
| Value from pipeline by property name: | True |
| Value from remaining arguments: | False |
-ResourceApplication
The identifier of the resource application to scope consent operation down to. It could be "Any" or a specific resource application ID.
Parameter properties
| Type: | System.String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
Parameter sets
(All)
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.