Microsoft Graph のエンタイトルメント管理 API を使用してリソースへのアクセスを管理する

[アーティクル]
03/26/2023

グループ、アプリケーション、サイトなど、従業員が必要とするすべてのリソースへのアクセスを管理することは、組織にとって重要な機能です。生産性を高めるために必要な適切なレベルのアクセス権を従業員に付与し、不要になったときにアクセス権を削除する必要があります。 Microsoft Graph API を使用した Azure Active Directory (Azure AD) エンタイトルメント管理を使用すると、この種類のアクセスを管理できます。

このチュートリアルでは、内部ユーザーがセルフサービスで要求できるマーケティングキャンペーン用のリソースのパッケージを作成するコードを開発する方法について説明します。要求は承認を必要とせず、ユーザーのアクセスは 30 日後に期限切れになります。このチュートリアルでは、マーケティングキャンペーンリソースは単なるグループのメンバーシップですが、グループ、アプリケーション、または SharePoint Online サイトのコレクションである可能性があります。

注:

このチュートリアルに示す応答オブジェクトは、読みやすくするために短縮される場合があります。

前提条件

このチュートリアルを正常に完了するには、必要な前提条件があることを確認します。

Azure AD エンタイトルメント管理には、特定のライセンスが必要です。詳細については、「ライセンス要件」を参照してください。テナントには次のライセンスが必要です。
- Azure AD Premium P2
- Enterprise Mobility + Security (EMS) E5 ライセンス
Graph エクスプローラー、Postman などの API クライアントにサインインするか、独自のクライアントアプリを作成して Microsoft Graph を呼び出します。このチュートリアルで Microsoft Graph API を呼び出すには、グローバル管理者ロールを持つアカウントを使用する必要があります。
委任されたアクセス許可を自分に付与します。 User.ReadWrite.All、 Group.ReadWrite.All、および EntitlementManagement.ReadWrite.All。

手順 1: ユーザーアカウントとグループを作成する

この手順では、権利管理のターゲットリソースであるディレクトリに Marketing resources という名前のグループを作成します。また、内部要求者として設定されたユーザーアカウントも作成します。

ユーザーアカウントを作成する

このチュートリアルでは、アクセスパッケージ内のリソースへのアクセスを要求するために使用するユーザーアカウントを作成します。これらの呼び出しを行うときは、テナントのドメイン名に変更 contoso.onmicrosoft.com します。テナントの情報は、Azure Active Directory の概要ページで確認できます。チュートリアルの後半で使用するために返される id プロパティの値を記録します。

要求

POST https://graph.microsoft.com/v1.0/users
Content-type: application/json

{
  "accountEnabled":true,
  "displayName":"Requestor1",
  "mailNickname":"Requestor1",
  "userPrincipalName":"Requestor1@contoso.onmicrosoft.com",
  "passwordProfile": {
    "forceChangePasswordNextSignIn":true,
    "password":"Contoso1234"
  }
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new User
{
	AccountEnabled = true,
	DisplayName = "Requestor1",
	MailNickname = "Requestor1",
	UserPrincipalName = "Requestor1@contoso.onmicrosoft.com",
	PasswordProfile = new PasswordProfile
	{
		ForceChangePasswordNextSignIn = true,
		Password = "Contoso1234",
	},
};
var result = await graphClient.Users.PostAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const user = {
  accountEnabled: true,
  displayName: 'Requestor1',
  mailNickname: 'Requestor1',
  userPrincipalName: 'Requestor1@contoso.onmicrosoft.com',
  passwordProfile: {
    forceChangePasswordNextSignIn: true,
    password: 'Contoso1234'
  }
};

await client.api('/users')
	.post(user);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

User user = new User();
user.accountEnabled = true;
user.displayName = "Requestor1";
user.mailNickname = "Requestor1";
user.userPrincipalName = "Requestor1@contoso.onmicrosoft.com";
PasswordProfile passwordProfile = new PasswordProfile();
passwordProfile.forceChangePasswordNextSignIn = true;
passwordProfile.password = "Contoso1234";
user.passwordProfile = passwordProfile;

graphClient.users()
	.buildRequest()
	.post(user);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewUser()
accountEnabled := true
requestBody.SetAccountEnabled(&accountEnabled) 
displayName := "Requestor1"
requestBody.SetDisplayName(&displayName) 
mailNickname := "Requestor1"
requestBody.SetMailNickname(&mailNickname) 
userPrincipalName := "Requestor1@contoso.onmicrosoft.com"
requestBody.SetUserPrincipalName(&userPrincipalName) 
passwordProfile := graphmodels.NewPasswordProfile()
forceChangePasswordNextSignIn := true
passwordProfile.SetForceChangePasswordNextSignIn(&forceChangePasswordNextSignIn) 
password := "Contoso1234"
passwordProfile.SetPassword(&password) 
requestBody.SetPasswordProfile(passwordProfile)

result, err := graphClient.Users().Post(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Users

$params = @{
	AccountEnabled = $true
	DisplayName = "Requestor1"
	MailNickname = "Requestor1"
	UserPrincipalName = "Requestor1@contoso.onmicrosoft.com"
	PasswordProfile = @{
		ForceChangePasswordNextSignIn = $true
		Password = "Contoso1234"
	}
}

New-MgUser -BodyParameter $params


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new User();
$requestBody->setAccountEnabled(true);

$requestBody->setDisplayName('Requestor1');

$requestBody->setMailNickname('Requestor1');

$requestBody->setUserPrincipalName('Requestor1@contoso.onmicrosoft.com');

$passwordProfile = new PasswordProfile();
$passwordProfile->setForceChangePasswordNextSignIn(true);

$passwordProfile->setPassword('Contoso1234');


$requestBody->setPasswordProfile($passwordProfile);


$requestResult = $graphServiceClient->users()->post($requestBody);

応答

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
  "id": "007d1c7e-7fa8-4e33-b678-5e437acdcddc",
  "deletedDateTime": null,
  "accountEnabled": true,
  "ageGroup": null,
  "businessPhones": [],
  "city": null,
  "createdDateTime": null,
  "creationType": null,
  "companyName": null,
  "consentProvidedForMinor": null,
  "country": null,
  "department": null,
  "displayName": "Requestor1",
  "employeeId": null,
  "faxNumber": null,
  "givenName": null,
  "imAddresses": [],
  "infoCatalogs": [],
  "isResourceAccount": null,
  "jobTitle": null,
  "legalAgeGroupClassification": null,
  "mail": null,
  "mailNickname": "Requestor1",
}

グループを作成する

このチュートリアルでは、エンタイトルメント管理のターゲット リソースである Marketing resources という名前のグループを作成します。既存のグループが既にある場合は、使用できます。このチュートリアルの後半で使用するために返される id プロパティの値を記録します。

要求

POST https://graph.microsoft.com/v1.0/groups
Content-type: application/json

{
  "description":"Marketing group",
  "displayName":"Marketing resources",
  "mailEnabled":false,
  "mailNickname":"markres",
  "securityEnabled":true
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new Group
{
	Description = "Marketing group",
	DisplayName = "Marketing resources",
	MailEnabled = false,
	MailNickname = "markres",
	SecurityEnabled = true,
};
var result = await graphClient.Groups.PostAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const group = {
  description: 'Marketing group',
  displayName: 'Marketing resources',
  mailEnabled: false,
  mailNickname: 'markres',
  securityEnabled: true
};

await client.api('/groups')
	.post(group);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

Group group = new Group();
group.description = "Marketing group";
group.displayName = "Marketing resources";
group.mailEnabled = false;
group.mailNickname = "markres";
group.securityEnabled = true;

graphClient.groups()
	.buildRequest()
	.post(group);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewGroup()
description := "Marketing group"
requestBody.SetDescription(&description) 
displayName := "Marketing resources"
requestBody.SetDisplayName(&displayName) 
mailEnabled := false
requestBody.SetMailEnabled(&mailEnabled) 
mailNickname := "markres"
requestBody.SetMailNickname(&mailNickname) 
securityEnabled := true
requestBody.SetSecurityEnabled(&securityEnabled) 

result, err := graphClient.Groups().Post(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Groups

$params = @{
	Description = "Marketing group"
	DisplayName = "Marketing resources"
	MailEnabled = $false
	MailNickname = "markres"
	SecurityEnabled = $true
}

New-MgGroup -BodyParameter $params


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new Group();
$requestBody->setDescription('Marketing group');

$requestBody->setDisplayName('Marketing resources');

$requestBody->setMailEnabled(false);

$requestBody->setMailNickname('markres');

$requestBody->setSecurityEnabled(true);



$requestResult = $graphServiceClient->groups()->post($requestBody);

応答

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#groups/$entity",
  "id": "e93e24d1-2b65-4a6c-a1dd-654a12225487",
  "deletedDateTime": null,
  "classification": null,
  "createdDateTime": "2020-06-24T16:47:37Z",
  "createdByAppId": "de8bc8b5-d9f9-48b1-a8ad-b748da725064",
  "description": "Marketing group",
  "displayName": "Marketing resources",
  "expirationDateTime": null,
  "groupTypes": [],
  "infoCatalogs": [],
  "isAssignableToRole": null,
  "mail": null,
  "mailEnabled": false,
  "mailNickname": "markres"
}

手順 2: カタログにリソースを追加し、アクセスパッケージを作成する

アクセスパッケージは、チームまたはプロジェクトが必要とするリソースのバンドルであり、ポリシーで管理されます。アクセスパッケージは、カタログと呼ばれるコンテナーで定義されます。カタログは、アクセスパッケージで使用されるリソース (グループ、アプリ、サイトなど) を参照できます。この手順では、一般カタログに Marketing Campaign アクセスパッケージを作成します。別のカタログがある場合は、次のセクションでその名前を使用します。

カタログ識別子を取得する

カタログにリソースを追加するには、まずその識別子を取得する必要があります。 General カタログを使用している場合は、次の要求を実行してその識別子を取得します。別のカラログを使用している場合は、要求のフィルター値をカタログの名前に変更します。このチュートリアルの後半で使用するために返される id プロパティの値を記録します。

要求

GET https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackageCatalogs?$filter=(displayName eq 'General')


var graphClient = new GraphServiceClient(requestAdapter);

var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackageCatalogs.GetAsync((requestConfiguration) =>
{
	requestConfiguration.QueryParameters.Filter = "(displayName eq 'General')";
});


const options = {
	authProvider,
};

const client = Client.init(options);

let accessPackageCatalogs = await client.api('/identityGovernance/entitlementManagement/accessPackageCatalogs')
	.version('beta')
	.filter('(displayName eq \'General\')')
	.get();


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

AccessPackageCatalogCollectionPage accessPackageCatalogs = graphClient.identityGovernance().entitlementManagement().accessPackageCatalogs()
	.buildRequest()
	.filter("(displayName eq 'General')")
	.get();


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestFilter := "(displayName eq 'General')"

requestParameters := &graphconfig.IdentityGovernanceEntitlementManagementAccessPackageCatalogsRequestBuilderGetQueryParameters{
	Filter: &requestFilter,
}
configuration := &graphconfig.IdentityGovernanceEntitlementManagementAccessPackageCatalogsRequestBuilderGetRequestConfiguration{
	QueryParameters: requestParameters,
}

result, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackageCatalogs().Get(context.Background(), configuration)


Import-Module Microsoft.Graph.Identity.Governance

Get-MgEntitlementManagementAccessPackageCatalog -Filter "(displayName eq 'General')"


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestConfiguration = new AccessPackageCatalogsRequestBuilderGetRequestConfiguration();

$queryParameters = new AccessPackageCatalogsRequestBuilderGetQueryParameters();
$queryParameters->filter = "(displayName eq 'General')";

$requestConfiguration->queryParameters = $queryParameters;


$requestResult = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackageCatalogs()->get($requestConfiguration);

応答

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#accessPackageCatalogs",
  "value": [ 
    {
      "id": "cec5d6ab-c75d-47c0-9c1c-92e89f66e384",
      "displayName": "General",
      "description": "Built-in catalog.",
      "catalogType": "ServiceDefault",
      "catalogStatus": "Published",
      "isExternallyVisible": true,
      "createdBy": "Azure AD",
      "createdDateTime": "2020-05-30T10:58:05.363Z",
      "modifiedBy": "Azure AD",
      "modifiedDateTime": "2020-05-30T10:58:05.363Z"
    }
  ]
}

応答には、要求で指定した名前のカタログのみが含まれている必要があります。返された値がない場合は、続行する前にカタログの名前が正しいことをチェックします。

カタログにグループを追加する

作成したグループをカタログに追加するには、次のプロパティ値を指定します。

catalogId - 使用しているカタログの ID
displayName - グループの名前
description - グループの説明
originId - 作成したグループの ID

要求

POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackageResourceRequests
Content-type: application/json

{
  "catalogId":"cec5d6ab-c75d-47c0-9c1c-92e89f66e384",
  "requestType": "AdminAdd",
  "justification": "",
  "accessPackageResource": {
    "displayName": "Marketing resources",
    "description": "Marketing group",
    "resourceType": "AadGroup",
    "originId": "e93e24d1-2b65-4a6c-a1dd-654a12225487",
    "originSystem": "AadGroup"
  }
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new AccessPackageResourceRequest
{
	CatalogId = "cec5d6ab-c75d-47c0-9c1c-92e89f66e384",
	RequestType = "AdminAdd",
	Justification = "",
	AccessPackageResource = new AccessPackageResource
	{
		DisplayName = "Marketing resources",
		Description = "Marketing group",
		ResourceType = "AadGroup",
		OriginId = "e93e24d1-2b65-4a6c-a1dd-654a12225487",
		OriginSystem = "AadGroup",
	},
};
var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackageResourceRequests.PostAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const accessPackageResourceRequest = {
  catalogId: 'cec5d6ab-c75d-47c0-9c1c-92e89f66e384',
  requestType: 'AdminAdd',
  justification: '',
  accessPackageResource: {
    displayName: 'Marketing resources',
    description: 'Marketing group',
    resourceType: 'AadGroup',
    originId: 'e93e24d1-2b65-4a6c-a1dd-654a12225487',
    originSystem: 'AadGroup'
  }
};

await client.api('/identityGovernance/entitlementManagement/accessPackageResourceRequests')
	.version('beta')
	.post(accessPackageResourceRequest);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

AccessPackageResourceRequest accessPackageResourceRequest = new AccessPackageResourceRequest();
accessPackageResourceRequest.catalogId = "cec5d6ab-c75d-47c0-9c1c-92e89f66e384";
accessPackageResourceRequest.requestType = "AdminAdd";
accessPackageResourceRequest.justification = "";
AccessPackageResource accessPackageResource = new AccessPackageResource();
accessPackageResource.displayName = "Marketing resources";
accessPackageResource.description = "Marketing group";
accessPackageResource.resourceType = "AadGroup";
accessPackageResource.originId = "e93e24d1-2b65-4a6c-a1dd-654a12225487";
accessPackageResource.originSystem = "AadGroup";
accessPackageResourceRequest.accessPackageResource = accessPackageResource;

graphClient.identityGovernance().entitlementManagement().accessPackageResourceRequests()
	.buildRequest()
	.post(accessPackageResourceRequest);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewAccessPackageResourceRequest()
catalogId := "cec5d6ab-c75d-47c0-9c1c-92e89f66e384"
requestBody.SetCatalogId(&catalogId) 
requestType := "AdminAdd"
requestBody.SetRequestType(&requestType) 
justification := ""
requestBody.SetJustification(&justification) 
accessPackageResource := graphmodels.NewAccessPackageResource()
displayName := "Marketing resources"
accessPackageResource.SetDisplayName(&displayName) 
description := "Marketing group"
accessPackageResource.SetDescription(&description) 
resourceType := "AadGroup"
accessPackageResource.SetResourceType(&resourceType) 
originId := "e93e24d1-2b65-4a6c-a1dd-654a12225487"
accessPackageResource.SetOriginId(&originId) 
originSystem := "AadGroup"
accessPackageResource.SetOriginSystem(&originSystem) 
requestBody.SetAccessPackageResource(accessPackageResource)

result, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackageResourceRequests().Post(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Identity.Governance

$params = @{
	CatalogId = "cec5d6ab-c75d-47c0-9c1c-92e89f66e384"
	RequestType = "AdminAdd"
	Justification = ""
	AccessPackageResource = @{
		DisplayName = "Marketing resources"
		Description = "Marketing group"
		ResourceType = "AadGroup"
		OriginId = "e93e24d1-2b65-4a6c-a1dd-654a12225487"
		OriginSystem = "AadGroup"
	}
}

New-MgEntitlementManagementAccessPackageResourceRequest -BodyParameter $params


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new AccessPackageResourceRequest();
$requestBody->setCatalogId('cec5d6ab-c75d-47c0-9c1c-92e89f66e384');

$requestBody->setRequestType('AdminAdd');

$requestBody->setJustification('');

$accessPackageResource = new AccessPackageResource();
$accessPackageResource->setDisplayName('Marketing resources');

$accessPackageResource->setDescription('Marketing group');

$accessPackageResource->setResourceType('AadGroup');

$accessPackageResource->setOriginId('e93e24d1-2b65-4a6c-a1dd-654a12225487');

$accessPackageResource->setOriginSystem('AadGroup');


$requestBody->setAccessPackageResource($accessPackageResource);


$requestResult = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackageResourceRequests()->post($requestBody);

応答

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/entitlementManagement/accessPackageResourceRequests/$entity",
  "catalogId": "cec5d6ab-c75d-47c0-9c1c-92e89f66e384",
  "executeImmediately": false,
  "id": "44e521e0-fb6b-4d5e-a282-e7e68dc59493",
  "requestType": "AdminAdd",
  "requestState": "Delivered",
  "requestStatus": "Fulfilled",
  "isValidationOnly": false,
  "expirationDateTime": null,
  "justification": ""
}

カタログリソースを取得する

このチュートリアルの後の手順では、カタログ内のグループリソースに割り当てられた ID が 必要です。カタログ内のリソースとしてグループを表すこの識別子は、Microsoft Graph のグループ自体の識別子とは異なります。これは、カタログに Microsoft Graph で表されていないリソースを含めることができるためです。

要求で、使用しているカタログの ID を 指定します。グループカタログリソースの id プロパティの値を記録します。

要求

GET https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackageCatalogs/cec5d6ab-c75d-47c0-9c1c-92e89f66e384/accessPackageResources?$filter=(displayName eq 'Marketing resources')


var graphClient = new GraphServiceClient(requestAdapter);

var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackageCatalogs["{accessPackageCatalog-id}"].AccessPackageResources.GetAsync((requestConfiguration) =>
{
	requestConfiguration.QueryParameters.Filter = "(displayName eq 'Marketing resources')";
});


const options = {
	authProvider,
};

const client = Client.init(options);

let accessPackageResources = await client.api('/identityGovernance/entitlementManagement/accessPackageCatalogs/cec5d6ab-c75d-47c0-9c1c-92e89f66e384/accessPackageResources')
	.version('beta')
	.filter('(displayName eq \'Marketing resources\')')
	.get();


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

AccessPackageResourceCollectionPage accessPackageResources = graphClient.identityGovernance().entitlementManagement().accessPackageCatalogs("cec5d6ab-c75d-47c0-9c1c-92e89f66e384").accessPackageResources()
	.buildRequest()
	.filter("(displayName eq 'Marketing resources')")
	.get();


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestFilter := "(displayName eq 'Marketing resources')"

requestParameters := &graphconfig.IdentityGovernanceEntitlementManagementAccessPackageCatalogItemAccessPackageResourcesRequestBuilderGetQueryParameters{
	Filter: &requestFilter,
}
configuration := &graphconfig.IdentityGovernanceEntitlementManagementAccessPackageCatalogItemAccessPackageResourcesRequestBuilderGetRequestConfiguration{
	QueryParameters: requestParameters,
}

result, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackageCatalogsById("accessPackageCatalog-id").AccessPackageResources().Get(context.Background(), configuration)


Import-Module Microsoft.Graph.Identity.Governance

Get-MgEntitlementManagementAccessPackageCatalogAccessPackageResource -AccessPackageCatalogId $accessPackageCatalogId -Filter "(displayName eq 'Marketing resources')"


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestConfiguration = new AccessPackageResourcesRequestBuilderGetRequestConfiguration();

$queryParameters = new AccessPackageResourcesRequestBuilderGetQueryParameters();
$queryParameters->filter = "(displayName eq 'Marketing resources')";

$requestConfiguration->queryParameters = $queryParameters;


$requestResult = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackageCatalogsById('accessPackageCatalog-id')->accessPackageResources()->get($requestConfiguration);

応答

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#accessPackageResources",
  "value": [
    {
      "id": "4a1e21c5-8a76-4578-acb1-641160e076e8",
      "displayName": "Marketing resources",
      "description": "Marketing group",
      "url": "https://account.activedirectory.windowsazure.com/r?tenantId=d3030981-8fb9-4919-9980-5580caeddd75#/manageMembership?objectType=Group&objectId=e93e24d1-2b65-4a6c-a1dd-654a12225487",
      "resourceType": "Security Group",
      "originId": "e93e24d1-2b65-4a6c-a1dd-654a12225487",
      "originSystem": "AadGroup",
      "isPendingOnboarding": false,
      "addedBy": "admin@contoso.onmicrosoft.com",
      "addedOn": "2020-08-21T19:27:29.967Z"
    }
  ]
}

リソースロールを取得する

アクセスパッケージは、リソースのロールにユーザーを割り当てます。グループの一般的なロールは、メンバーロールです。 SharePoint Online サイトやアプリケーションなどの他のリソースには、多くのロールが含まれる場合があります。アクセスパッケージで使用されるグループの一般的なロールは、メンバーロールです。このチュートリアルの後半でアクセスパッケージにリソースロールを追加する場合は、メンバーロールが必要です。

要求で、カタログの ID と、記録したカタログ内のグループリソースの ID を 使用して、メンバーリソースロールの originId を 取得します。このチュートリアルの後半で使用する originId プロパティの値を記録します。

要求

GET https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackageCatalogs/cec5d6ab-c75d-47c0-9c1c-92e89f66e384/accessPackageResourceRoles?$filter=(originSystem+eq+%27AadGroup%27+and+accessPackageResource/id+eq+%274a1e21c5-8a76-4578-acb1-641160e076e8%27+and+displayName+eq+%27Member%27)&$expand=accessPackageResource


var graphClient = new GraphServiceClient(requestAdapter);

var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackageCatalogs["{accessPackageCatalog-id}"].AccessPackageResourceRoles.GetAsync((requestConfiguration) =>
{
	requestConfiguration.QueryParameters.Filter = "(originSystem eq 'AadGroup' and accessPackageResource/id eq '4a1e21c5-8a76-4578-acb1-641160e076e8' and displayName eq 'Member')";
	requestConfiguration.QueryParameters.Expand = new string []{ "accessPackageResource" };
});


const options = {
	authProvider,
};

const client = Client.init(options);

let accessPackageResourceRoles = await client.api('/identityGovernance/entitlementManagement/accessPackageCatalogs/cec5d6ab-c75d-47c0-9c1c-92e89f66e384/accessPackageResourceRoles')
	.version('beta')
	.filter('(originSystem eq \'AadGroup\' and accessPackageResource/id eq \'4a1e21c5-8a76-4578-acb1-641160e076e8\' and displayName eq \'Member\')')
	.expand('accessPackageResource/id%20eq%20\'4a1e21c5-8a76-4578-acb1-641160e076e8\'%20and%20displayName%20eq%20\'Member\')')
	.get();


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

AccessPackageResourceRoleCollectionPage accessPackageResourceRoles = graphClient.identityGovernance().entitlementManagement().accessPackageCatalogs("cec5d6ab-c75d-47c0-9c1c-92e89f66e384").accessPackageResourceRoles()
	.buildRequest()
	.filter("(originSystem eq 'AadGroup' and accessPackageResource/id eq '4a1e21c5-8a76-4578-acb1-641160e076e8' and displayName eq 'Member')")
	.expand("accessPackageResource/id%20eq%20'4a1e21c5-8a76-4578-acb1-641160e076e8'%20and%20displayName%20eq%20'Member')")
	.get();


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestFilter := "(originSystem eq 'AadGroup' and accessPackageResource/id eq '4a1e21c5-8a76-4578-acb1-641160e076e8' and displayName eq 'Member')"

requestParameters := &graphconfig.IdentityGovernanceEntitlementManagementAccessPackageCatalogItemAccessPackageResourceRolesRequestBuilderGetQueryParameters{
	Filter: &requestFilter,
	Expand: [] string {"accessPackageResource"},
}
configuration := &graphconfig.IdentityGovernanceEntitlementManagementAccessPackageCatalogItemAccessPackageResourceRolesRequestBuilderGetRequestConfiguration{
	QueryParameters: requestParameters,
}

result, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackageCatalogsById("accessPackageCatalog-id").AccessPackageResourceRoles().Get(context.Background(), configuration)


Import-Module Microsoft.Graph.Identity.Governance

Get-MgEntitlementManagementAccessPackageCatalogAccessPackageResourceRole -AccessPackageCatalogId $accessPackageCatalogId -Filter "(originSystem eq 'AadGroup' and accessPackageResource/id eq '4a1e21c5-8a76-4578-acb1-641160e076e8' and displayName eq 'Member')" -ExpandProperty "accessPackageResource"


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestConfiguration = new AccessPackageResourceRolesRequestBuilderGetRequestConfiguration();

$queryParameters = new AccessPackageResourceRolesRequestBuilderGetQueryParameters();
$queryParameters->filter = "(originSystem eq 'AadGroup' and accessPackageResource/id eq '4a1e21c5-8a76-4578-acb1-641160e076e8' and displayName eq 'Member')";
$queryParameters->expand = ["accessPackageResource"];

$requestConfiguration->queryParameters = $queryParameters;


$requestResult = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackageCatalogsById('accessPackageCatalog-id')->accessPackageResourceRoles()->get($requestConfiguration);

応答

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/entitlementManagement/accessPackageCatalogs('ede67938-cda7-4127-a9ca-7c7bf86a19b7')/accessPackageResourceRoles(accessPackageResource())",
  "value": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "displayName": "Member",
      "description": null,
      "originSystem": "AadGroup",
      "originId": "Member_e93e24d1-2b65-4a6c-a1dd-654a12225487",
      "accessPackageResource": {
        "id": "4a1e21c5-8a76-4578-acb1-641160e076e8",
        "displayName": "Marketing resources",
        "description": "Marketing group",
        "url": "https://account.activedirectory.windowsazure.com/r?tenantId=d3030981-8fb9-4919-9980-5580caeddd75#/manageMembership?objectType=Group&objectId=e93e24d1-2b65-4a6c-a1dd-654a12225487",
        "resourceType": "Security Group",
        "originId": "e93e24d1-2b65-4a6c-a1dd-654a12225487",
        "originSystem": "AadGroup",
        "isPendingOnboarding": false,
        "addedBy": "admin@contoso.onmicrosoft.com",
        "addedOn": "2020-06-26T17:13:23.723Z",
        "accessPackageResourceScopes": []
      }
    }
  ]
}

成功した場合は、そのグループのメンバーロールを表す 1 つの値が返されます。ロールが返されない場合は、カタログの ID 値とアクセスパッケージリソースをチェックします。

アクセスパッケージを作成する

この時点で、グループリソースを含むカタログがあり、アクセスパッケージでグループメンバーのリソースロールを使用することがわかります。次の手順では、アクセスパッケージを作成します。アクセスパッケージを作成したら、リソースロールを追加し、ユーザーがそのリソースロールへのアクセスを要求する方法のポリシーを作成できます。アクセスパッケージを作成するには、前に記録したカタログの ID を 使用します。このチュートリアルの後半で使用するアクセスパッケージの ID を 記録します。

要求

POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages
Content-type: application/json

{
  "catalogId": "cec5d6ab-c75d-47c0-9c1c-92e89f66e384",
  "displayName": "Marketing Campaign",
  "description": "Access to resources for the campaign"
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new AccessPackage
{
	CatalogId = "cec5d6ab-c75d-47c0-9c1c-92e89f66e384",
	DisplayName = "Marketing Campaign",
	Description = "Access to resources for the campaign",
};
var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackages.PostAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const accessPackage = {
  catalogId: 'cec5d6ab-c75d-47c0-9c1c-92e89f66e384',
  displayName: 'Marketing Campaign',
  description: 'Access to resources for the campaign'
};

await client.api('/identityGovernance/entitlementManagement/accessPackages')
	.version('beta')
	.post(accessPackage);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

AccessPackage accessPackage = new AccessPackage();
accessPackage.catalogId = "cec5d6ab-c75d-47c0-9c1c-92e89f66e384";
accessPackage.displayName = "Marketing Campaign";
accessPackage.description = "Access to resources for the campaign";

graphClient.identityGovernance().entitlementManagement().accessPackages()
	.buildRequest()
	.post(accessPackage);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewAccessPackage()
catalogId := "cec5d6ab-c75d-47c0-9c1c-92e89f66e384"
requestBody.SetCatalogId(&catalogId) 
displayName := "Marketing Campaign"
requestBody.SetDisplayName(&displayName) 
description := "Access to resources for the campaign"
requestBody.SetDescription(&description) 

result, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackages().Post(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Identity.Governance

$params = @{
	CatalogId = "cec5d6ab-c75d-47c0-9c1c-92e89f66e384"
	DisplayName = "Marketing Campaign"
	Description = "Access to resources for the campaign"
}

New-MgEntitlementManagementAccessPackage -BodyParameter $params


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new AccessPackage();
$requestBody->setCatalogId('cec5d6ab-c75d-47c0-9c1c-92e89f66e384');

$requestBody->setDisplayName('Marketing Campaign');

$requestBody->setDescription('Access to resources for the campaign');



$requestResult = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackages()->post($requestBody);

応答

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/entitlementManagement/accessPackages/$entity",
  "id": "88203d16-0e31-41d4-87b2-dd402f1435e9",
  "catalogId": "cec5d6ab-c75d-47c0-9c1c-92e89f66e384",
  "displayName": "Marketing Campaign",
  "description": "Access to resources for the campaign",
  "isHidden": false,
  "isRoleScopesVisible": false,
  "createdBy": "admin@contoso.onmicrosoft.com",
  "createdDateTime": "2020-08-21T19:45:33.2042281Z",
  "modifiedBy": "admin@contoso.onmicrosoft.com",
  "modifiedDateTime": "2020-08-21T19:45:33.2042281Z"
}

アクセスパッケージにリソースロールを追加する

グループリソースのメンバーロールをアクセスパッケージに追加します。要求で、アクセスパッケージの ID を 指定します。要求本文で、accessPackageResource のグループカタログリソースの ID を 指定し、以前に記録したメンバーロールの originId を 指定します。

要求

POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/88203d16-0e31-41d4-87b2-dd402f1435e9/accessPackageResourceRoleScopes
Content-type: application/json

{
  "accessPackageResourceRole": {
    "originId":"Member_e93e24d1-2b65-4a6c-a1dd-654a12225487",
    "displayName":"Member",
    "originSystem":"AadGroup",
    "accessPackageResource": {
      "id":"4a1e21c5-8a76-4578-acb1-641160e076e8","resourceType":"Security Group",  
      "originId":"e93e24d1-2b65-4a6c-a1dd-654a12225487","originSystem":"AadGroup"
    }
  },
  "accessPackageResourceScope": {
    "originId":"e93e24d1-2b65-4a6c-a1dd-654a12225487","originSystem":"AadGroup"
  }
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new AccessPackageResourceRoleScope
{
	AccessPackageResourceRole = new AccessPackageResourceRole
	{
		OriginId = "Member_e93e24d1-2b65-4a6c-a1dd-654a12225487",
		DisplayName = "Member",
		OriginSystem = "AadGroup",
		AccessPackageResource = new AccessPackageResource
		{
			Id = "4a1e21c5-8a76-4578-acb1-641160e076e8",
			ResourceType = "Security Group",
			OriginId = "e93e24d1-2b65-4a6c-a1dd-654a12225487",
			OriginSystem = "AadGroup",
		},
	},
	AccessPackageResourceScope = new AccessPackageResourceScope
	{
		OriginId = "e93e24d1-2b65-4a6c-a1dd-654a12225487",
		OriginSystem = "AadGroup",
	},
};
var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackages["{accessPackage-id}"].AccessPackageResourceRoleScopes.PostAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const accessPackageResourceRoleScope = {
  accessPackageResourceRole: {
    originId: 'Member_e93e24d1-2b65-4a6c-a1dd-654a12225487',
    displayName: 'Member',
    originSystem: 'AadGroup',
    accessPackageResource: {
      id: '4a1e21c5-8a76-4578-acb1-641160e076e8',resourceType: 'Security Group',  
      originId: 'e93e24d1-2b65-4a6c-a1dd-654a12225487',originSystem: 'AadGroup'
    }
  },
  accessPackageResourceScope: {
    originId: 'e93e24d1-2b65-4a6c-a1dd-654a12225487',originSystem: 'AadGroup'
  }
};

await client.api('/identityGovernance/entitlementManagement/accessPackages/88203d16-0e31-41d4-87b2-dd402f1435e9/accessPackageResourceRoleScopes')
	.version('beta')
	.post(accessPackageResourceRoleScope);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

AccessPackageResourceRoleScope accessPackageResourceRoleScope = new AccessPackageResourceRoleScope();
AccessPackageResourceRole accessPackageResourceRole = new AccessPackageResourceRole();
accessPackageResourceRole.originId = "Member_e93e24d1-2b65-4a6c-a1dd-654a12225487";
accessPackageResourceRole.displayName = "Member";
accessPackageResourceRole.originSystem = "AadGroup";
AccessPackageResource accessPackageResource = new AccessPackageResource();
accessPackageResource.id = "4a1e21c5-8a76-4578-acb1-641160e076e8";
accessPackageResource.resourceType = "Security Group";
accessPackageResource.originId = "e93e24d1-2b65-4a6c-a1dd-654a12225487";
accessPackageResource.originSystem = "AadGroup";
accessPackageResourceRole.accessPackageResource = accessPackageResource;
accessPackageResourceRoleScope.accessPackageResourceRole = accessPackageResourceRole;
AccessPackageResourceScope accessPackageResourceScope = new AccessPackageResourceScope();
accessPackageResourceScope.originId = "e93e24d1-2b65-4a6c-a1dd-654a12225487";
accessPackageResourceScope.originSystem = "AadGroup";
accessPackageResourceRoleScope.accessPackageResourceScope = accessPackageResourceScope;

graphClient.identityGovernance().entitlementManagement().accessPackages("88203d16-0e31-41d4-87b2-dd402f1435e9").accessPackageResourceRoleScopes()
	.buildRequest()
	.post(accessPackageResourceRoleScope);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewAccessPackageResourceRoleScope()
accessPackageResourceRole := graphmodels.NewAccessPackageResourceRole()
originId := "Member_e93e24d1-2b65-4a6c-a1dd-654a12225487"
accessPackageResourceRole.SetOriginId(&originId) 
displayName := "Member"
accessPackageResourceRole.SetDisplayName(&displayName) 
originSystem := "AadGroup"
accessPackageResourceRole.SetOriginSystem(&originSystem) 
accessPackageResource := graphmodels.NewAccessPackageResource()
id := "4a1e21c5-8a76-4578-acb1-641160e076e8"
accessPackageResource.SetId(&id) 
resourceType := "Security Group"
accessPackageResource.SetResourceType(&resourceType) 
originId := "e93e24d1-2b65-4a6c-a1dd-654a12225487"
accessPackageResource.SetOriginId(&originId) 
originSystem := "AadGroup"
accessPackageResource.SetOriginSystem(&originSystem) 
accessPackageResourceRole.SetAccessPackageResource(accessPackageResource)
requestBody.SetAccessPackageResourceRole(accessPackageResourceRole)
accessPackageResourceScope := graphmodels.NewAccessPackageResourceScope()
originId := "e93e24d1-2b65-4a6c-a1dd-654a12225487"
accessPackageResourceScope.SetOriginId(&originId) 
originSystem := "AadGroup"
accessPackageResourceScope.SetOriginSystem(&originSystem) 
requestBody.SetAccessPackageResourceScope(accessPackageResourceScope)

result, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackagesById("accessPackage-id").AccessPackageResourceRoleScopes().Post(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Identity.Governance

$params = @{
	AccessPackageResourceRole = @{
		OriginId = "Member_e93e24d1-2b65-4a6c-a1dd-654a12225487"
		DisplayName = "Member"
		OriginSystem = "AadGroup"
		AccessPackageResource = @{
			Id = "4a1e21c5-8a76-4578-acb1-641160e076e8"
			ResourceType = "Security Group"
			OriginId = "e93e24d1-2b65-4a6c-a1dd-654a12225487"
			OriginSystem = "AadGroup"
		}
	}
	AccessPackageResourceScope = @{
		OriginId = "e93e24d1-2b65-4a6c-a1dd-654a12225487"
		OriginSystem = "AadGroup"
	}
}

New-MgEntitlementManagementAccessPackageResourceRoleScope -AccessPackageId $accessPackageId -BodyParameter $params


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new AccessPackageResourceRoleScope();
$accessPackageResourceRole = new AccessPackageResourceRole();
$accessPackageResourceRole->setOriginId('Member_e93e24d1-2b65-4a6c-a1dd-654a12225487');

$accessPackageResourceRole->setDisplayName('Member');

$accessPackageResourceRole->setOriginSystem('AadGroup');

$accessPackageResourceRoleAccessPackageResource = new AccessPackageResource();
$accessPackageResourceRoleAccessPackageResource->setId('4a1e21c5-8a76-4578-acb1-641160e076e8');

$accessPackageResourceRoleAccessPackageResource->setResourceType('Security Group');

$accessPackageResourceRoleAccessPackageResource->setOriginId('e93e24d1-2b65-4a6c-a1dd-654a12225487');

$accessPackageResourceRoleAccessPackageResource->setOriginSystem('AadGroup');


$accessPackageResourceRole->setAccessPackageResource($accessPackageResourceRoleAccessPackageResource);

$requestBody->setAccessPackageResourceRole($accessPackageResourceRole);
$accessPackageResourceScope = new AccessPackageResourceScope();
$accessPackageResourceScope->setOriginId('e93e24d1-2b65-4a6c-a1dd-654a12225487');

$accessPackageResourceScope->setOriginSystem('AadGroup');


$requestBody->setAccessPackageResourceScope($accessPackageResourceScope);


$requestResult = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackagesById('accessPackage-id')->accessPackageResourceRoleScopes()->post($requestBody);

応答

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/entitlementManagement/accessPackages('88203d16-0e31-41d4-87b2-dd402f1435e9')/accessPackageResourceRoleScopes/$entity",
  "id": "e081321b-2802-4834-a6ca-6f598ce3cdf7_6dbd2209-9d14-4c76-b92b-fcb00e835fe1",
  "createdBy": "admin@contoso.onmicrosoft.com",
  "createdDateTime": "2020-08-21T19:56:00.6320729Z",
  "modifiedBy": "admin@contoso.onmicrosoft.com",
  "modifiedDateTime": "2020-08-21T19:56:00.6320729Z"
}

アクセスパッケージに、グループメンバーシップであるリソースロールが 1 つ追加されました。ロールは、アクセスパッケージを持つすべてのユーザーに割り当てられます。

アクセスパッケージポリシーを作成する

アクセスパッケージを作成し、リソースとロールを追加したら、アクセスパッケージポリシーを作成してアクセスできるユーザーを決定できます。このチュートリアルでは、作成した Requestor1 アカウントを有効にして、アクセスパッケージ内のリソースへのアクセスを要求します。このタスクには、次の値が必要です。

accessPackageId プロパティの値のアクセスパッケージの id
allowedRequestors の id プロパティの値の Requestor1 ユーザーアカウントの id

durationInDays プロパティの値を使用すると、Requestor1 アカウントはアクセスパッケージ内のリソースに最大 30 日間アクセスできます。このチュートリアルの後半で使用するために返される id プロパティの値を記録します。

要求

POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackageAssignmentPolicies
Content-type: application/json

{
  "accessPackageId": "88203d16-0e31-41d4-87b2-dd402f1435e9",
  "displayName": "Specific users",
  "description": "Specific users can request assignment",
  "accessReviewSettings": null,
  "durationInDays": 30,
  "requestorSettings": {
    "scopeType": "SpecificDirectorySubjects",
    "acceptRequests": true,
    "allowedRequestors": [
       {
         "@odata.type": "#microsoft.graph.singleUser",
         "isBackup": false,
         "id": "007d1c7e-7fa8-4e33-b678-5e437acdcddc",
         "description": "Requestor1"
       }
    ]
  },
  "requestApprovalSettings": {
    "isApprovalRequired": false,
    "isApprovalRequiredForExtension": false,
    "isRequestorJustificationRequired": false,
    "approvalMode": "NoApproval",
    "approvalStages": []
  }
}

Snippet not available


const options = {
	authProvider,
};

const client = Client.init(options);

const accessPackageAssignmentPolicy = {
  accessPackageId: '88203d16-0e31-41d4-87b2-dd402f1435e9',
  displayName: 'Specific users',
  description: 'Specific users can request assignment',
  accessReviewSettings: null,
  durationInDays: 30,
  requestorSettings: {
    scopeType: 'SpecificDirectorySubjects',
    acceptRequests: true,
    allowedRequestors: [
       {
         '@odata.type': '#microsoft.graph.singleUser',
         isBackup: false,
         id: '007d1c7e-7fa8-4e33-b678-5e437acdcddc',
         description: 'Requestor1'
       }
    ]
  },
  requestApprovalSettings: {
    isApprovalRequired: false,
    isApprovalRequiredForExtension: false,
    isRequestorJustificationRequired: false,
    approvalMode: 'NoApproval',
    approvalStages: []
  }
};

await client.api('/identityGovernance/entitlementManagement/accessPackageAssignmentPolicies')
	.version('beta')
	.post(accessPackageAssignmentPolicy);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

AccessPackageAssignmentPolicy accessPackageAssignmentPolicy = new AccessPackageAssignmentPolicy();
accessPackageAssignmentPolicy.accessPackageId = "88203d16-0e31-41d4-87b2-dd402f1435e9";
accessPackageAssignmentPolicy.displayName = "Specific users";
accessPackageAssignmentPolicy.description = "Specific users can request assignment";
accessPackageAssignmentPolicy.accessReviewSettings = null;
accessPackageAssignmentPolicy.durationInDays = 30;
RequestorSettings requestorSettings = new RequestorSettings();
requestorSettings.scopeType = "SpecificDirectorySubjects";
requestorSettings.acceptRequests = true;
LinkedList<UserSet> allowedRequestorsList = new LinkedList<UserSet>();
SingleUser allowedRequestors = new SingleUser();
allowedRequestors.isBackup = false;
allowedRequestors.id = "007d1c7e-7fa8-4e33-b678-5e437acdcddc";
allowedRequestors.description = "Requestor1";
allowedRequestorsList.add(allowedRequestors);
requestorSettings.allowedRequestors = allowedRequestorsList;
accessPackageAssignmentPolicy.requestorSettings = requestorSettings;
ApprovalSettings requestApprovalSettings = new ApprovalSettings();
requestApprovalSettings.isApprovalRequired = false;
requestApprovalSettings.isApprovalRequiredForExtension = false;
requestApprovalSettings.isRequestorJustificationRequired = false;
requestApprovalSettings.approvalMode = "NoApproval";
LinkedList<ApprovalStage> approvalStagesList = new LinkedList<ApprovalStage>();
requestApprovalSettings.approvalStages = approvalStagesList;
accessPackageAssignmentPolicy.requestApprovalSettings = requestApprovalSettings;

graphClient.identityGovernance().entitlementManagement().accessPackageAssignmentPolicies()
	.buildRequest()
	.post(accessPackageAssignmentPolicy);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewAccessPackageAssignmentPolicy()
accessPackageId := "88203d16-0e31-41d4-87b2-dd402f1435e9"
requestBody.SetAccessPackageId(&accessPackageId) 
displayName := "Specific users"
requestBody.SetDisplayName(&displayName) 
description := "Specific users can request assignment"
requestBody.SetDescription(&description) 
accessReviewSettings := null
requestBody.SetAccessReviewSettings(&accessReviewSettings) 
durationInDays := int32(30)
requestBody.SetDurationInDays(&durationInDays) 
requestorSettings := graphmodels.NewRequestorSettings()
scopeType := "SpecificDirectorySubjects"
requestorSettings.SetScopeType(&scopeType) 
acceptRequests := true
requestorSettings.SetAcceptRequests(&acceptRequests) 


userSet := graphmodels.NewUserSet()
isBackup := false
userSet.SetIsBackup(&isBackup) 
additionalData := map[string]interface{}{
	"id" : "007d1c7e-7fa8-4e33-b678-5e437acdcddc", 
	"description" : "Requestor1", 
}
userSet.SetAdditionalData(additionalData)

allowedRequestors := []graphmodels.UserSetable {
	userSet,

}
requestorSettings.SetAllowedRequestors(allowedRequestors)
requestBody.SetRequestorSettings(requestorSettings)
requestApprovalSettings := graphmodels.NewApprovalSettings()
isApprovalRequired := false
requestApprovalSettings.SetIsApprovalRequired(&isApprovalRequired) 
isApprovalRequiredForExtension := false
requestApprovalSettings.SetIsApprovalRequiredForExtension(&isApprovalRequiredForExtension) 
isRequestorJustificationRequired := false
requestApprovalSettings.SetIsRequestorJustificationRequired(&isRequestorJustificationRequired) 
approvalMode := "NoApproval"
requestApprovalSettings.SetApprovalMode(&approvalMode) 
approvalStages := []graphmodels.ApprovalStageable {

}
requestApprovalSettings.SetApprovalStages(approvalStages)
requestBody.SetRequestApprovalSettings(requestApprovalSettings)

result, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackageAssignmentPolicies().Post(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Identity.Governance

$params = @{
	AccessPackageId = "88203d16-0e31-41d4-87b2-dd402f1435e9"
	DisplayName = "Specific users"
	Description = "Specific users can request assignment"
	AccessReviewSettings = $null
	DurationInDays = 30
	RequestorSettings = @{
		ScopeType = "SpecificDirectorySubjects"
		AcceptRequests = $true
		AllowedRequestors = @(
			@{
				"@odata.type" = "#microsoft.graph.singleUser"
				IsBackup = $false
				Id = "007d1c7e-7fa8-4e33-b678-5e437acdcddc"
				Description = "Requestor1"
			}
		)
	}
	RequestApprovalSettings = @{
		IsApprovalRequired = $false
		IsApprovalRequiredForExtension = $false
		IsRequestorJustificationRequired = $false
		ApprovalMode = "NoApproval"
		ApprovalStages = @(
		)
	}
}

New-MgEntitlementManagementAccessPackageAssignmentPolicy -BodyParameter $params


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new AccessPackageAssignmentPolicy();
$requestBody->setAccessPackageId('88203d16-0e31-41d4-87b2-dd402f1435e9');

$requestBody->setDisplayName('Specific users');

$requestBody->setDescription('Specific users can request assignment');

$requestBody->setAccessReviewSettings(null);

$requestBody->setDurationInDays(30);

$requestorSettings = new RequestorSettings();
$requestorSettings->setScopeType('SpecificDirectorySubjects');

$requestorSettings->setAcceptRequests(true);

$allowedRequestorsUserSet1 = new UserSet();
$allowedRequestorsUserSet1->set@odatatype('#microsoft.graph.singleUser');

$allowedRequestorsUserSet1->setIsBackup(false);

$additionalData = [
'id' => '007d1c7e-7fa8-4e33-b678-5e437acdcddc', 
'description' => 'Requestor1', 
];
$allowedRequestorsUserSet1->setAdditionalData($additionalData);



$allowedRequestorsArray []= $allowedRequestorsUserSet1;
$requestorSettings->setAllowedRequestors($allowedRequestorsArray);



$requestBody->setRequestorSettings($requestorSettings);
$requestApprovalSettings = new ApprovalSettings();
$requestApprovalSettings->setIsApprovalRequired(false);

$requestApprovalSettings->setIsApprovalRequiredForExtension(false);

$requestApprovalSettings->setIsRequestorJustificationRequired(false);

$requestApprovalSettings->setApprovalMode('NoApproval');

$requestApprovalSettings->setApprovalStages([]);


$requestBody->setRequestApprovalSettings($requestApprovalSettings);


$requestResult = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackageAssignmentPolicies()->post($requestBody);

応答

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#accessPackageAssignmentPolicies/$entity",
  "id": "db440482-1210-4a60-9b55-3ac7a72f63ba",
  "accessPackageId": "88203d16-0e31-41d4-87b2-dd402f1435e9",
  "displayName": "Specific users",
  "description": "Specific users can request assignment",
  "canExtend": false,
  "durationInDays": 30,
  "expirationDateTime": null,
  "createdBy": "admin@contoso.onmicrosoft.com",
  "createdDateTime": "2020-06-29T19:47:44.7399675Z",
  "modifiedBy": "admin@contoso.onmicrosoft.com",
  "modifiedDateTime": "2020-06-29T19:47:44.7555489Z",
  "accessReviewSettings": null,
  "requestorSettings": {
    "scopeType": "SpecificDirectorySubjects",
    "acceptRequests": true,
    "allowedRequestors": [
      {
        "@odata.type": "#microsoft.graph.singleUser",
        "isBackup": false,
        "id": "007d1c7e-7fa8-4e33-b678-5e437acdcddc",
        "description": "Requestor1"
      }
    ]
  },
  "requestApprovalSettings": {
    "isApprovalRequired": false,
    "isApprovalRequiredForExtension": false,
    "isRequestorJustificationRequired": false,
    "approvalMode": "NoApproval",
    "approvalStages": []
  }
}

手順 3: アクセスを要求する

この手順では、 Requestor1 ユーザーアカウントがアクセスパッケージ内のリソースへのアクセスを要求します。

アクセスパッケージ内のリソースへのアクセスを要求するには、次の値を指定する必要があります。

targetId プロパティの値に対して作成した Requestor1 ユーザーアカウントの ID
assignmentPolicyId プロパティの値の割り当てポリシーの ID
accessPackageId プロパティの値のアクセスパッケージの id

応答では、[ 承諾済み ] の状態と [ 送信済み] の状態を確認できます。後で要求の状態を取得するために返される id プロパティの値を記録します。

まだサインインしていない場合は、Microsoft Graph エクスプローラーで使用していた管理者アカウントからサインアウトします。作成した Requestor1 ユーザーアカウントにサインインします。初めてサインインする場合は、パスワードの変更を求められます。

要求

POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackageAssignmentRequests
Content-type: application/json

{
  "requestType": "UserAdd",
  "accessPackageAssignment":{
     "targetId":"007d1c7e-7fa8-4e33-b678-5e437acdcddc",
     "assignmentPolicyId":"db440482-1210-4a60-9b55-3ac7a72f63ba",
     "accessPackageId":"88203d16-0e31-41d4-87b2-dd402f1435e9"
  }
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new AccessPackageAssignmentRequest
{
	RequestType = "UserAdd",
	AccessPackageAssignment = new AccessPackageAssignment
	{
		TargetId = "007d1c7e-7fa8-4e33-b678-5e437acdcddc",
		AssignmentPolicyId = "db440482-1210-4a60-9b55-3ac7a72f63ba",
		AccessPackageId = "88203d16-0e31-41d4-87b2-dd402f1435e9",
	},
};
var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackageAssignmentRequests.PostAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const accessPackageAssignmentRequest = {
  requestType: 'UserAdd',
  accessPackageAssignment: {
     targetId: '007d1c7e-7fa8-4e33-b678-5e437acdcddc',
     assignmentPolicyId: 'db440482-1210-4a60-9b55-3ac7a72f63ba',
     accessPackageId: '88203d16-0e31-41d4-87b2-dd402f1435e9'
  }
};

await client.api('/identityGovernance/entitlementManagement/accessPackageAssignmentRequests')
	.version('beta')
	.post(accessPackageAssignmentRequest);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

AccessPackageAssignmentRequest accessPackageAssignmentRequest = new AccessPackageAssignmentRequest();
accessPackageAssignmentRequest.requestType = "UserAdd";
AccessPackageAssignment accessPackageAssignment = new AccessPackageAssignment();
accessPackageAssignment.targetId = "007d1c7e-7fa8-4e33-b678-5e437acdcddc";
accessPackageAssignment.assignmentPolicyId = "db440482-1210-4a60-9b55-3ac7a72f63ba";
accessPackageAssignment.accessPackageId = "88203d16-0e31-41d4-87b2-dd402f1435e9";
accessPackageAssignmentRequest.accessPackageAssignment = accessPackageAssignment;

graphClient.identityGovernance().entitlementManagement().accessPackageAssignmentRequests()
	.buildRequest()
	.post(accessPackageAssignmentRequest);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewAccessPackageAssignmentRequest()
requestType := "UserAdd"
requestBody.SetRequestType(&requestType) 
accessPackageAssignment := graphmodels.NewAccessPackageAssignment()
targetId := "007d1c7e-7fa8-4e33-b678-5e437acdcddc"
accessPackageAssignment.SetTargetId(&targetId) 
assignmentPolicyId := "db440482-1210-4a60-9b55-3ac7a72f63ba"
accessPackageAssignment.SetAssignmentPolicyId(&assignmentPolicyId) 
accessPackageId := "88203d16-0e31-41d4-87b2-dd402f1435e9"
accessPackageAssignment.SetAccessPackageId(&accessPackageId) 
requestBody.SetAccessPackageAssignment(accessPackageAssignment)

result, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackageAssignmentRequests().Post(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Identity.Governance

$params = @{
	RequestType = "UserAdd"
	AccessPackageAssignment = @{
		TargetId = "007d1c7e-7fa8-4e33-b678-5e437acdcddc"
		AssignmentPolicyId = "db440482-1210-4a60-9b55-3ac7a72f63ba"
		AccessPackageId = "88203d16-0e31-41d4-87b2-dd402f1435e9"
	}
}

New-MgEntitlementManagementAccessPackageAssignmentRequest -BodyParameter $params


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new AccessPackageAssignmentRequest();
$requestBody->setRequestType('UserAdd');

$accessPackageAssignment = new AccessPackageAssignment();
$accessPackageAssignment->setTargetId('007d1c7e-7fa8-4e33-b678-5e437acdcddc');

$accessPackageAssignment->setAssignmentPolicyId('db440482-1210-4a60-9b55-3ac7a72f63ba');

$accessPackageAssignment->setAccessPackageId('88203d16-0e31-41d4-87b2-dd402f1435e9');


$requestBody->setAccessPackageAssignment($accessPackageAssignment);


$requestResult = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackageAssignmentRequests()->post($requestBody);

応答

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#accessPackageAssignmentRequests/$entity",
    "createdDateTime": null,
    "completedDate": null,
    "id": "a6bb6942-3ae1-4259-9908-0133aaee9377",
    "requestType": "UserAdd",
    "requestState": "Submitted",
    "requestStatus": "Accepted",
    "isValidationOnly": false,
    "expirationDateTime": null,
    "justification": null
}

手順 4: アクセスが割り当てられていることを検証する

この手順では、 Requestor1 ユーザーアカウントにアクセスパッケージが割り当てられ、現在は マーケティングリソース グループのメンバーであることを確認します。

Requestor1 アカウントからサインアウトし、管理者アカウントにもう一度サインインして、要求の状態を確認します。

要求の状態を取得する

要求の id プロパティの値を使用して、要求の現在の状態を取得します。応答で、状態が [フルフィルメント済 み] に変更され、状態が [配信済み] に変更されたことを確認できます。

要求

GET https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackageAssignmentRequests/a6bb6942-3ae1-4259-9908-0133aaee9377


var graphClient = new GraphServiceClient(requestAdapter);

var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackageAssignmentRequests["{accessPackageAssignmentRequest-id}"].GetAsync();


const options = {
	authProvider,
};

const client = Client.init(options);

let accessPackageAssignmentRequest = await client.api('/identityGovernance/entitlementManagement/accessPackageAssignmentRequests/a6bb6942-3ae1-4259-9908-0133aaee9377')
	.version('beta')
	.get();


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

AccessPackageAssignmentRequest accessPackageAssignmentRequest = graphClient.identityGovernance().entitlementManagement().accessPackageAssignmentRequests("a6bb6942-3ae1-4259-9908-0133aaee9377")
	.buildRequest()
	.get();


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


result, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackageAssignmentRequestsById("accessPackageAssignmentRequest-id").Get(context.Background(), nil)


Import-Module Microsoft.Graph.Identity.Governance

Get-MgEntitlementManagementAccessPackageAssignmentRequest -AccessPackageAssignmentRequestId $accessPackageAssignmentRequestId


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);


$requestResult = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackageAssignmentRequestsById('accessPackageAssignmentRequest-id')->get();

応答

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#accessPackageAssignmentRequests/$entity",
  "createdDateTime": "2020-06-29T20:24:24.683Z",
  "completedDate": "2020-06-29T20:24:47.937Z",
  "id": "a6bb6942-3ae1-4259-9908-0133aaee9377",
  "requestType": "UserAdd",
  "requestState": "Delivered",
  "requestStatus": "FulfilledNotificationTriggered",
  "isValidationOnly": false,
  "expirationDateTime": null,
  "justification": null
}

アクセスパッケージの割り当てを取得する

また、作成したアクセスパッケージポリシーの ID を 使用して、 リソースが Requestor1 ユーザーアカウントに割り当てられていることを確認することもできます。

要求

GET https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackageAssignments?$filter=accessPackageAssignmentPolicy/Id eq 'db440482-1210-4a60-9b55-3ac7a72f63ba'&$expand=target,accessPackageAssignmentResourceRoles


var graphClient = new GraphServiceClient(requestAdapter);

var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackageAssignments.GetAsync((requestConfiguration) =>
{
	requestConfiguration.QueryParameters.Filter = "accessPackageAssignmentPolicy/Id eq 'db440482-1210-4a60-9b55-3ac7a72f63ba'";
	requestConfiguration.QueryParameters.Expand = new string []{ "target","accessPackageAssignmentResourceRoles" };
});


const options = {
	authProvider,
};

const client = Client.init(options);

let accessPackageAssignments = await client.api('/identityGovernance/entitlementManagement/accessPackageAssignments')
	.version('beta')
	.filter('accessPackageAssignmentPolicy/Id eq \'db440482-1210-4a60-9b55-3ac7a72f63ba\'')
	.expand('target,accessPackageAssignmentResourceRoles')
	.get();


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

AccessPackageAssignmentCollectionPage accessPackageAssignments = graphClient.identityGovernance().entitlementManagement().accessPackageAssignments()
	.buildRequest()
	.filter("accessPackageAssignmentPolicy/Id eq 'db440482-1210-4a60-9b55-3ac7a72f63ba'")
	.expand("target,accessPackageAssignmentResourceRoles")
	.get();


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


requestFilter := "accessPackageAssignmentPolicy/Id eq 'db440482-1210-4a60-9b55-3ac7a72f63ba'"

requestParameters := &graphconfig.IdentityGovernanceEntitlementManagementAccessPackageAssignmentsRequestBuilderGetQueryParameters{
	Filter: &requestFilter,
	Expand: [] string {"target","accessPackageAssignmentResourceRoles"},
}
configuration := &graphconfig.IdentityGovernanceEntitlementManagementAccessPackageAssignmentsRequestBuilderGetRequestConfiguration{
	QueryParameters: requestParameters,
}

result, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackageAssignments().Get(context.Background(), configuration)


Import-Module Microsoft.Graph.Identity.Governance

Get-MgEntitlementManagementAccessPackageAssignment -Filter "accessPackageAssignmentPolicy/Id eq 'db440482-1210-4a60-9b55-3ac7a72f63ba'" -ExpandProperty "target,accessPackageAssignmentResourceRoles"


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestConfiguration = new AccessPackageAssignmentsRequestBuilderGetRequestConfiguration();

$queryParameters = new AccessPackageAssignmentsRequestBuilderGetQueryParameters();
$queryParameters->filter = "accessPackageAssignmentPolicy/Id eq 'db440482-1210-4a60-9b55-3ac7a72f63ba'";
$queryParameters->expand = ["target","accessPackageAssignmentResourceRoles"];

$requestConfiguration->queryParameters = $queryParameters;


$requestResult = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackageAssignments()->get($requestConfiguration);

応答

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#accessPackageAssignments",
  "value": [
    {
      "id": "a6bb6942-3ae1-4259-9908-0133aaee9377",
      "catalogId": "cec5d6ab-c75d-47c0-9c1c-92e89f66e384",
      "accessPackageId": "88203d16-0e31-41d4-87b2-dd402f1435e9",
      "assignmentPolicyId": "db440482-1210-4a60-9b55-3ac7a72f63ba",
      "targetId": "2bc42425-6dc5-4f2a-9ebb-7a7464481eb0",
      "assignmentStatus": "Delivered",
      "assignmentState": "Delivered",
      "isExtended": false,
      "expiredDateTime": null,
      "target": {
         "id": "8586ddc8-0ff7-4c24-9c79-f192bc3566e3",
         "objectId": "2bc42425-6dc5-4f2a-9ebb-7a7464481eb0"
      },
      "accessPackageAssignmentResourceRoles": [
         {
            "id": "bdb7e0a0-a927-42ab-bf30-c5b5533dc54a",
            "originSystem": "AadGroup",
            "status": "Fulfilled"
         }
      ]
    }
  ]
}

グループのメンバーを取得する

要求が付与されたら、マーケティングリソース グループに記録した ID を使用して、Requestor1 ユーザーアカウントが追加されたことを確認できます。

要求

GET https://graph.microsoft.com/v1.0/groups/e93e24d1-2b65-4a6c-a1dd-654a12225487/members


var graphClient = new GraphServiceClient(requestAdapter);

var result = await graphClient.Groups["{group-id}"].Members.GetAsync();


const options = {
	authProvider,
};

const client = Client.init(options);

let members = await client.api('/groups/e93e24d1-2b65-4a6c-a1dd-654a12225487/members')
	.get();


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

DirectoryObjectCollectionWithReferencesPage members = graphClient.groups("e93e24d1-2b65-4a6c-a1dd-654a12225487").members()
	.buildRequest()
	.get();


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


result, err := graphClient.GroupsById("group-id").Members().Get(context.Background(), nil)


Import-Module Microsoft.Graph.Groups

Get-MgGroupMember -GroupId $groupId


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);


$requestResult = $graphServiceClient->groupsById('group-id')->members()->get();

応答:

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#directoryObjects",
  "value": [
    {
      "@odata.type": "#microsoft.graph.user",
      "id": "007d1c7e-7fa8-4e33-b678-5e437acdcddc",
      "deletedDateTime": null,
      "accountEnabled": true,
      "ageGroup": null,
      "businessPhones": [],
      "city": null,
      "createdDateTime": "2020-06-23T18:43:24Z",
      "creationType": null,
      "companyName": null,
      "consentProvidedForMinor": null,
      "country": null,
      "department": null,
      "displayName": "Requestor1",
      "employeeId": null,
      "faxNumber": null,
      "givenName": null,
      "imAddresses": [],
      "infoCatalogs": [],
      "isResourceAccount": null,
      "jobTitle": null,
      "legalAgeGroupClassification": null,
      "mail": null,
      "mailNickname": "Requestor1"
    }
  ]
}

手順 5: リソースをクリーンアップする

この手順では、行った変更を削除し、 Marketing Campaign アクセスパッケージを削除します。

アクセスパッケージの割り当てを削除する

アクセスパッケージを削除する前に、アクセスパッケージへの割り当てを削除する必要があります。以前に記録した割り当て要求の ID を使用して削除します。

要求

POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackageAssignmentRequests
Content-type: application/json

{
  "requestType": "AdminRemove",
  "accessPackageAssignment":{
     "id": "a6bb6942-3ae1-4259-9908-0133aaee9377"
  }
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new AccessPackageAssignmentRequest
{
	RequestType = "AdminRemove",
	AccessPackageAssignment = new AccessPackageAssignment
	{
		Id = "a6bb6942-3ae1-4259-9908-0133aaee9377",
	},
};
var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackageAssignmentRequests.PostAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const accessPackageAssignmentRequest = {
  requestType: 'AdminRemove',
  accessPackageAssignment: {
     id: 'a6bb6942-3ae1-4259-9908-0133aaee9377'
  }
};

await client.api('/identityGovernance/entitlementManagement/accessPackageAssignmentRequests')
	.version('beta')
	.post(accessPackageAssignmentRequest);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

AccessPackageAssignmentRequest accessPackageAssignmentRequest = new AccessPackageAssignmentRequest();
accessPackageAssignmentRequest.requestType = "AdminRemove";
AccessPackageAssignment accessPackageAssignment = new AccessPackageAssignment();
accessPackageAssignment.id = "a6bb6942-3ae1-4259-9908-0133aaee9377";
accessPackageAssignmentRequest.accessPackageAssignment = accessPackageAssignment;

graphClient.identityGovernance().entitlementManagement().accessPackageAssignmentRequests()
	.buildRequest()
	.post(accessPackageAssignmentRequest);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewAccessPackageAssignmentRequest()
requestType := "AdminRemove"
requestBody.SetRequestType(&requestType) 
accessPackageAssignment := graphmodels.NewAccessPackageAssignment()
id := "a6bb6942-3ae1-4259-9908-0133aaee9377"
accessPackageAssignment.SetId(&id) 
requestBody.SetAccessPackageAssignment(accessPackageAssignment)

result, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackageAssignmentRequests().Post(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Identity.Governance

$params = @{
	RequestType = "AdminRemove"
	AccessPackageAssignment = @{
		Id = "a6bb6942-3ae1-4259-9908-0133aaee9377"
	}
}

New-MgEntitlementManagementAccessPackageAssignmentRequest -BodyParameter $params


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new AccessPackageAssignmentRequest();
$requestBody->setRequestType('AdminRemove');

$accessPackageAssignment = new AccessPackageAssignment();
$accessPackageAssignment->setId('a6bb6942-3ae1-4259-9908-0133aaee9377');


$requestBody->setAccessPackageAssignment($accessPackageAssignment);


$requestResult = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackageAssignmentRequests()->post($requestBody);

応答

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#accessPackageAssignmentRequests/$entity",
    "createdDateTime": null,
    "completedDate": null,
    "id": "78eaee8c-e6cf-48c9-8f99-aae44c35e379",
    "requestType": "AdminRemove",
    "requestState": "Submitted",
    "requestStatus": "Accepted",
    "isValidationOnly": false,
    "expirationDateTime": null,
    "justification": null
}

アクセスパッケージの割り当てポリシーを削除する

以前に記録した割り当てポリシーの ID を使用して削除します。すべての割り当てが最初に削除されていることを確認します。

要求

DELETE https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackageAssignmentPolicies/6c1f65ec-8c25-4a45-83c2-a1de2a6d0e9f


var graphClient = new GraphServiceClient(requestAdapter);

await graphClient.IdentityGovernance.EntitlementManagement.AccessPackageAssignmentPolicies["{accessPackageAssignmentPolicy-id}"].DeleteAsync();


const options = {
	authProvider,
};

const client = Client.init(options);

await client.api('/identityGovernance/entitlementManagement/accessPackageAssignmentPolicies/6c1f65ec-8c25-4a45-83c2-a1de2a6d0e9f')
	.version('beta')
	.delete();


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

graphClient.identityGovernance().entitlementManagement().accessPackageAssignmentPolicies("6c1f65ec-8c25-4a45-83c2-a1de2a6d0e9f")
	.buildRequest()
	.delete();


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


graphClient.IdentityGovernance().EntitlementManagement().AccessPackageAssignmentPoliciesById("accessPackageAssignmentPolicy-id").Delete(context.Background(), nil)


Import-Module Microsoft.Graph.Identity.Governance

Remove-MgEntitlementManagementAccessPackageAssignmentPolicy -AccessPackageAssignmentPolicyId $accessPackageAssignmentPolicyId


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);


$graphServiceClient->identityGovernance()->entitlementManagement()->accessPackageAssignmentPoliciesById('accessPackageAssignmentPolicy-id')->delete();

応答

No Content - 204

アクセスパッケージを削除する

以前に記録したアクセスパッケージの ID を 使用して削除します。

要求

DELETE https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/cf54c6ca-d717-49bc-babe-d140d035dfdd


var graphClient = new GraphServiceClient(requestAdapter);

await graphClient.IdentityGovernance.EntitlementManagement.AccessPackages["{accessPackage-id}"].DeleteAsync();


const options = {
	authProvider,
};

const client = Client.init(options);

await client.api('/identityGovernance/entitlementManagement/accessPackages/cf54c6ca-d717-49bc-babe-d140d035dfdd')
	.version('beta')
	.delete();


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

graphClient.identityGovernance().entitlementManagement().accessPackages("cf54c6ca-d717-49bc-babe-d140d035dfdd")
	.buildRequest()
	.delete();


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


graphClient.IdentityGovernance().EntitlementManagement().AccessPackagesById("accessPackage-id").Delete(context.Background(), nil)


Import-Module Microsoft.Graph.Identity.Governance

Remove-MgEntitlementManagementAccessPackage -AccessPackageId $accessPackageId


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);


$graphServiceClient->identityGovernance()->entitlementManagement()->accessPackagesById('accessPackage-id')->delete();

応答

No Content - 204

ユーザーアカウントを削除する

Requestor1 ユーザーアカウントを削除します。

要求

DELETE https://graph.microsoft.com/v1.0/users/ce02eca8-752b-4ecf-ac29-aa9bccd87606


var graphClient = new GraphServiceClient(requestAdapter);

await graphClient.Users["{user-id}"].DeleteAsync();


const options = {
	authProvider,
};

const client = Client.init(options);

await client.api('/users/ce02eca8-752b-4ecf-ac29-aa9bccd87606')
	.delete();


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

graphClient.users("ce02eca8-752b-4ecf-ac29-aa9bccd87606")
	.buildRequest()
	.delete();


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


graphClient.UsersById("user-id").Delete(context.Background(), nil)


Import-Module Microsoft.Graph.Users

Remove-MgUser -UserId $userId


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);


$graphServiceClient->usersById('user-id')->delete();

応答

No Content - 204

グループのメンバーを追加または削除する

マーケティングリソース グループを削除します。

要求

DELETE https://graph.microsoft.com/v1.0/groups/a468eaea-ed6c-4290-98d2-a96bb1cb4209


var graphClient = new GraphServiceClient(requestAdapter);

await graphClient.Groups["{group-id}"].DeleteAsync();


const options = {
	authProvider,
};

const client = Client.init(options);

await client.api('/groups/a468eaea-ed6c-4290-98d2-a96bb1cb4209')
	.delete();


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

graphClient.groups("a468eaea-ed6c-4290-98d2-a96bb1cb4209")
	.buildRequest()
	.delete();


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)


graphClient.GroupsById("group-id").Delete(context.Background(), nil)


Import-Module Microsoft.Graph.Groups

Remove-MgGroup -GroupId $groupId


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);


$graphServiceClient->groupsById('group-id')->delete();

応答

No Content - 204

Microsoft Graph のエンタイトルメント管理 API を使用してリソースへのアクセスを管理する

前提条件

手順 1: ユーザー アカウントとグループを作成する

ユーザー アカウントを作成する

要求

応答

グループを作成する

要求

応答

手順 2: カタログにリソースを追加し、アクセス パッケージを作成する

カタログ識別子を取得する

要求

応答

カタログにグループを追加する

要求

応答

カタログ リソースを取得する

要求

応答

リソース ロールを取得する

要求

応答

アクセス パッケージを作成する

要求

応答

アクセス パッケージにリソース ロールを追加する

要求

応答

アクセス パッケージ ポリシーを作成する

要求

応答