편집

다음을 통해 공유


Create delegatedAdminRelationship

Namespace: microsoft.graph

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Create a new delegatedAdminRelationship object.

This API is available in the following national cloud deployments.

Global service US Government L4 US Government L5 (DOD) China operated by 21Vianet

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

Permission type Least privileged permissions Higher privileged permissions
Delegated (work or school account) DelegatedAdminRelationship.ReadWrite.All Not available.
Delegated (personal Microsoft account) Not supported. Not supported.
Application DelegatedAdminRelationship.ReadWrite.All Not available.

To call this API using application permissions, you must provision the service principal identified by appId 2832473f-ec63-45fb-976f-5d45a7d4bb91 and named Partner Customer Delegated Administration in the partner tenant. To provision the service principal in the partner tenant, call the Create servicePrincipal API.

HTTP request

POST /tenantRelationships/delegatedAdminRelationships

Request headers

Name Description
Authorization Bearer {token}. Required. Learn more about authentication and authorization.
Content-Type application/json. Required.

Request body

In the request body, supply a JSON representation of the delegatedAdminRelationship object.

You can specify the following properties when creating a delegatedAdminRelationship.

Property Type Description
accessDetails delegatedAdminAccessDetails The identifiers of the administrative roles that the partner requests or has access to in the customer tenant. Required.
autoExtendDuration Duration The duration by which the validity of the relationship is automatically extended, denoted in ISO 8601 format. Supported values are: P0D, PT0S, P180D. The default value is PT0S. PT0S indicates that the relationship expires when the endDateTime is reached and it isn't automatically extended. Optional.
customer delegatedAdminRelationshipCustomerParticipant The display name and unique identifier of the customer of the relationship. Optional.
displayName String The display name of the relationship used for ease of identification. Must be unique across all delegated admin relationships of the partner. Required. Maximum length is 50 characters.
duration Duration The duration of the relationship in ISO 8601 format. Must be a value between P1D and P2Y inclusive. Required.

Response

If successful, this method returns a 201 Created response code and a delegatedAdminRelationship object in the response body.

The response contains a Location header which contains a URL to the created delegated admin relationship. Each delegatedAdminRelationship object contains an @odata.etag property as per RFC2616.

Examples

Request

POST https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships
Content-Type: application/json

{
  "displayName": "Contoso admin relationship",
  "duration": "P730D",
  "customer": {
    "tenantId": "4b827261-d21f-4aa9-b7db-7fa1f56fb163",
    "displayName": "Contoso subsidiary Inc"
  },
  "accessDetails": {
    "unifiedRoles": [
      {
        "roleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de"
      },
      {
        "roleDefinitionId": "3a2c62db-5318-420d-8d74-23affee5d9d5"
      }
    ]
  },
  "autoExtendDuration": "P180D"
}

Response

Note: The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-Type: application/json
Location: https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships/5d027261-d21f-4aa9-b7db-7fa1f56fb163-8777b240-c6f0-4469-9e98-a3205431b836

{
  "@odata.type": "#microsoft.graph.delegatedAdminRelationship",
  "@odata.context": "https://graph.microsoft.com/beta/tenantRelationships/$metadata#delegatedAdminRelationships",
  "@odata.etag": "W/\"JyIxODAwZTY4My0wMDAwLTAyMDAtMDAwMC02MTU0OWFmMDAwMDAiJw==\"",
  "id": "5d027261-d21f-4aa9-b7db-7fa1f56fb163-8777b240-c6f0-4469-9e98-a3205431b836",
  "displayName": "Contoso admin relationship",
  "duration": "P730D",
  "customer": {
    "tenantId": "4b827261-d21f-4aa9-b7db-7fa1f56fb163",
    "displayName": "Contoso subsidiary Inc"
  },
  "accessDetails": {
    "unifiedRoles": [
      {
        "roleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de"
      },
      {
        "roleDefinitionId": "3a2c62db-5318-420d-8d74-23affee5d9d5"
      }
    ]
  },
  "status": "created",
  "autoExtendDuration": "P180D",
  "createdDateTime": "2022-02-10T11:24:42.3148266Z",
  "lastModifiedDateTime": "2022-02-10T11:24:42.3148266Z",
  "activatedDateTime": "",
  "endDateTime": "2024-02-10T11:24:42.3148266Z"
}