Vadnica: Dodeljevanje vlog glavnim uporabnikom storitve (predogled)

[Ta članek je del predizdajne dokumentacije in se lahko spremeni.]

Skrbniki lahko z nadzorom dostopa na osnovi vlog (RBAC) v platformi Power Platform dodelijo vgrajene vloge uporabnikom, skupinam in glavnim upraviteljem storitev v najemniku, skupini okolja ali obsegu okolja. V tej vadnici je opisan pogost scenarij avtomatizacije: dodeljevanje vloge sodelavca glavnemu imenu storitve v obsegu najemnika z uporabo API-ja za pooblastitev.

Če želite izvedeti več o konceptih RBAC, vgrajenih vlogah in dedovanju obsega, glejte Nadzor dostopa, ki temelji na vlogah, za skrbniško središče platforme Power Platform.

Pomembno

• To je funkcija predogleda.
• Predogledne različice funkcij niso za komercialno uporabo in njihovo delovanje je lahko omejeno. Za te funkcije veljajo dodatni pogoji uporabe in so na voljo pred uradno izdajo, da lahko stranke dostopajo do njih prej in podajo povratne informacije. ...

V tej vadnici se boste naučili:

• Preverjanje pristnosti z API-jem platforme Power Platform.
• Navedite definicije vlog, ki so na voljo.
• Ustvarite dodelitev vloge za glavno ime storitve v obsegu najemnika.
• Preverite dodelitev vloge.

Zahteve

• Registracija aplikacije Microsoft Entra, konfigurirana za API platforme Power Platform, s potrdilom ali skrivnostjo odjemalca za glavno preverjanje pristnosti storitve. Za navodila glejte Preverjanje pristnosti.
• ID predmeta programa podjetja za glavno ime storitve (najden v programih Microsoft Entra ID>Enterprise).
• Identiteta klicanja mora imeti vlogo skrbnika platforme Power Platform ali skrbnika za nadzor dostopa na osnovi vloge platforme Power Platform .

Vgrajene definicije vlog

Power Platform zagotavlja štiri vgrajene vloge, ki jih je mogoče dodeliti prek storitve RBAC. Vsaka vloga ima nespremenljiv nabor dovoljenj in jo je mogoče dodeliti najemniku, skupini okolja ali obsegu okolja.

Ime vloge	ID vloge	Dovoljenja
Lastnik Power Platform	0cb07c69-1631-4725-ab35-e59e001c51ea	Vsa dovoljenja
Prispevalec Power Platform	ff954d61-a89a-4fbe-ace9-01c367b89f87	Upravljanje in branje vseh virov, ne morete pa dodeliti vloge ali jih spreminjati
Bralnik Power Platform	c886ad2e-27f7-4874-8381-5849b8d8a090	Dostop samo za branje do vseh virov
Administrator dostopa na osnovi vlog Power Platform	95e94555-018c-447b-8691-bdac8e12211e	Branje vseh virov + upravljanje dodelitev vlog

1. korak Seznam razpoložljivih definicij vlog

Najprej preverite pristnost in pridobite razpoložljive definicije vlog za potrditev ID-ja vloge sodelavke.

PowerShell

# Install the Az.Accounts module if not already installed
Install-Module -Name Az.Accounts

# Set your tenant ID
$TenantId = "YOUR_TENANT_ID"

# Authenticate and obtain an access token
Connect-AzAccount
$secureToken = (Get-AzAccessToken -TenantId $TenantId -ResourceUrl "https://api.powerplatform.com/").Token
$AccessToken = [System.Net.NetworkCredential]::new("", $secureToken).Password

$headers = @{ 'Authorization' = 'Bearer ' + $AccessToken }
$headers.Add('Content-Type', 'application/json')

# List all role definitions
$roleDefinitions = Invoke-RestMethod -Method Get -Uri "https://api.powerplatform.com/authorization/roleDefinitions?api-version=2024-10-01" -Headers $headers

$roleDefinitions.value | Format-Table roleDefinitionName, roleDefinitionId

Pričakovan rezultat:

roleDefinitionName                                          roleDefinitionId
------------------                                          ----------------
Power Platform owner                                        0cb07c69-1631-4725-ab35-e59e001c51ea
Power Platform contributor                                  ff954d61-a89a-4fbe-ace9-01c367b89f87
Power Platform reader                                       c886ad2e-27f7-4874-8381-5849b8d8a090
Power Platform role-based access control administrator      95e94555-018c-447b-8691-bdac8e12211e

C#

using Microsoft.PowerPlatform.Management;
using Microsoft.PowerPlatform.Management.Models;

var client = ServiceClientFactory.Create(clientId);

// List all role definitions
var roleDefinitions = await client.Authorization.RoleDefinitions.GetAsync();

foreach (var role in roleDefinitions.Value)
{
    Console.WriteLine($"{role.RoleDefinitionName}: {role.RoleDefinitionId}");
}

Pričakovan rezultat:

Power Platform owner: 0cb07c69-1631-4725-ab35-e59e001c51ea
Power Platform contributor: ff954d61-a89a-4fbe-ace9-01c367b89f87
Power Platform reader: c886ad2e-27f7-4874-8381-5849b8d8a090
Power Platform role-based access control administrator: 95e94555-018c-447b-8691-bdac8e12211e

Python

import asyncio
from azure.identity import InteractiveBrowserCredential
from kiota_authentication_azure.azure_identity_authentication_provider import AzureIdentityAuthenticationProvider
from kiota_http.httpx_request_adapter import HttpxRequestAdapter
from mspp_management.service_client_base import ServiceClientBase

credential = InteractiveBrowserCredential()
auth_provider = AzureIdentityAuthenticationProvider(
    credential,
    scopes=["https://api.powerplatform.com/.default"]
)
adapter = HttpxRequestAdapter(auth_provider)
adapter.base_url = "https://api.powerplatform.com"
client = ServiceClientBase(adapter)

# List all role definitions
role_definitions = await client.authorization.role_definitions.get()

for role in role_definitions.value:
    print(f"{role.role_definition_name}: {role.role_definition_id}")

Pričakovan rezultat:

Power Platform owner: 0cb07c69-1631-4725-ab35-e59e001c51ea
Power Platform contributor: ff954d61-a89a-4fbe-ace9-01c367b89f87
Power Platform reader: c886ad2e-27f7-4874-8381-5849b8d8a090
Power Platform role-based access control administrator: 95e94555-018c-447b-8691-bdac8e12211e

Sklic na API platforme Power Platform: Role-Based nadzor dostopa – definicije vloge seznama

2. korak. Dodeljevanje vloge sodelavca glavnemu imenu storitve

Ustvarite dodelitev vloge, ki dodeli vlogo sodelavca platforme Power Platform glavnemu imenu storitve v obsegu najemnika. Zamenjajte YOUR_TENANT_ID z GUID-jem najemnika YOUR_ENTERPRISE_APP_OBJECT_ID in ID-jem predmeta programa podjetja iz id-ja Microsoft Entra ID.

PowerShell

$TenantId = "YOUR_TENANT_ID"
$EnterpriseAppObjectId = "YOUR_ENTERPRISE_APP_OBJECT_ID"

$body = @{
    roleDefinitionId = "ff954d61-a89a-4fbe-ace9-01c367b89f87"
    principalObjectId = $EnterpriseAppObjectId
    principalType = "ApplicationUser"
    scope = "/tenants/$TenantId"
} | ConvertTo-Json

$roleAssignment = Invoke-RestMethod -Method Post -Uri "https://api.powerplatform.com/authorization/roleAssignments?api-version=2024-10-01" -Headers $headers -Body $body

$roleAssignment

Pričakovan rezultat:

roleAssignmentId   : a1b2c3d4-e5f6-7890-abcd-ef1234567890
principalObjectId  : <your-enterprise-app-object-id>
roleDefinitionId   : ff954d61-a89a-4fbe-ace9-01c367b89f87
scope              : /tenants/<your-tenant-id>
principalType      : ApplicationUser
createdOn          : 2026-03-02T12:00:00.0000000+00:00

C#

var request = new RoleAssignmentRequest
{
    RoleDefinitionId = "ff954d61-a89a-4fbe-ace9-01c367b89f87",
    PrincipalObjectId = "YOUR_ENTERPRISE_APP_OBJECT_ID",
    PrincipalType = "ApplicationUser",
    Scope = "/tenants/YOUR_TENANT_ID"
};

var roleAssignment = await client.Authorization.RoleAssignments.PostAsync(request);

Console.WriteLine($"Assignment ID: {roleAssignment.Value[0].RoleAssignmentId}");
Console.WriteLine($"Scope: {roleAssignment.Value[0].Scope}");
Console.WriteLine($"Principal: {roleAssignment.Value[0].PrincipalObjectId}");

Python

from mspp_management.models.role_assignment_request import RoleAssignmentRequest

request = RoleAssignmentRequest(
    role_definition_id="ff954d61-a89a-4fbe-ace9-01c367b89f87",
    principal_object_id="YOUR_ENTERPRISE_APP_OBJECT_ID",
    principal_type="ApplicationUser",
    scope="/tenants/YOUR_TENANT_ID",
)

role_assignment = await client.authorization.role_assignments.post(request)

print(f"Assignment ID: {role_assignment.value[0].role_assignment_id}")
print(f"Scope: {role_assignment.value[0].scope}")
print(f"Principal: {role_assignment.value[0].principal_object_id}")

Sklic na API platforme Power Platform: Role-Based nadzor dostopa – Ustvarjanje dodelitve vloge

3. korak. Preverjanje dodelitve vloge

Pridobite vse dodelitve vlog, da potrdite, da nova dodelitev obstaja.

PowerShell

$roleAssignments = Invoke-RestMethod -Method Get -Uri "https://api.powerplatform.com/authorization/roleAssignments?api-version=2024-10-01" -Headers $headers

# Filter for the service principal's assignments
$roleAssignments.value | Where-Object { $_.principalObjectId -eq $EnterpriseAppObjectId } | Format-Table roleAssignmentId, roleDefinitionId, scope, principalType

Pričakovan rezultat:

roleAssignmentId                        roleDefinitionId                        scope                          principalType
----------------                        ----------------                        -----                          -------------
a1b2c3d4-e5f6-7890-abcd-ef1234567890    ff954d61-a89a-4fbe-ace9-01c367b89f87    /tenants/<your-tenant-id>      ApplicationUser

C#

var roleAssignments = await client.Authorization.RoleAssignments.GetAsync();

var myAssignments = roleAssignments.Value
    .Where(a => a.PrincipalObjectId == "YOUR_ENTERPRISE_APP_OBJECT_ID");

foreach (var assignment in myAssignments)
{
    Console.WriteLine($"ID: {assignment.RoleAssignmentId}");
    Console.WriteLine($"Role: {assignment.RoleDefinitionId}");
    Console.WriteLine($"Scope: {assignment.Scope}");
    Console.WriteLine($"Type: {assignment.PrincipalType}");
}

Python

role_assignments = await client.authorization.role_assignments.get()

my_assignments = [
    a for a in role_assignments.value
    if a.principal_object_id == "YOUR_ENTERPRISE_APP_OBJECT_ID"
]

for assignment in my_assignments:
    print(f"ID: {assignment.role_assignment_id}")
    print(f"Role: {assignment.role_definition_id}")
    print(f"Scope: {assignment.scope}")
    print(f"Type: {assignment.principal_type}")

Sklic na API platforme Power Platform: nadzor dostopa, ki temelji na vlogi – dodelitve vloge seznama

Sorodna vsebina

• Nadzor dostopa, ki temelji na vlogah, za skrbniško središče platforme Power Platform
• Sklic dovoljenja
• Preverjanje pristnosti – ustvarite svojo prvo registracijo aplikacije