Espacio de nombres: microsoft.graph
Importante
Las API de la versión /beta de Microsoft Graph están sujetas a cambios. No se admite el uso de estas API en aplicaciones de producción. Para determinar si una API está disponible en la versión 1.0, use el selector de Versión.
Cree un nuevo objeto unifiedRoleAssignment .
Esta API está disponible en las siguientes implementaciones nacionales de nube.
| Servicio global |
Gobierno de EE. UU. L4 |
Us Government L5 (DOD) |
China operada por 21Vianet |
| ✅ |
✅ |
✅ |
✅ |
Permisos
Se requiere uno de los siguientes permisos para llamar a esta API. Para obtener más información, incluido cómo elegir permisos, vea Permisos.
Para el proveedor de directorios (Microsoft Entra ID)
| Tipo de permiso |
Permisos (de menos a más privilegiados) |
| Delegado (cuenta profesional o educativa) |
RoleManagement.ReadWrite.Directory |
| Delegado (cuenta personal de Microsoft) |
No admitida. |
| Aplicación |
RoleManagement.ReadWrite.Directory |
Importante
En escenarios delegados con cuentas profesionales o educativas, al usuario que ha iniciado sesión se le debe asignar un rol de Microsoft Entra compatible o un rol personalizado con un permiso de rol admitido.
Privileged Role Administrator es el rol con privilegios mínimos admitido para esta operación.
Para el proveedor de administración de derechos
| Tipo de permiso |
Permisos (de menos a más privilegiados) |
| Delegado (cuenta profesional o educativa) |
EntitlementManagement.ReadWrite.All |
| Delegado (cuenta personal de Microsoft) |
No admitida. |
| Aplicación |
No admitida. |
Para un proveedor de Exchange Online
| Tipo de permiso |
Permisos (de menos a más privilegiados) |
| Delegado (cuenta profesional o educativa) |
RoleManagement.ReadWrite.Exchange |
| Delegado (cuenta personal de Microsoft) |
No admitida. |
| Aplicación |
RoleManagement.ReadWrite.Exchange |
Solicitud HTTP
Cree una asignación de roles para el proveedor de directorios:
POST /roleManagement/directory/roleAssignments
Cree una asignación de roles para el proveedor de administración de derechos:
POST /roleManagement/entitlementManagement/roleAssignments
Cree una asignación de roles para el proveedor de Exchange Online:
POST /roleManagement/exchange/roleAssignments
Cuerpo de la solicitud
En el cuerpo de la solicitud, proporcione una representación JSON de un objeto unifiedRoleAssignment .
Puede especificar las siguientes propiedades al crear un unifiedRoleAssignment.
| Propiedad |
Tipo |
Descripción |
| appScopeId |
Cadena |
Obligatorio. Identificador del ámbito específico de la aplicación cuando el ámbito de asignación es específico de la aplicación. El ámbito de una asignación determina el conjunto de recursos a los que se ha concedido acceso a la entidad de seguridad. Los ámbitos de aplicación son ámbitos definidos y entendidos solo por una aplicación de recursos.
Para el proveedor de administración de derechos, use esta propiedad para especificar un catálogo, por ejemplo /AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997.
Se deben especificar appScopeId o directoryScopeId . |
| directoryScopeId |
Cadena |
Obligatorio. Identificador del objeto de directorio que representa el ámbito de la asignación. El ámbito de una asignación determina el conjunto de recursos a los que se ha concedido acceso a la entidad de seguridad. Los ámbitos de directorio son ámbitos compartidos almacenados en el directorio que entienden varias aplicaciones, a diferencia de los ámbitos de aplicación definidos y entendidos solo por una aplicación de recursos.
Para el proveedor de directorios (Microsoft Entra ID), esta propiedad admite los siguientes formatos:
/ para el ámbito de todo el inquilino
/administrativeUnits/{administrativeunit-ID} para limitar a una unidad administrativa
/{application-objectID} para limitar a una aplicación de recursos
/attributeSets/{attributeSet-ID} para limitar a un conjunto de atributos
Para el proveedor de administración de derechos, / para el ámbito de todo el inquilino. Para establecer el ámbito de un catálogo de paquetes de acceso, use la propiedad appScopeId .
Para Exchange Online proveedor, esta propiedad admite los siguientes formatos:
/ para el ámbito de todo el inquilino
/Users/{ObjectId of user} para limitar la asignación de roles a un usuario específico
/AdministrativeUnits/{ObjectId of AU} para limitar la asignación de roles a una unidad administrativa
/Groups/{ObjectId of group} para limitar el assinmento del rol a los miembros directos de un grupo específico
Se deben especificar appScopeId o directoryScopeId . |
| principalId |
Cadena |
Obligatorio. Identificador de la entidad de seguridad a la que se concede la asignación. |
| roleDefinitionId |
Cadena |
Identificador de unifiedRoleDefinition para el que se realiza la asignación. Solo lectura. Admite $filter (eq, in). |
Respuesta
Si se ejecuta correctamente, este método devuelve un 201 Created código de respuesta y un nuevo objeto unifiedRoleAssignment en el cuerpo de la respuesta.
Ejemplos
Ejemplo 1: Creación de una asignación de roles con ámbito de inquilino
Solicitud
En el ejemplo siguiente se muestra la solicitud. Tenga en cuenta el uso del roleTemplateId para roleDefinitionId. roleDefinitionId puede ser el identificador de plantilla de todo el servicio o el roleDefinitionId específico del directorio.
POST https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments
Content-type: application/json
{
"@odata.type": "#microsoft.graph.unifiedRoleAssignment",
"roleDefinitionId": "c2cf284d-6c41-4e6b-afac-4b80928c9034",
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
"directoryScopeId": "/"
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new UnifiedRoleAssignment
{
OdataType = "#microsoft.graph.unifiedRoleAssignment",
RoleDefinitionId = "c2cf284d-6c41-4e6b-afac-4b80928c9034",
PrincipalId = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
DirectoryScopeId = "/",
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.Directory.RoleAssignments.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewUnifiedRoleAssignment()
roleDefinitionId := "c2cf284d-6c41-4e6b-afac-4b80928c9034"
requestBody.SetRoleDefinitionId(&roleDefinitionId)
principalId := "f8ca5a85-489a-49a0-b555-0a6d81e56f0d"
requestBody.SetPrincipalId(&principalId)
directoryScopeId := "/"
requestBody.SetDirectoryScopeId(&directoryScopeId)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().Directory().RoleAssignments().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignment unifiedRoleAssignment = new UnifiedRoleAssignment();
unifiedRoleAssignment.setOdataType("#microsoft.graph.unifiedRoleAssignment");
unifiedRoleAssignment.setRoleDefinitionId("c2cf284d-6c41-4e6b-afac-4b80928c9034");
unifiedRoleAssignment.setPrincipalId("f8ca5a85-489a-49a0-b555-0a6d81e56f0d");
unifiedRoleAssignment.setDirectoryScopeId("/");
UnifiedRoleAssignment result = graphClient.roleManagement().directory().roleAssignments().post(unifiedRoleAssignment);
const options = {
authProvider,
};
const client = Client.init(options);
const unifiedRoleAssignment = {
'@odata.type': '#microsoft.graph.unifiedRoleAssignment',
roleDefinitionId: 'c2cf284d-6c41-4e6b-afac-4b80928c9034',
principalId: 'f8ca5a85-489a-49a0-b555-0a6d81e56f0d',
directoryScopeId: '/'
};
await client.api('/roleManagement/directory/roleAssignments')
.version('beta')
.post(unifiedRoleAssignment);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\UnifiedRoleAssignment;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new UnifiedRoleAssignment();
$requestBody->setOdataType('#microsoft.graph.unifiedRoleAssignment');
$requestBody->setRoleDefinitionId('c2cf284d-6c41-4e6b-afac-4b80928c9034');
$requestBody->setPrincipalId('f8ca5a85-489a-49a0-b555-0a6d81e56f0d');
$requestBody->setDirectoryScopeId('/');
$result = $graphServiceClient->roleManagement()->directory()->roleAssignments()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
$params = @{
"@odata.type" = "#microsoft.graph.unifiedRoleAssignment"
roleDefinitionId = "c2cf284d-6c41-4e6b-afac-4b80928c9034"
principalId = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d"
directoryScopeId = "/"
}
New-MgBetaRoleManagementDirectoryRoleAssignment -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.unified_role_assignment import UnifiedRoleAssignment
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = UnifiedRoleAssignment(
odata_type = "#microsoft.graph.unifiedRoleAssignment",
role_definition_id = "c2cf284d-6c41-4e6b-afac-4b80928c9034",
principal_id = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
directory_scope_id = "/",
)
result = await graph_client.role_management.directory.role_assignments.post(request_body)
Respuesta
En el ejemplo siguiente se muestra la respuesta.
Nota: Se puede acortar el objeto de respuesta que se muestra aquí para mejorar la legibilidad.
HTTP/1.1 201 Created
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleAssignments/$entity",
"id": "YUb1sHQtUEyvox7IA_Eu_mm3jqnUe4lEhvatluHVi2I-1",
"roleDefinitionId": "c2cf284d-6c41-4e6b-afac-4b80928c9034",
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
"directoryScopeId": "/"
}
Ejemplo 2: Creación de una asignación de roles con ámbito de unidad administrativa
Solicitud
En el ejemplo siguiente se asigna el rol Administrador de usuarios a una entidad de seguridad con ámbito de unidad administrativa.
POST https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments
Content-type: application/json
{
"@odata.type": "#microsoft.graph.unifiedRoleAssignment",
"roleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1",
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
"directoryScopeId": "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a"
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new UnifiedRoleAssignment
{
OdataType = "#microsoft.graph.unifiedRoleAssignment",
RoleDefinitionId = "fe930be7-5e62-47db-91af-98c3a49a38b1",
PrincipalId = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
DirectoryScopeId = "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a",
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.Directory.RoleAssignments.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewUnifiedRoleAssignment()
roleDefinitionId := "fe930be7-5e62-47db-91af-98c3a49a38b1"
requestBody.SetRoleDefinitionId(&roleDefinitionId)
principalId := "f8ca5a85-489a-49a0-b555-0a6d81e56f0d"
requestBody.SetPrincipalId(&principalId)
directoryScopeId := "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a"
requestBody.SetDirectoryScopeId(&directoryScopeId)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().Directory().RoleAssignments().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignment unifiedRoleAssignment = new UnifiedRoleAssignment();
unifiedRoleAssignment.setOdataType("#microsoft.graph.unifiedRoleAssignment");
unifiedRoleAssignment.setRoleDefinitionId("fe930be7-5e62-47db-91af-98c3a49a38b1");
unifiedRoleAssignment.setPrincipalId("f8ca5a85-489a-49a0-b555-0a6d81e56f0d");
unifiedRoleAssignment.setDirectoryScopeId("/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a");
UnifiedRoleAssignment result = graphClient.roleManagement().directory().roleAssignments().post(unifiedRoleAssignment);
const options = {
authProvider,
};
const client = Client.init(options);
const unifiedRoleAssignment = {
'@odata.type': '#microsoft.graph.unifiedRoleAssignment',
roleDefinitionId: 'fe930be7-5e62-47db-91af-98c3a49a38b1',
principalId: 'f8ca5a85-489a-49a0-b555-0a6d81e56f0d',
directoryScopeId: '/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a'
};
await client.api('/roleManagement/directory/roleAssignments')
.version('beta')
.post(unifiedRoleAssignment);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\UnifiedRoleAssignment;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new UnifiedRoleAssignment();
$requestBody->setOdataType('#microsoft.graph.unifiedRoleAssignment');
$requestBody->setRoleDefinitionId('fe930be7-5e62-47db-91af-98c3a49a38b1');
$requestBody->setPrincipalId('f8ca5a85-489a-49a0-b555-0a6d81e56f0d');
$requestBody->setDirectoryScopeId('/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a');
$result = $graphServiceClient->roleManagement()->directory()->roleAssignments()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
$params = @{
"@odata.type" = "#microsoft.graph.unifiedRoleAssignment"
roleDefinitionId = "fe930be7-5e62-47db-91af-98c3a49a38b1"
principalId = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d"
directoryScopeId = "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a"
}
New-MgBetaRoleManagementDirectoryRoleAssignment -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.unified_role_assignment import UnifiedRoleAssignment
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = UnifiedRoleAssignment(
odata_type = "#microsoft.graph.unifiedRoleAssignment",
role_definition_id = "fe930be7-5e62-47db-91af-98c3a49a38b1",
principal_id = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
directory_scope_id = "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a",
)
result = await graph_client.role_management.directory.role_assignments.post(request_body)
Respuesta
En el ejemplo siguiente se muestra la respuesta.
Nota: Se puede acortar el objeto de respuesta que se muestra aquí para mejorar la legibilidad.
HTTP/1.1 201 Created
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleAssignments/$entity",
"id": "BH21sHQtUEyvox7IA_Eu_mm3jqnUe4lEhvatluHIWb7-1",
"roleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1",
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
"directoryScopeId": "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a"
}
Ejemplo 3: Creación de una asignación de roles con ámbito de conjunto de atributos
Solicitud
En el ejemplo siguiente se asigna el rol Administrador de asignación de atributos a una entidad de seguridad con un ámbito de conjunto de atributos denominado Ingeniería. Para obtener más información sobre Microsoft Entra atributos de seguridad personalizados y el ámbito del conjunto de atributos, consulte Administración del acceso a atributos de seguridad personalizados en Microsoft Entra ID.
POST https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments
Content-type: application/json
{
"@odata.type": "#microsoft.graph.unifiedRoleAssignment",
"roleDefinitionId": "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
"directoryScopeId": "/attributeSets/Engineering"
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new UnifiedRoleAssignment
{
OdataType = "#microsoft.graph.unifiedRoleAssignment",
RoleDefinitionId = "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",
PrincipalId = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
DirectoryScopeId = "/attributeSets/Engineering",
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.Directory.RoleAssignments.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewUnifiedRoleAssignment()
roleDefinitionId := "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d"
requestBody.SetRoleDefinitionId(&roleDefinitionId)
principalId := "f8ca5a85-489a-49a0-b555-0a6d81e56f0d"
requestBody.SetPrincipalId(&principalId)
directoryScopeId := "/attributeSets/Engineering"
requestBody.SetDirectoryScopeId(&directoryScopeId)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().Directory().RoleAssignments().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignment unifiedRoleAssignment = new UnifiedRoleAssignment();
unifiedRoleAssignment.setOdataType("#microsoft.graph.unifiedRoleAssignment");
unifiedRoleAssignment.setRoleDefinitionId("58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d");
unifiedRoleAssignment.setPrincipalId("f8ca5a85-489a-49a0-b555-0a6d81e56f0d");
unifiedRoleAssignment.setDirectoryScopeId("/attributeSets/Engineering");
UnifiedRoleAssignment result = graphClient.roleManagement().directory().roleAssignments().post(unifiedRoleAssignment);
const options = {
authProvider,
};
const client = Client.init(options);
const unifiedRoleAssignment = {
'@odata.type': '#microsoft.graph.unifiedRoleAssignment',
roleDefinitionId: '58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d',
principalId: 'f8ca5a85-489a-49a0-b555-0a6d81e56f0d',
directoryScopeId: '/attributeSets/Engineering'
};
await client.api('/roleManagement/directory/roleAssignments')
.version('beta')
.post(unifiedRoleAssignment);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\UnifiedRoleAssignment;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new UnifiedRoleAssignment();
$requestBody->setOdataType('#microsoft.graph.unifiedRoleAssignment');
$requestBody->setRoleDefinitionId('58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d');
$requestBody->setPrincipalId('f8ca5a85-489a-49a0-b555-0a6d81e56f0d');
$requestBody->setDirectoryScopeId('/attributeSets/Engineering');
$result = $graphServiceClient->roleManagement()->directory()->roleAssignments()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
$params = @{
"@odata.type" = "#microsoft.graph.unifiedRoleAssignment"
roleDefinitionId = "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d"
principalId = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d"
directoryScopeId = "/attributeSets/Engineering"
}
New-MgBetaRoleManagementDirectoryRoleAssignment -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.unified_role_assignment import UnifiedRoleAssignment
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = UnifiedRoleAssignment(
odata_type = "#microsoft.graph.unifiedRoleAssignment",
role_definition_id = "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",
principal_id = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
directory_scope_id = "/attributeSets/Engineering",
)
result = await graph_client.role_management.directory.role_assignments.post(request_body)
Respuesta
En el ejemplo siguiente se muestra la respuesta.
Nota: Se puede acortar el objeto de respuesta que se muestra aquí para mejorar la legibilidad.
HTTP/1.1 201 Created
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleAssignments/$entity",
"id": "oz6hWDLGrkae4JwNQ81_PU-mYqx8m71OpqEQPdN1u",
"roleDefinitionId": "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
"directoryScopeId": "/attributeSets/Engineering"
}
Ejemplo 4: Creación de una asignación de roles con ámbito de catálogo de paquetes de acceso
Solicitud
En el ejemplo siguiente se muestra la solicitud.
POST https://graph.microsoft.com/beta/roleManagement/entitlementManagement/roleAssignments
Content-type: application/json
{
"principalId": "679a9213-c497-48a4-830a-8d3d25d94ddc",
"roleDefinitionId": "ae79f266-94d4-4dab-b730-feca7e132178",
"appScopeId": "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997"
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new UnifiedRoleAssignment
{
PrincipalId = "679a9213-c497-48a4-830a-8d3d25d94ddc",
RoleDefinitionId = "ae79f266-94d4-4dab-b730-feca7e132178",
AppScopeId = "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997",
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.EntitlementManagement.RoleAssignments.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewUnifiedRoleAssignment()
principalId := "679a9213-c497-48a4-830a-8d3d25d94ddc"
requestBody.SetPrincipalId(&principalId)
roleDefinitionId := "ae79f266-94d4-4dab-b730-feca7e132178"
requestBody.SetRoleDefinitionId(&roleDefinitionId)
appScopeId := "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997"
requestBody.SetAppScopeId(&appScopeId)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().EntitlementManagement().RoleAssignments().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignment unifiedRoleAssignment = new UnifiedRoleAssignment();
unifiedRoleAssignment.setPrincipalId("679a9213-c497-48a4-830a-8d3d25d94ddc");
unifiedRoleAssignment.setRoleDefinitionId("ae79f266-94d4-4dab-b730-feca7e132178");
unifiedRoleAssignment.setAppScopeId("/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997");
UnifiedRoleAssignment result = graphClient.roleManagement().entitlementManagement().roleAssignments().post(unifiedRoleAssignment);
const options = {
authProvider,
};
const client = Client.init(options);
const unifiedRoleAssignment = {
principalId: '679a9213-c497-48a4-830a-8d3d25d94ddc',
roleDefinitionId: 'ae79f266-94d4-4dab-b730-feca7e132178',
appScopeId: '/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997'
};
await client.api('/roleManagement/entitlementManagement/roleAssignments')
.version('beta')
.post(unifiedRoleAssignment);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\UnifiedRoleAssignment;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new UnifiedRoleAssignment();
$requestBody->setPrincipalId('679a9213-c497-48a4-830a-8d3d25d94ddc');
$requestBody->setRoleDefinitionId('ae79f266-94d4-4dab-b730-feca7e132178');
$requestBody->setAppScopeId('/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997');
$result = $graphServiceClient->roleManagement()->entitlementManagement()->roleAssignments()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
$params = @{
principalId = "679a9213-c497-48a4-830a-8d3d25d94ddc"
roleDefinitionId = "ae79f266-94d4-4dab-b730-feca7e132178"
appScopeId = "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997"
}
New-MgBetaRoleManagementEntitlementManagementRoleAssignment -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.unified_role_assignment import UnifiedRoleAssignment
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = UnifiedRoleAssignment(
principal_id = "679a9213-c497-48a4-830a-8d3d25d94ddc",
role_definition_id = "ae79f266-94d4-4dab-b730-feca7e132178",
app_scope_id = "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997",
)
result = await graph_client.role_management.entitlement_management.role_assignments.post(request_body)
Respuesta
En el ejemplo siguiente se muestra la respuesta.
Nota: Se puede acortar el objeto de respuesta que se muestra aquí para mejorar la legibilidad.
HTTP/1.1 201 Created
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/entitlementManagement/roleAssignments/$entity",
"id": "f3092518-7874-462e-93e9-0cd6c11ffc52",
"principalId": "679a9213-c497-48a4-830a-8d3d25d94ddc",
"roleDefinitionId": "ae79f266-94d4-4dab-b730-feca7e132178",
"appScopeId": "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997"
}
Ejemplo 5: Creación de una asignación de roles para Exchange Online proveedor con ámbito de unidad administrativa
Solicitud
En el ejemplo siguiente se muestra la solicitud.
POST https://graph.microsoft.com/beta/roleManagement/exchange/roleAssignments
Content-type: application/json
{
"principalId": "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece",
"roleDefinitionId": "f66ab1ee-3cac-4d03-8a64-dadc56e563f8",
"directoryScopeId": "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb",
"appScopeId": null
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new UnifiedRoleAssignment
{
PrincipalId = "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece",
RoleDefinitionId = "f66ab1ee-3cac-4d03-8a64-dadc56e563f8",
DirectoryScopeId = "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb",
AppScopeId = null,
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.Exchange.RoleAssignments.PostAsync(requestBody);
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewUnifiedRoleAssignment()
principalId := "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece"
requestBody.SetPrincipalId(&principalId)
roleDefinitionId := "f66ab1ee-3cac-4d03-8a64-dadc56e563f8"
requestBody.SetRoleDefinitionId(&roleDefinitionId)
directoryScopeId := "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb"
requestBody.SetDirectoryScopeId(&directoryScopeId)
appScopeId := null
requestBody.SetAppScopeId(&appScopeId)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().Exchange().RoleAssignments().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignment unifiedRoleAssignment = new UnifiedRoleAssignment();
unifiedRoleAssignment.setPrincipalId("/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece");
unifiedRoleAssignment.setRoleDefinitionId("f66ab1ee-3cac-4d03-8a64-dadc56e563f8");
unifiedRoleAssignment.setDirectoryScopeId("/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb");
unifiedRoleAssignment.setAppScopeId(null);
UnifiedRoleAssignment result = graphClient.roleManagement().exchange().roleAssignments().post(unifiedRoleAssignment);
const options = {
authProvider,
};
const client = Client.init(options);
const unifiedRoleAssignment = {
principalId: '/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece',
roleDefinitionId: 'f66ab1ee-3cac-4d03-8a64-dadc56e563f8',
directoryScopeId: '/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb',
appScopeId: null
};
await client.api('/roleManagement/exchange/roleAssignments')
.version('beta')
.post(unifiedRoleAssignment);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\UnifiedRoleAssignment;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new UnifiedRoleAssignment();
$requestBody->setPrincipalId('/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece');
$requestBody->setRoleDefinitionId('f66ab1ee-3cac-4d03-8a64-dadc56e563f8');
$requestBody->setDirectoryScopeId('/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb');
$requestBody->setAppScopeId(null);
$result = $graphServiceClient->roleManagement()->exchange()->roleAssignments()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.DeviceManagement.Enrollment
$params = @{
principalId = "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece"
roleDefinitionId = "f66ab1ee-3cac-4d03-8a64-dadc56e563f8"
directoryScopeId = "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb"
appScopeId = $null
}
New-MgBetaRoleManagementExchangeRoleAssignment -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.unified_role_assignment import UnifiedRoleAssignment
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = UnifiedRoleAssignment(
principal_id = "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece",
role_definition_id = "f66ab1ee-3cac-4d03-8a64-dadc56e563f8",
directory_scope_id = "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb",
app_scope_id = None,
)
result = await graph_client.role_management.exchange.role_assignments.post(request_body)
Respuesta
En el ejemplo siguiente se muestra la respuesta.
HTTP/1.1 201 Created
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/exchange/roleAssignments/$entity",
"id": "c5dd3ab8-374f-42e9-b163-eb7c54b53755",
"principalId": "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece",
"roleDefinitionId": "f66ab1ee-3cac-4d03-8a64-dadc56e563f8",
"directoryScopeId": "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb",
"appScopeId": null
}