Создание resourceRoleScope

Статья
11/22/2024

Пространство имен: microsoft.graph

Создайте accessPackageResourceRoleScope для добавления роли ресурса в пакет доступа. Ресурс пакета доступа для группы, приложения или сайта SharePoint Online уже должен существовать в каталоге пакетов для доступа, а идентификатор originId для роли ресурса, полученный из списка ролей ресурсов. После добавления роли ресурса область в пакет доступа пользователь получит эту роль ресурса через любые текущие и будущие назначения пакетов доступа.

Этот API доступен в следующих национальных облачных развертываниях.

Глобальная служба	Правительство США L4	Правительство США L5 (DOD)	Китай управляется 21Vianet
✅	✅	✅	✅

Разрешения

Выберите разрешение или разрешения, помеченные как наименее привилегированные для этого API. Используйте более привилегированное разрешение или разрешения только в том случае, если это требуется приложению. Дополнительные сведения о делегированных разрешениях и разрешениях приложений см. в разделе Типы разрешений. Дополнительные сведения об этих разрешениях см. в справочнике по разрешениям.

Тип разрешения	Разрешения с наименьшими привилегиями	Более высокие привилегированные разрешения
Делегированные (рабочая или учебная учетная запись)	EntitlementManagement.ReadWrite.All	Недоступно.
Делегированные (личная учетная запись Майкрософт)	Не поддерживается.	Не поддерживается.
Приложение	EntitlementManagement.ReadWrite.All	Недоступно.

Совет

В делегированных сценариях с рабочими или учебными учетными записями вошедшему пользователю также должна быть назначена роль администратора с поддерживаемыми разрешениями роли с помощью одного из следующих параметров:

Роль в системе управления правами, где наименее привилегированные роли:
- Доступ к диспетчеру пакетов. Это наименее привилегированный вариант
- Владелец каталога
Дополнительные привилегированные Microsoft Entra роли, поддерживаемые для этой операции:
- Администратор управления удостоверениями

В сценариях только для приложений вызывающему приложению можно назначить одну из предыдущих поддерживаемых ролей вместо EntitlementManagement.ReadWrite.All разрешения приложения. Роль диспетчера пакетов Access имеет меньшие привилегии, чем EntitlementManagement.ReadWrite.All разрешение приложения.

Дополнительные сведения см. в разделе Делегирование и роли в управлении правами и как делегировать управление доступом диспетчерам пакетов в управлении правами.

HTTP-запрос

POST /identityGovernance/entitlementManagement/accessPackages/{id}/resourceRoleScopes

Заголовки запросов

Имя	Описание
Авторизация	Bearer {token}. Обязательно. Дополнительные сведения о проверке подлинности и авторизации.
Content-Type	application/json. Обязательно.

Текст запроса

В тексте запроса укажите представление объекта accessPackageResourceRoleScope в формате JSON. Включите в объект связи с объектом accessPackageResourceRole и объектом accessPackageResourceScope , которые можно получить из запроса на получение списка ресурсов пакета для доступа к каталогу с $expand=roles,scopesпомощью .

Отклик

В случае успешного выполнения этот метод возвращает код отклика серии 200 и новый объект accessPackageResourceRoleScope в тексте ответа.

Примеры

Пример 1. Добавление роли сайта SharePoint Online в пакет доступа

Запрос

В следующем примере показан запрос на добавление роли сайта SharePoint Online в список ролей ресурсов пакета для доступа. Ресурс пакета доступа для сайта уже должен быть добавлен в каталог пакетов для доступа, содержащий этот пакет доступа.

Запрос содержит объект accessPackageResourceRole . Каждый тип ресурса определяет формат поля originId в роли ресурса. Для сайта SharePoint Online originId будет порядковый номер роли на сайте. Роль ресурса можно получить из запроса на получение ролей ресурса для семейства веб-сайтов SharePoint Online.

POST https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/accessPackages/{id}/resourceRoleScopes
Content-type: application/json

{
    "role": {
        "displayName": "Contributors",
        "originSystem": "SharePointOnline",
        "originId": "4",
        "resource": {
            "id": "53c71803-a0a8-4777-aecc-075de8ee3991"
        }
    },
    "scope": {
        "displayName": "Root",
        "description": "Root Scope",
        "originId": "https://contoso.sharepoint.com/portals/Community",
        "originSystem": "SharePointOnline",
        "isRootScope": true
    }
}


// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Models;

var requestBody = new AccessPackageResourceRoleScope
{
	Role = new AccessPackageResourceRole
	{
		DisplayName = "Contributors",
		OriginSystem = "SharePointOnline",
		OriginId = "4",
		Resource = new AccessPackageResource
		{
			Id = "53c71803-a0a8-4777-aecc-075de8ee3991",
		},
	},
	Scope = new AccessPackageResourceScope
	{
		DisplayName = "Root",
		Description = "Root Scope",
		OriginId = "https://contoso.sharepoint.com/portals/Community",
		OriginSystem = "SharePointOnline",
		IsRootScope = true,
	},
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackages["{accessPackage-id}"].ResourceRoleScopes.PostAsync(requestBody);



mgc identity-governance entitlement-management access-packages resource-role-scopes create --access-package-id {accessPackage-id} --body '{\
    "role": {\
        "displayName": "Contributors",\
        "originSystem": "SharePointOnline",\
        "originId": "4",\
        "resource": {\
            "id": "53c71803-a0a8-4777-aecc-075de8ee3991"\
        }\
    },\
    "scope": {\
        "displayName": "Root",\
        "description": "Root Scope",\
        "originId": "https://contoso.sharepoint.com/portals/Community",\
        "originSystem": "SharePointOnline",\
        "isRootScope": true\
    }\
}\
'



// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

requestBody := graphmodels.NewAccessPackageResourceRoleScope()
role := graphmodels.NewAccessPackageResourceRole()
displayName := "Contributors"
role.SetDisplayName(&displayName) 
originSystem := "SharePointOnline"
role.SetOriginSystem(&originSystem) 
originId := "4"
role.SetOriginId(&originId) 
resource := graphmodels.NewAccessPackageResource()
id := "53c71803-a0a8-4777-aecc-075de8ee3991"
resource.SetId(&id) 
role.SetResource(resource)
requestBody.SetRole(role)
scope := graphmodels.NewAccessPackageResourceScope()
displayName := "Root"
scope.SetDisplayName(&displayName) 
description := "Root Scope"
scope.SetDescription(&description) 
originId := "https://contoso.sharepoint.com/portals/Community"
scope.SetOriginId(&originId) 
originSystem := "SharePointOnline"
scope.SetOriginSystem(&originSystem) 
isRootScope := true
scope.SetIsRootScope(&isRootScope) 
requestBody.SetScope(scope)

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
resourceRoleScopes, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackages().ByAccessPackageId("accessPackage-id").ResourceRoleScopes().Post(context.Background(), requestBody, nil)


// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

AccessPackageResourceRoleScope accessPackageResourceRoleScope = new AccessPackageResourceRoleScope();
AccessPackageResourceRole role = new AccessPackageResourceRole();
role.setDisplayName("Contributors");
role.setOriginSystem("SharePointOnline");
role.setOriginId("4");
AccessPackageResource resource = new AccessPackageResource();
resource.setId("53c71803-a0a8-4777-aecc-075de8ee3991");
role.setResource(resource);
accessPackageResourceRoleScope.setRole(role);
AccessPackageResourceScope scope = new AccessPackageResourceScope();
scope.setDisplayName("Root");
scope.setDescription("Root Scope");
scope.setOriginId("https://contoso.sharepoint.com/portals/Community");
scope.setOriginSystem("SharePointOnline");
scope.setIsRootScope(true);
accessPackageResourceRoleScope.setScope(scope);
AccessPackageResourceRoleScope result = graphClient.identityGovernance().entitlementManagement().accessPackages().byAccessPackageId("{accessPackage-id}").resourceRoleScopes().post(accessPackageResourceRoleScope);


const options = {
	authProvider,
};

const client = Client.init(options);

const accessPackageResourceRoleScope = {
    role: {
        displayName: 'Contributors',
        originSystem: 'SharePointOnline',
        originId: '4',
        resource: {
            id: '53c71803-a0a8-4777-aecc-075de8ee3991'
        }
    },
    scope: {
        displayName: 'Root',
        description: 'Root Scope',
        originId: 'https://contoso.sharepoint.com/portals/Community',
        originSystem: 'SharePointOnline',
        isRootScope: true
    }
};

await client.api('/identityGovernance/entitlementManagement/accessPackages/{id}/resourceRoleScopes')
	.post(accessPackageResourceRoleScope);


<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Models\AccessPackageResourceRoleScope;
use Microsoft\Graph\Generated\Models\AccessPackageResourceRole;
use Microsoft\Graph\Generated\Models\AccessPackageResource;
use Microsoft\Graph\Generated\Models\AccessPackageResourceScope;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestBody = new AccessPackageResourceRoleScope();
$role = new AccessPackageResourceRole();
$role->setDisplayName('Contributors');
$role->setOriginSystem('SharePointOnline');
$role->setOriginId('4');
$roleResource = new AccessPackageResource();
$roleResource->setId('53c71803-a0a8-4777-aecc-075de8ee3991');
$role->setResource($roleResource);
$requestBody->setRole($role);
$scope = new AccessPackageResourceScope();
$scope->setDisplayName('Root');
$scope->setDescription('Root Scope');
$scope->setOriginId('https://contoso.sharepoint.com/portals/Community');
$scope->setOriginSystem('SharePointOnline');
$scope->setIsRootScope(true);
$requestBody->setScope($scope);

$result = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackages()->byAccessPackageId('accessPackage-id')->resourceRoleScopes()->post($requestBody)->wait();


Import-Module Microsoft.Graph.Identity.Governance

$params = @{
	role = @{
		displayName = "Contributors"
		originSystem = "SharePointOnline"
		originId = "4"
		resource = @{
			id = "53c71803-a0a8-4777-aecc-075de8ee3991"
		}
	}
	scope = @{
		displayName = "Root"
		description = "Root Scope"
		originId = "https://contoso.sharepoint.com/portals/Community"
		originSystem = "SharePointOnline"
		isRootScope = $true
	}
}

New-MgEntitlementManagementAccessPackageResourceRoleScope -AccessPackageId $accessPackageId -BodyParameter $params


# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.access_package_resource_role_scope import AccessPackageResourceRoleScope
from msgraph.generated.models.access_package_resource_role import AccessPackageResourceRole
from msgraph.generated.models.access_package_resource import AccessPackageResource
from msgraph.generated.models.access_package_resource_scope import AccessPackageResourceScope
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = AccessPackageResourceRoleScope(
	role = AccessPackageResourceRole(
		display_name = "Contributors",
		origin_system = "SharePointOnline",
		origin_id = "4",
		resource = AccessPackageResource(
			id = "53c71803-a0a8-4777-aecc-075de8ee3991",
		),
	),
	scope = AccessPackageResourceScope(
		display_name = "Root",
		description = "Root Scope",
		origin_id = "https://contoso.sharepoint.com/portals/Community",
		origin_system = "SharePointOnline",
		is_root_scope = True,
	),
)

result = await graph_client.identity_governance.entitlement_management.access_packages.by_access_package_id('accessPackage-id').resource_role_scopes.post(request_body)

Отклик

Ниже показан пример отклика.

HTTP/1.1 201 Created
Content-type: application/json

{
   "id": "6646a29e-da03-49f6-bcd9-dec124492de3_5ae0ae7c-d0a5-42aa-ab37-1f15e9a61d33",
    "createdDateTime": "2023-06-28T01:19:48.4216782Z"
}

Пример 2. Добавление роли приложения в пакет доступа

Запрос

В следующем примере показан запрос, добавляющий роль приложения в список ролей ресурсов пакета доступа. Ресурс пакета доступа для приложения должен уже быть добавлен в каталог пакетов для доступа, содержащий этот пакет доступа. , roleresource и scope можно получить с помощью списка ресурсов каталога.

POST https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/accessPackages/cdd5f06b-752a-4c9f-97a6-82f4eda6c76d/resourceRoleScopes
Content-type: application/json

{
    "role": {
        "id": "cde82ecb-e461-496b-98fb-4f807c7ca640",
        "displayName": "Standard User",
        "description": "Standard User",
        "originSystem": "AadApplication",
        "originId": "a29a7690-b3c4-4ed5-96c6-f640cde06fb8",
        "resource": {
            "id": "5f80c0c7-a180-4521-b585-18200048a0d8",
            "originId": "e81d7f57-0840-45e1-894b-f505c1bdcc1f",
            "originSystem": "AadApplication"
        }
    },
    "scope": {
        "id": "dbeb8772-9907-4e95-a28e-a8d70dbcda69",
        "originId": "e81d7f57-0840-45e1-894b-f505c1bdcc1f",
        "originSystem": "AadApplication",
        "isRootScope": true
    }
}


// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Models;

var requestBody = new AccessPackageResourceRoleScope
{
	Role = new AccessPackageResourceRole
	{
		Id = "cde82ecb-e461-496b-98fb-4f807c7ca640",
		DisplayName = "Standard User",
		Description = "Standard User",
		OriginSystem = "AadApplication",
		OriginId = "a29a7690-b3c4-4ed5-96c6-f640cde06fb8",
		Resource = new AccessPackageResource
		{
			Id = "5f80c0c7-a180-4521-b585-18200048a0d8",
			OriginId = "e81d7f57-0840-45e1-894b-f505c1bdcc1f",
			OriginSystem = "AadApplication",
		},
	},
	Scope = new AccessPackageResourceScope
	{
		Id = "dbeb8772-9907-4e95-a28e-a8d70dbcda69",
		OriginId = "e81d7f57-0840-45e1-894b-f505c1bdcc1f",
		OriginSystem = "AadApplication",
		IsRootScope = true,
	},
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackages["{accessPackage-id}"].ResourceRoleScopes.PostAsync(requestBody);



mgc identity-governance entitlement-management access-packages resource-role-scopes create --access-package-id {accessPackage-id} --body '{\
    "role": {\
        "id": "cde82ecb-e461-496b-98fb-4f807c7ca640",\
        "displayName": "Standard User",\
        "description": "Standard User",\
        "originSystem": "AadApplication",\
        "originId": "a29a7690-b3c4-4ed5-96c6-f640cde06fb8",\
        "resource": {\
            "id": "5f80c0c7-a180-4521-b585-18200048a0d8",\
            "originId": "e81d7f57-0840-45e1-894b-f505c1bdcc1f",\
            "originSystem": "AadApplication"\
        }\
    },\
    "scope": {\
        "id": "dbeb8772-9907-4e95-a28e-a8d70dbcda69",\
        "originId": "e81d7f57-0840-45e1-894b-f505c1bdcc1f",\
        "originSystem": "AadApplication",\
        "isRootScope": true\
    }\
}\
'



// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

requestBody := graphmodels.NewAccessPackageResourceRoleScope()
role := graphmodels.NewAccessPackageResourceRole()
id := "cde82ecb-e461-496b-98fb-4f807c7ca640"
role.SetId(&id) 
displayName := "Standard User"
role.SetDisplayName(&displayName) 
description := "Standard User"
role.SetDescription(&description) 
originSystem := "AadApplication"
role.SetOriginSystem(&originSystem) 
originId := "a29a7690-b3c4-4ed5-96c6-f640cde06fb8"
role.SetOriginId(&originId) 
resource := graphmodels.NewAccessPackageResource()
id := "5f80c0c7-a180-4521-b585-18200048a0d8"
resource.SetId(&id) 
originId := "e81d7f57-0840-45e1-894b-f505c1bdcc1f"
resource.SetOriginId(&originId) 
originSystem := "AadApplication"
resource.SetOriginSystem(&originSystem) 
role.SetResource(resource)
requestBody.SetRole(role)
scope := graphmodels.NewAccessPackageResourceScope()
id := "dbeb8772-9907-4e95-a28e-a8d70dbcda69"
scope.SetId(&id) 
originId := "e81d7f57-0840-45e1-894b-f505c1bdcc1f"
scope.SetOriginId(&originId) 
originSystem := "AadApplication"
scope.SetOriginSystem(&originSystem) 
isRootScope := true
scope.SetIsRootScope(&isRootScope) 
requestBody.SetScope(scope)

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
resourceRoleScopes, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackages().ByAccessPackageId("accessPackage-id").ResourceRoleScopes().Post(context.Background(), requestBody, nil)


// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

AccessPackageResourceRoleScope accessPackageResourceRoleScope = new AccessPackageResourceRoleScope();
AccessPackageResourceRole role = new AccessPackageResourceRole();
role.setId("cde82ecb-e461-496b-98fb-4f807c7ca640");
role.setDisplayName("Standard User");
role.setDescription("Standard User");
role.setOriginSystem("AadApplication");
role.setOriginId("a29a7690-b3c4-4ed5-96c6-f640cde06fb8");
AccessPackageResource resource = new AccessPackageResource();
resource.setId("5f80c0c7-a180-4521-b585-18200048a0d8");
resource.setOriginId("e81d7f57-0840-45e1-894b-f505c1bdcc1f");
resource.setOriginSystem("AadApplication");
role.setResource(resource);
accessPackageResourceRoleScope.setRole(role);
AccessPackageResourceScope scope = new AccessPackageResourceScope();
scope.setId("dbeb8772-9907-4e95-a28e-a8d70dbcda69");
scope.setOriginId("e81d7f57-0840-45e1-894b-f505c1bdcc1f");
scope.setOriginSystem("AadApplication");
scope.setIsRootScope(true);
accessPackageResourceRoleScope.setScope(scope);
AccessPackageResourceRoleScope result = graphClient.identityGovernance().entitlementManagement().accessPackages().byAccessPackageId("{accessPackage-id}").resourceRoleScopes().post(accessPackageResourceRoleScope);


const options = {
	authProvider,
};

const client = Client.init(options);

const accessPackageResourceRoleScope = {
    role: {
        id: 'cde82ecb-e461-496b-98fb-4f807c7ca640',
        displayName: 'Standard User',
        description: 'Standard User',
        originSystem: 'AadApplication',
        originId: 'a29a7690-b3c4-4ed5-96c6-f640cde06fb8',
        resource: {
            id: '5f80c0c7-a180-4521-b585-18200048a0d8',
            originId: 'e81d7f57-0840-45e1-894b-f505c1bdcc1f',
            originSystem: 'AadApplication'
        }
    },
    scope: {
        id: 'dbeb8772-9907-4e95-a28e-a8d70dbcda69',
        originId: 'e81d7f57-0840-45e1-894b-f505c1bdcc1f',
        originSystem: 'AadApplication',
        isRootScope: true
    }
};

await client.api('/identityGovernance/entitlementManagement/accessPackages/cdd5f06b-752a-4c9f-97a6-82f4eda6c76d/resourceRoleScopes')
	.post(accessPackageResourceRoleScope);


<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Models\AccessPackageResourceRoleScope;
use Microsoft\Graph\Generated\Models\AccessPackageResourceRole;
use Microsoft\Graph\Generated\Models\AccessPackageResource;
use Microsoft\Graph\Generated\Models\AccessPackageResourceScope;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestBody = new AccessPackageResourceRoleScope();
$role = new AccessPackageResourceRole();
$role->setId('cde82ecb-e461-496b-98fb-4f807c7ca640');
$role->setDisplayName('Standard User');
$role->setDescription('Standard User');
$role->setOriginSystem('AadApplication');
$role->setOriginId('a29a7690-b3c4-4ed5-96c6-f640cde06fb8');
$roleResource = new AccessPackageResource();
$roleResource->setId('5f80c0c7-a180-4521-b585-18200048a0d8');
$roleResource->setOriginId('e81d7f57-0840-45e1-894b-f505c1bdcc1f');
$roleResource->setOriginSystem('AadApplication');
$role->setResource($roleResource);
$requestBody->setRole($role);
$scope = new AccessPackageResourceScope();
$scope->setId('dbeb8772-9907-4e95-a28e-a8d70dbcda69');
$scope->setOriginId('e81d7f57-0840-45e1-894b-f505c1bdcc1f');
$scope->setOriginSystem('AadApplication');
$scope->setIsRootScope(true);
$requestBody->setScope($scope);

$result = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackages()->byAccessPackageId('accessPackage-id')->resourceRoleScopes()->post($requestBody)->wait();


Import-Module Microsoft.Graph.Identity.Governance

$params = @{
	role = @{
		id = "cde82ecb-e461-496b-98fb-4f807c7ca640"
		displayName = "Standard User"
		description = "Standard User"
		originSystem = "AadApplication"
		originId = "a29a7690-b3c4-4ed5-96c6-f640cde06fb8"
		resource = @{
			id = "5f80c0c7-a180-4521-b585-18200048a0d8"
			originId = "e81d7f57-0840-45e1-894b-f505c1bdcc1f"
			originSystem = "AadApplication"
		}
	}
	scope = @{
		id = "dbeb8772-9907-4e95-a28e-a8d70dbcda69"
		originId = "e81d7f57-0840-45e1-894b-f505c1bdcc1f"
		originSystem = "AadApplication"
		isRootScope = $true
	}
}

New-MgEntitlementManagementAccessPackageResourceRoleScope -AccessPackageId $accessPackageId -BodyParameter $params


# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.access_package_resource_role_scope import AccessPackageResourceRoleScope
from msgraph.generated.models.access_package_resource_role import AccessPackageResourceRole
from msgraph.generated.models.access_package_resource import AccessPackageResource
from msgraph.generated.models.access_package_resource_scope import AccessPackageResourceScope
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = AccessPackageResourceRoleScope(
	role = AccessPackageResourceRole(
		id = "cde82ecb-e461-496b-98fb-4f807c7ca640",
		display_name = "Standard User",
		description = "Standard User",
		origin_system = "AadApplication",
		origin_id = "a29a7690-b3c4-4ed5-96c6-f640cde06fb8",
		resource = AccessPackageResource(
			id = "5f80c0c7-a180-4521-b585-18200048a0d8",
			origin_id = "e81d7f57-0840-45e1-894b-f505c1bdcc1f",
			origin_system = "AadApplication",
		),
	),
	scope = AccessPackageResourceScope(
		id = "dbeb8772-9907-4e95-a28e-a8d70dbcda69",
		origin_id = "e81d7f57-0840-45e1-894b-f505c1bdcc1f",
		origin_system = "AadApplication",
		is_root_scope = True,
	),
)

result = await graph_client.identity_governance.entitlement_management.access_packages.by_access_package_id('accessPackage-id').resource_role_scopes.post(request_body)

Отклик

Ниже показан пример отклика.

HTTP/1.1 201 Created
Content-type: application/json

{
   "id": "cde82ecb-e461-496b-98fb-4f807c7ca640_dbeb8772-9907-4e95-a28e-a8d70dbcda69",
   "createdDateTime": "2023-06-28T01:19:48.4216782Z"
}

Пример 3. Добавление членства в группе в пакет для доступа

Запрос

В следующем примере показан запрос на добавление членства в группе в список ролей ресурсов пакета для доступа. Ресурс пакета доступа для группы должен уже быть добавлен в каталог пакетов для доступа, содержащий этот пакет доступа. , roleresource и scope можно получить с помощью списка ресурсов каталога.

POST https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/accessPackages/cdd5f06b-752a-4c9f-97a6-82f4eda6c76d/resourceRoleScopes
Content-type: application/json

{
    "role": {
        "id": "748f8431-c7c6-404d-8564-df67aa8cfc5e",
        "displayName": "Member",
        "originSystem": "AadGroup",
        "originId": "Member_0282e19d-bf41-435d-92a4-99bab93af305",
        "resource": {
            "id": "b16e0e71-17b4-4ebd-a3cd-8a468542e418",
            "displayName": "example group",
            "description": "a group whose members are to be assigned via an access package",
            "originId": "0282e19d-bf41-435d-92a4-99bab93af305",
            "originSystem": "AadGroup"
        }
    },
    "scope": {
        "id": "83b3e3e9-c8b3-481b-ad80-53e29d1eda9c",
        "displayName": "Root",
        "description": "Root Scope",
        "originId": "0282e19d-bf41-435d-92a4-99bab93af305",
        "originSystem": "AadGroup",
        "isRootScope": true
    }
}


// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Models;

var requestBody = new AccessPackageResourceRoleScope
{
	Role = new AccessPackageResourceRole
	{
		Id = "748f8431-c7c6-404d-8564-df67aa8cfc5e",
		DisplayName = "Member",
		OriginSystem = "AadGroup",
		OriginId = "Member_0282e19d-bf41-435d-92a4-99bab93af305",
		Resource = new AccessPackageResource
		{
			Id = "b16e0e71-17b4-4ebd-a3cd-8a468542e418",
			DisplayName = "example group",
			Description = "a group whose members are to be assigned via an access package",
			OriginId = "0282e19d-bf41-435d-92a4-99bab93af305",
			OriginSystem = "AadGroup",
		},
	},
	Scope = new AccessPackageResourceScope
	{
		Id = "83b3e3e9-c8b3-481b-ad80-53e29d1eda9c",
		DisplayName = "Root",
		Description = "Root Scope",
		OriginId = "0282e19d-bf41-435d-92a4-99bab93af305",
		OriginSystem = "AadGroup",
		IsRootScope = true,
	},
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.IdentityGovernance.EntitlementManagement.AccessPackages["{accessPackage-id}"].ResourceRoleScopes.PostAsync(requestBody);



mgc identity-governance entitlement-management access-packages resource-role-scopes create --access-package-id {accessPackage-id} --body '{\
    "role": {\
        "id": "748f8431-c7c6-404d-8564-df67aa8cfc5e",\
        "displayName": "Member",\
        "originSystem": "AadGroup",\
        "originId": "Member_0282e19d-bf41-435d-92a4-99bab93af305",\
        "resource": {\
            "id": "b16e0e71-17b4-4ebd-a3cd-8a468542e418",\
            "displayName": "example group",\
            "description": "a group whose members are to be assigned via an access package",\
            "originId": "0282e19d-bf41-435d-92a4-99bab93af305",\
            "originSystem": "AadGroup"\
        }\
    },\
    "scope": {\
        "id": "83b3e3e9-c8b3-481b-ad80-53e29d1eda9c",\
        "displayName": "Root",\
        "description": "Root Scope",\
        "originId": "0282e19d-bf41-435d-92a4-99bab93af305",\
        "originSystem": "AadGroup",\
        "isRootScope": true\
    }\
}\
'



// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

requestBody := graphmodels.NewAccessPackageResourceRoleScope()
role := graphmodels.NewAccessPackageResourceRole()
id := "748f8431-c7c6-404d-8564-df67aa8cfc5e"
role.SetId(&id) 
displayName := "Member"
role.SetDisplayName(&displayName) 
originSystem := "AadGroup"
role.SetOriginSystem(&originSystem) 
originId := "Member_0282e19d-bf41-435d-92a4-99bab93af305"
role.SetOriginId(&originId) 
resource := graphmodels.NewAccessPackageResource()
id := "b16e0e71-17b4-4ebd-a3cd-8a468542e418"
resource.SetId(&id) 
displayName := "example group"
resource.SetDisplayName(&displayName) 
description := "a group whose members are to be assigned via an access package"
resource.SetDescription(&description) 
originId := "0282e19d-bf41-435d-92a4-99bab93af305"
resource.SetOriginId(&originId) 
originSystem := "AadGroup"
resource.SetOriginSystem(&originSystem) 
role.SetResource(resource)
requestBody.SetRole(role)
scope := graphmodels.NewAccessPackageResourceScope()
id := "83b3e3e9-c8b3-481b-ad80-53e29d1eda9c"
scope.SetId(&id) 
displayName := "Root"
scope.SetDisplayName(&displayName) 
description := "Root Scope"
scope.SetDescription(&description) 
originId := "0282e19d-bf41-435d-92a4-99bab93af305"
scope.SetOriginId(&originId) 
originSystem := "AadGroup"
scope.SetOriginSystem(&originSystem) 
isRootScope := true
scope.SetIsRootScope(&isRootScope) 
requestBody.SetScope(scope)

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
resourceRoleScopes, err := graphClient.IdentityGovernance().EntitlementManagement().AccessPackages().ByAccessPackageId("accessPackage-id").ResourceRoleScopes().Post(context.Background(), requestBody, nil)


// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

AccessPackageResourceRoleScope accessPackageResourceRoleScope = new AccessPackageResourceRoleScope();
AccessPackageResourceRole role = new AccessPackageResourceRole();
role.setId("748f8431-c7c6-404d-8564-df67aa8cfc5e");
role.setDisplayName("Member");
role.setOriginSystem("AadGroup");
role.setOriginId("Member_0282e19d-bf41-435d-92a4-99bab93af305");
AccessPackageResource resource = new AccessPackageResource();
resource.setId("b16e0e71-17b4-4ebd-a3cd-8a468542e418");
resource.setDisplayName("example group");
resource.setDescription("a group whose members are to be assigned via an access package");
resource.setOriginId("0282e19d-bf41-435d-92a4-99bab93af305");
resource.setOriginSystem("AadGroup");
role.setResource(resource);
accessPackageResourceRoleScope.setRole(role);
AccessPackageResourceScope scope = new AccessPackageResourceScope();
scope.setId("83b3e3e9-c8b3-481b-ad80-53e29d1eda9c");
scope.setDisplayName("Root");
scope.setDescription("Root Scope");
scope.setOriginId("0282e19d-bf41-435d-92a4-99bab93af305");
scope.setOriginSystem("AadGroup");
scope.setIsRootScope(true);
accessPackageResourceRoleScope.setScope(scope);
AccessPackageResourceRoleScope result = graphClient.identityGovernance().entitlementManagement().accessPackages().byAccessPackageId("{accessPackage-id}").resourceRoleScopes().post(accessPackageResourceRoleScope);


const options = {
	authProvider,
};

const client = Client.init(options);

const accessPackageResourceRoleScope = {
    role: {
        id: '748f8431-c7c6-404d-8564-df67aa8cfc5e',
        displayName: 'Member',
        originSystem: 'AadGroup',
        originId: 'Member_0282e19d-bf41-435d-92a4-99bab93af305',
        resource: {
            id: 'b16e0e71-17b4-4ebd-a3cd-8a468542e418',
            displayName: 'example group',
            description: 'a group whose members are to be assigned via an access package',
            originId: '0282e19d-bf41-435d-92a4-99bab93af305',
            originSystem: 'AadGroup'
        }
    },
    scope: {
        id: '83b3e3e9-c8b3-481b-ad80-53e29d1eda9c',
        displayName: 'Root',
        description: 'Root Scope',
        originId: '0282e19d-bf41-435d-92a4-99bab93af305',
        originSystem: 'AadGroup',
        isRootScope: true
    }
};

await client.api('/identityGovernance/entitlementManagement/accessPackages/cdd5f06b-752a-4c9f-97a6-82f4eda6c76d/resourceRoleScopes')
	.post(accessPackageResourceRoleScope);


<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Models\AccessPackageResourceRoleScope;
use Microsoft\Graph\Generated\Models\AccessPackageResourceRole;
use Microsoft\Graph\Generated\Models\AccessPackageResource;
use Microsoft\Graph\Generated\Models\AccessPackageResourceScope;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestBody = new AccessPackageResourceRoleScope();
$role = new AccessPackageResourceRole();
$role->setId('748f8431-c7c6-404d-8564-df67aa8cfc5e');
$role->setDisplayName('Member');
$role->setOriginSystem('AadGroup');
$role->setOriginId('Member_0282e19d-bf41-435d-92a4-99bab93af305');
$roleResource = new AccessPackageResource();
$roleResource->setId('b16e0e71-17b4-4ebd-a3cd-8a468542e418');
$roleResource->setDisplayName('example group');
$roleResource->setDescription('a group whose members are to be assigned via an access package');
$roleResource->setOriginId('0282e19d-bf41-435d-92a4-99bab93af305');
$roleResource->setOriginSystem('AadGroup');
$role->setResource($roleResource);
$requestBody->setRole($role);
$scope = new AccessPackageResourceScope();
$scope->setId('83b3e3e9-c8b3-481b-ad80-53e29d1eda9c');
$scope->setDisplayName('Root');
$scope->setDescription('Root Scope');
$scope->setOriginId('0282e19d-bf41-435d-92a4-99bab93af305');
$scope->setOriginSystem('AadGroup');
$scope->setIsRootScope(true);
$requestBody->setScope($scope);

$result = $graphServiceClient->identityGovernance()->entitlementManagement()->accessPackages()->byAccessPackageId('accessPackage-id')->resourceRoleScopes()->post($requestBody)->wait();


Import-Module Microsoft.Graph.Identity.Governance

$params = @{
	role = @{
		id = "748f8431-c7c6-404d-8564-df67aa8cfc5e"
		displayName = "Member"
		originSystem = "AadGroup"
		originId = "Member_0282e19d-bf41-435d-92a4-99bab93af305"
		resource = @{
			id = "b16e0e71-17b4-4ebd-a3cd-8a468542e418"
			displayName = "example group"
			description = "a group whose members are to be assigned via an access package"
			originId = "0282e19d-bf41-435d-92a4-99bab93af305"
			originSystem = "AadGroup"
		}
	}
	scope = @{
		id = "83b3e3e9-c8b3-481b-ad80-53e29d1eda9c"
		displayName = "Root"
		description = "Root Scope"
		originId = "0282e19d-bf41-435d-92a4-99bab93af305"
		originSystem = "AadGroup"
		isRootScope = $true
	}
}

New-MgEntitlementManagementAccessPackageResourceRoleScope -AccessPackageId $accessPackageId -BodyParameter $params


# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.access_package_resource_role_scope import AccessPackageResourceRoleScope
from msgraph.generated.models.access_package_resource_role import AccessPackageResourceRole
from msgraph.generated.models.access_package_resource import AccessPackageResource
from msgraph.generated.models.access_package_resource_scope import AccessPackageResourceScope
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = AccessPackageResourceRoleScope(
	role = AccessPackageResourceRole(
		id = "748f8431-c7c6-404d-8564-df67aa8cfc5e",
		display_name = "Member",
		origin_system = "AadGroup",
		origin_id = "Member_0282e19d-bf41-435d-92a4-99bab93af305",
		resource = AccessPackageResource(
			id = "b16e0e71-17b4-4ebd-a3cd-8a468542e418",
			display_name = "example group",
			description = "a group whose members are to be assigned via an access package",
			origin_id = "0282e19d-bf41-435d-92a4-99bab93af305",
			origin_system = "AadGroup",
		),
	),
	scope = AccessPackageResourceScope(
		id = "83b3e3e9-c8b3-481b-ad80-53e29d1eda9c",
		display_name = "Root",
		description = "Root Scope",
		origin_id = "0282e19d-bf41-435d-92a4-99bab93af305",
		origin_system = "AadGroup",
		is_root_scope = True,
	),
)

result = await graph_client.identity_governance.entitlement_management.access_packages.by_access_package_id('accessPackage-id').resource_role_scopes.post(request_body)

Отклик

Ниже показан пример отклика.

HTTP/1.1 201 Created
Content-type: application/json

{
   "id": "748f8431-c7c6-404d-8564-df67aa8cfc5e_83b3e3e9-c8b3-481b-ad80-53e29d1eda9c",
   "createdDateTime": "2023-06-28T01:19:48.4216782Z"
}

Поделиться через

Создание resourceRoleScope

Разрешения

HTTP-запрос

Заголовки запросов

Текст запроса

Отклик

Примеры

Пример 1. Добавление роли сайта SharePoint Online в пакет доступа

Запрос

Отклик

Пример 2. Добавление роли приложения в пакет доступа

Запрос

Отклик

Пример 3. Добавление членства в группе в пакет для доступа

Запрос

Отклик

Обратная связь

Дополнительные ресурсы