名前空間: microsoft.graph
重要
Microsoft Graph の /beta
バージョンの API は変更される可能性があります。 実稼働アプリケーションでこれらの API を使用することは、サポートされていません。 v1.0 で API を使用できるかどうかを確認するには、Version セレクターを使用します。
プロバイダーの unifiedRoleAssignment オブジェクトの一覧を取得します。
現在、次の RBAC プロバイダーがサポートされています。
- directory (Microsoft Entra ID)
- エンタイトルメント管理 (Microsoft Entraエンタイトルメント管理)
- Exchange Online
この API は、次の国内クラウド展開で使用できます。
グローバル サービス |
米国政府機関 L4 |
米国政府機関 L5 (DOD) |
21Vianet が運営する中国 |
✅ |
✅ |
✅ |
✅ |
アクセス許可
この API を呼び出すには、次のいずれかのアクセス許可が必要です。 アクセス許可の選択方法などの詳細については、「アクセス許可」を参照してください。
ディレクトリ (Microsoft Entra ID) プロバイダーの場合
アクセス許可の種類 |
アクセス許可 (特権の小さいものから大きいものへ) |
委任 (職場または学校のアカウント) |
RoleManagement.Read.Directory、RoleManagement.Read.All、Directory.Read.All、RoleManagement.ReadWrite.Directory、Directory.ReadWrite.All |
委任 (個人用 Microsoft アカウント) |
サポートされていません。 |
アプリケーション |
RoleManagement.Read.Directory、RoleManagement.Read.All、Directory.Read.All、RoleManagement.ReadWrite.Directory、Directory.ReadWrite.All |
重要
職場または学校アカウントを使用した委任されたシナリオでは、サインインしているユーザーに、サポートされているMicrosoft Entraロールまたはサポートされているロールのアクセス許可を持つカスタム ロールを割り当てる必要があります。 この操作では、次の最小特権ロールがサポートされています。
- ディレクトリ リーダー
- グローバル閲覧者
- 特権ロール管理者
エンタイトルメント管理プロバイダーの場合
アクセス許可の種類 |
アクセス許可 (特権の小さいものから大きいものへ) |
委任 (職場または学校のアカウント) |
EntitlementManagement.Read.All、EntitlementManagement.ReadWrite.All |
委任 (個人用 Microsoft アカウント) |
サポートされていません。 |
アプリケーション |
サポートされていません。 |
Exchange Online プロバイダーの場合
アクセス許可の種類 |
アクセス許可 (特権の小さいものから大きいものへ) |
委任 (職場または学校のアカウント) |
RoleManagement.Read.Exchange、RoleManagement.Read.All、RoleManagement.ReadWrite.Exchange |
委任 (個人用 Microsoft アカウント) |
サポートされていません。 |
アプリケーション |
RoleManagement.Read.Exchange、RoleManagement.Read.All、RoleManagement.ReadWrite.Exchange |
HTTP 要求
ディレクトリ プロバイダーのロールの割り当てを一覧表示するには:
GET /roleManagement/directory/roleAssignments
エンタイトルメント管理プロバイダーのロールの割り当てを一覧表示するには:
GET /roleManagement/entitlementManagement/roleAssignments?
Exchange Online プロバイダーのロールの割り当てを一覧表示するには:
GET /roleManagement/exchange/roleAssignments
オプションのクエリ パラメーター
このメソッドは、応答のカスタマイズに役立つ $filter
、 $expand
、および $select
OData クエリ パラメーター をサポートします。
名前 |
説明 |
Authorization |
ベアラー {token}。 必須です。
認証と認可についての詳細をご覧ください。 |
要求本文
このメソッドには、要求本文を指定しません。
応答
成功した場合、このメソッドは 200 OK
応答コードと、応答本文の unifiedRoleAssignment オブジェクトのコレクションを返します。
例
例 1: roleDefinitionId のフィルターを使用して要求し、プリンシパル オブジェクトを展開する
要求
次の例は要求を示しています。
GET https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments?$filter=roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'&$expand=principal
// Code snippets are only available for the latest version. Current version is 5.x
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.Directory.RoleAssignments.GetAsync((requestConfiguration) =>
{
requestConfiguration.QueryParameters.Filter = "roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'";
requestConfiguration.QueryParameters.Expand = new string []{ "principal" };
});
mgc-beta role-management directory role-assignments list --filter "roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'" --expand "principal"
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphrolemanagement "github.com/microsoftgraph/msgraph-beta-sdk-go/rolemanagement"
//other-imports
)
requestFilter := "roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'"
requestParameters := &graphrolemanagement.DirectoryRoleAssignmentsRequestBuilderGetQueryParameters{
Filter: &requestFilter,
Expand: [] string {"principal"},
}
configuration := &graphrolemanagement.DirectoryRoleAssignmentsRequestBuilderGetRequestConfiguration{
QueryParameters: requestParameters,
}
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().Directory().RoleAssignments().Get(context.Background(), configuration)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignmentCollectionResponse result = graphClient.roleManagement().directory().roleAssignments().get(requestConfiguration -> {
requestConfiguration.queryParameters.filter = "roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'";
requestConfiguration.queryParameters.expand = new String []{"principal"};
});
const options = {
authProvider,
};
const client = Client.init(options);
let roleAssignments = await client.api('/roleManagement/directory/roleAssignments')
.version('beta')
.filter('roleDefinitionId eq \'62e90394-69f5-4237-9190-012177145e10\'')
.expand('principal')
.get();
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\RoleManagement\Directory\RoleAssignments\RoleAssignmentsRequestBuilderGetRequestConfiguration;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestConfiguration = new RoleAssignmentsRequestBuilderGetRequestConfiguration();
$queryParameters = RoleAssignmentsRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->filter = "roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'";
$queryParameters->expand = ["principal"];
$requestConfiguration->queryParameters = $queryParameters;
$result = $graphServiceClient->roleManagement()->directory()->roleAssignments()->get($requestConfiguration)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
Get-MgBetaRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'" -ExpandProperty "principal"
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.role_management.directory.role_assignments.role_assignments_request_builder import RoleAssignmentsRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
query_params = RoleAssignmentsRequestBuilder.RoleAssignmentsRequestBuilderGetQueryParameters(
filter = "roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'",
expand = ["principal"],
)
request_configuration = RequestConfiguration(
query_parameters = query_params,
)
result = await graph_client.role_management.directory.role_assignments.get(request_configuration = request_configuration)
応答
次の例は応答を示しています。
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleAssignments(principal())",
"value": [
{
"id": "lAPpYvVpN0KRkAEhdxReEMmO4KwRqtpKkUWt3wOYIz4-1",
"principalId": "ace08ec9-aa11-4ada-9145-addf0398233e",
"resourceScope": "/",
"directoryScopeId": "/",
"roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
"principal": {
"@odata.type": "#microsoft.graph.user",
"id": "ace08ec9-aa11-4ada-9145-addf0398233e",
"deletedDateTime": null,
"accountEnabled": true,
"ageGroup": null,
"businessPhones": [],
"city": "Redmond",
"createdDateTime": "2019-02-22T20:29:07Z",
"creationType": null,
"companyName": null,
"consentProvidedForMinor": null,
"country": "US",
"department": "Office of the CEO",
"displayName": "Joey Cruz",
"employeeId": null,
"faxNumber": null,
"givenName": "Joey",
"imAddresses": [
"joeyc@woodgrove.ms"
],
"infoCatalogs": [],
"isResourceAccount": null,
"jobTitle": "Chief Security Officer",
"legalAgeGroupClassification": null,
"mail": "joeyc@woodgrove.ms",
"mailNickname": "joeyc",
"mobilePhone": null,
"onPremisesDistinguishedName": null,
"officeLocation": null,
"userType": "Member",
}
},
{
"id": "lAPpYvVpN0KRkAEhdxReEC6Xh29-LklLmYDrOIi9z-E-1",
"principalId": "6f87972e-2e7e-4b49-9980-eb3888bdcfe1",
"resourceScope": "/",
"directoryScopeId": "/",
"roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
"principal": {
"@odata.type": "#microsoft.graph.user",
"id": "6f87972e-2e7e-4b49-9980-eb3888bdcfe1",
"deletedDateTime": null,
"accountEnabled": true,
"ageGroup": null,
"businessPhones": [],
"city": null,
"createdDateTime": "2019-07-18T01:38:36Z",
"creationType": "Invitation",
"companyName": null,
"consentProvidedForMinor": null,
"country": null,
"department": null,
"displayName": "Kalyan Krishna",
"employeeId": null,
"faxNumber": null,
"givenName": null,
"imAddresses": [],
"userType": "Guest",
}
},
{
"id": "lAPpYvVpN0KRkAEhdxReEMgc_BA2rIZBuZsM-BSqLdU-1",
"principalId": "10fc1cc8-ac36-4186-b99b-0cf814aa2dd5",
"resourceScope": "/",
"directoryScopeId": "/",
"roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10",
"principal": {
"@odata.type": "#microsoft.graph.user",
"id": "10fc1cc8-ac36-4186-b99b-0cf814aa2dd5",
"deletedDateTime": null,
"accountEnabled": true,
"ageGroup": null,
"businessPhones": [],
"city": null,
"createdDateTime": "2019-11-13T21:54:27Z",
"creationType": "Invitation",
"companyName": null,
"consentProvidedForMinor": null,
"country": null,
"department": null,
"displayName": "Markie Downing",
"employeeId": null,
"faxNumber": null,
"givenName": null,
"imAddresses": [],
"userType": "Guest",
}
}
]
}
例 2: プリンシパル ID のフィルターを使用して要求する
要求
次の例は要求を示しています。
GET https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments?$filter = principalId eq 'f1847572-48aa-47aa-96a3-2ec61904f41f'
// Code snippets are only available for the latest version. Current version is 5.x
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.Directory.RoleAssignments.GetAsync((requestConfiguration) =>
{
requestConfiguration.QueryParameters.Filter = " principalId eq 'f1847572-48aa-47aa-96a3-2ec61904f41f'";
});
mgc-beta role-management directory role-assignments list
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphrolemanagement "github.com/microsoftgraph/msgraph-beta-sdk-go/rolemanagement"
//other-imports
)
requestFilter := " principalId eq 'f1847572-48aa-47aa-96a3-2ec61904f41f'"
requestParameters := &graphrolemanagement.DirectoryRoleAssignmentsRequestBuilderGetQueryParameters{
Filter: &requestFilter,
}
configuration := &graphrolemanagement.DirectoryRoleAssignmentsRequestBuilderGetRequestConfiguration{
QueryParameters: requestParameters,
}
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().Directory().RoleAssignments().Get(context.Background(), configuration)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignmentCollectionResponse result = graphClient.roleManagement().directory().roleAssignments().get(requestConfiguration -> {
requestConfiguration.queryParameters.filter = " principalId eq 'f1847572-48aa-47aa-96a3-2ec61904f41f'";
});
const options = {
authProvider,
};
const client = Client.init(options);
let roleAssignments = await client.api('/roleManagement/directory/roleAssignments')
.version('beta')
.filter(' principalId eq \'f1847572-48aa-47aa-96a3-2ec61904f41f\'')
.get();
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\RoleManagement\Directory\RoleAssignments\RoleAssignmentsRequestBuilderGetRequestConfiguration;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestConfiguration = new RoleAssignmentsRequestBuilderGetRequestConfiguration();
$queryParameters = RoleAssignmentsRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->filter = " principalId eq 'f1847572-48aa-47aa-96a3-2ec61904f41f'";
$requestConfiguration->queryParameters = $queryParameters;
$result = $graphServiceClient->roleManagement()->directory()->roleAssignments()->get($requestConfiguration)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
Get-MgBetaRoleManagementDirectoryRoleAssignment -Filter " principalId eq 'f1847572-48aa-47aa-96a3-2ec61904f41f'"
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.role_management.directory.role_assignments.role_assignments_request_builder import RoleAssignmentsRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
query_params = RoleAssignmentsRequestBuilder.RoleAssignmentsRequestBuilderGetQueryParameters(
filter = " principalId eq 'f1847572-48aa-47aa-96a3-2ec61904f41f'",
)
request_configuration = RequestConfiguration(
query_parameters = query_params,
)
result = await graph_client.role_management.directory.role_assignments.get(request_configuration = request_configuration)
応答
次の例は応答を示しています。
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleAssignments",
"value": [
{
"id": "lAPpYvVpN0KRkAEhdxReEHJ1hPGqSKpHlqMuxhkE9B8-1",
"principalId": "f1847572-48aa-47aa-96a3-2ec61904f41f",
"resourceScope": "/",
"directoryScopeId": "/",
"roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10"
},
{
"id": "LJnv8vs6uUa3z6Em7nTEUXJ1hPGqSKpHlqMuxhkE9B8-1",
"principalId": "f1847572-48aa-47aa-96a3-2ec61904f41f",
"resourceScope": "/",
"directoryScopeId": "/",
"roleDefinitionId": "f2ef992c-3afb-46b9-b7cf-a126ee74c451"
}
]
}
例 3: アクセス パッケージ カタログのロールの割り当てに$filterを使用して要求し、プリンシパルを展開する
要求
次の例は要求を示しています。
GET https://graph.microsoft.com/beta/roleManagement/entitlementManagement/roleAssignments?$filter=appScopeId eq '/AccessPackageCatalog/4cee616b-fdf9-4890-9d10-955e0ccb12bc'&$expand=principal
// Code snippets are only available for the latest version. Current version is 5.x
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.EntitlementManagement.RoleAssignments.GetAsync((requestConfiguration) =>
{
requestConfiguration.QueryParameters.Filter = "appScopeId eq '/AccessPackageCatalog/4cee616b-fdf9-4890-9d10-955e0ccb12bc'";
requestConfiguration.QueryParameters.Expand = new string []{ "principal" };
});
mgc-beta role-management entitlement-management role-assignments list --filter "appScopeId eq '/AccessPackageCatalog/4cee616b-fdf9-4890-9d10-955e0ccb12bc'" --expand "principal"
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphrolemanagement "github.com/microsoftgraph/msgraph-beta-sdk-go/rolemanagement"
//other-imports
)
requestFilter := "appScopeId eq '/AccessPackageCatalog/4cee616b-fdf9-4890-9d10-955e0ccb12bc'"
requestParameters := &graphrolemanagement.EntitlementManagementRoleAssignmentsRequestBuilderGetQueryParameters{
Filter: &requestFilter,
Expand: [] string {"principal"},
}
configuration := &graphrolemanagement.EntitlementManagementRoleAssignmentsRequestBuilderGetRequestConfiguration{
QueryParameters: requestParameters,
}
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().EntitlementManagement().RoleAssignments().Get(context.Background(), configuration)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignmentCollectionResponse result = graphClient.roleManagement().entitlementManagement().roleAssignments().get(requestConfiguration -> {
requestConfiguration.queryParameters.filter = "appScopeId eq '/AccessPackageCatalog/4cee616b-fdf9-4890-9d10-955e0ccb12bc'";
requestConfiguration.queryParameters.expand = new String []{"principal"};
});
const options = {
authProvider,
};
const client = Client.init(options);
let roleAssignments = await client.api('/roleManagement/entitlementManagement/roleAssignments')
.version('beta')
.filter('appScopeId eq \'/AccessPackageCatalog/4cee616b-fdf9-4890-9d10-955e0ccb12bc\'')
.expand('principal')
.get();
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\RoleManagement\EntitlementManagement\RoleAssignments\RoleAssignmentsRequestBuilderGetRequestConfiguration;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestConfiguration = new RoleAssignmentsRequestBuilderGetRequestConfiguration();
$queryParameters = RoleAssignmentsRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->filter = "appScopeId eq '/AccessPackageCatalog/4cee616b-fdf9-4890-9d10-955e0ccb12bc'";
$queryParameters->expand = ["principal"];
$requestConfiguration->queryParameters = $queryParameters;
$result = $graphServiceClient->roleManagement()->entitlementManagement()->roleAssignments()->get($requestConfiguration)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
Get-MgBetaRoleManagementEntitlementManagementRoleAssignment -Filter "appScopeId eq '/AccessPackageCatalog/4cee616b-fdf9-4890-9d10-955e0ccb12bc'" -ExpandProperty "principal"
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.role_management.entitlement_management.role_assignments.role_assignments_request_builder import RoleAssignmentsRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
query_params = RoleAssignmentsRequestBuilder.RoleAssignmentsRequestBuilderGetQueryParameters(
filter = "appScopeId eq '/AccessPackageCatalog/4cee616b-fdf9-4890-9d10-955e0ccb12bc'",
expand = ["principal"],
)
request_configuration = RequestConfiguration(
query_parameters = query_params,
)
result = await graph_client.role_management.entitlement_management.role_assignments.get(request_configuration = request_configuration)
応答
次の例は応答を示しています。
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleAssignments",
"value": [
{
"id": "900633fe-2508-4b13-a561-a15e320ad35f",
"principalId": "39228473-522e-4533-88cc-a9553180cb99",
"roleDefinitionId": "ae79f266-94d4-4dab-b730-feca7e132178",
"appScopeId": "/AccessPackageCatalog/4cee616b-fdf9-4890-9d10-955e0ccb12bc",
"principal": {
"@odata.type": "#microsoft.graph.user",
"id": "39228473-522e-4533-88cc-a9553180cb99"
}
}
]
}
例 4: Exchange Online プロバイダーの特定のサービス プリンシパルのロールの割り当てを一覧表示する
要求
次の例は要求を示しています。
GET https://graph.microsoft.com/beta/roleManagement/exchange/roleAssignments?$filter=principalId eq '/ServicePrincipals/5d39cc4d-ba68-4c44-92c7-5056e3a1ce39'
// Code snippets are only available for the latest version. Current version is 5.x
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.Exchange.RoleAssignments.GetAsync((requestConfiguration) =>
{
requestConfiguration.QueryParameters.Filter = "principalId eq '/ServicePrincipals/5d39cc4d-ba68-4c44-92c7-5056e3a1ce39'";
});
mgc-beta role-management exchange role-assignments list --filter "principalId eq '/ServicePrincipals/5d39cc4d-ba68-4c44-92c7-5056e3a1ce39'"
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphrolemanagement "github.com/microsoftgraph/msgraph-beta-sdk-go/rolemanagement"
//other-imports
)
requestFilter := "principalId eq '/ServicePrincipals/5d39cc4d-ba68-4c44-92c7-5056e3a1ce39'"
requestParameters := &graphrolemanagement.ExchangeRoleAssignmentsRequestBuilderGetQueryParameters{
Filter: &requestFilter,
}
configuration := &graphrolemanagement.ExchangeRoleAssignmentsRequestBuilderGetRequestConfiguration{
QueryParameters: requestParameters,
}
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().Exchange().RoleAssignments().Get(context.Background(), configuration)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignmentCollectionResponse result = graphClient.roleManagement().exchange().roleAssignments().get(requestConfiguration -> {
requestConfiguration.queryParameters.filter = "principalId eq '/ServicePrincipals/5d39cc4d-ba68-4c44-92c7-5056e3a1ce39'";
});
const options = {
authProvider,
};
const client = Client.init(options);
let roleAssignments = await client.api('/roleManagement/exchange/roleAssignments')
.version('beta')
.filter('principalId eq \'/ServicePrincipals/5d39cc4d-ba68-4c44-92c7-5056e3a1ce39\'')
.get();
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\RoleManagement\Exchange\RoleAssignments\RoleAssignmentsRequestBuilderGetRequestConfiguration;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestConfiguration = new RoleAssignmentsRequestBuilderGetRequestConfiguration();
$queryParameters = RoleAssignmentsRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->filter = "principalId eq '/ServicePrincipals/5d39cc4d-ba68-4c44-92c7-5056e3a1ce39'";
$requestConfiguration->queryParameters = $queryParameters;
$result = $graphServiceClient->roleManagement()->exchange()->roleAssignments()->get($requestConfiguration)->wait();
Import-Module Microsoft.Graph.Beta.DeviceManagement.Enrollment
Get-MgBetaRoleManagementExchangeRoleAssignment -Filter "principalId eq '/ServicePrincipals/5d39cc4d-ba68-4c44-92c7-5056e3a1ce39'"
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.role_management.exchange.role_assignments.role_assignments_request_builder import RoleAssignmentsRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
query_params = RoleAssignmentsRequestBuilder.RoleAssignmentsRequestBuilderGetQueryParameters(
filter = "principalId eq '/ServicePrincipals/5d39cc4d-ba68-4c44-92c7-5056e3a1ce39'",
)
request_configuration = RequestConfiguration(
query_parameters = query_params,
)
result = await graph_client.role_management.exchange.role_assignments.get(request_configuration = request_configuration)
応答
次の例は応答を示しています。
注: ここに示す応答オブジェクトは、読みやすさのために短縮されている場合があります。
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/exchange/roleAssignments",
"value": [
{
"id": "e664cde0-fbdf-4b1e-bcb2-d134ef32194d",
"principalId": "/ServicePrincipals/5d39cc4d-ba68-4c44-92c7-5056e3a1ce39",
"roleDefinitionId": "7224da60-d8e2-4f45-9380-8e4fda64e133",
"directoryScopeId": "/",
"appScopeId": null
},
{
"id": "6f0be5be-49f3-42e6-8086-cdcd67b6eac0",
"principalId": "/ServicePrincipals/5d39cc4d-ba68-4c44-92c7-5056e3a1ce39",
"roleDefinitionId": "ba6ab9a1-045c-4812-9e0b-f851f0da3907",
"directoryScopeId": "/Users/62ef60ab-0736-495b-b2b0-a4ca2c5b11d7",
"appScopeId": null
},
{
"id": "7ce3e76d-5997-447b-be59-798468265b41",
"principalId": "/ServicePrincipals/5d39cc4d-ba68-4c44-92c7-5056e3a1ce39",
"roleDefinitionId": "42f85b54-af39-40fd-acea-083b9c14d3f3",
"directoryScopeId": "/AdministrativeUnits/62ef60ab-0736-495b-b2b0-a4ca2c5b11d7",
"appScopeId": null
}
]
}
例 4: 特権ロールの割り当てを一覧表示する
要求
次の例は要求を示しています。
GET https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments?$expand=roleDefinition&$filter=roleDefinition/isPrivileged eq true
// Code snippets are only available for the latest version. Current version is 5.x
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.Directory.RoleAssignments.GetAsync((requestConfiguration) =>
{
requestConfiguration.QueryParameters.Expand = new string []{ "roleDefinition" };
requestConfiguration.QueryParameters.Filter = "roleDefinition/isPrivileged eq true";
});
mgc-beta role-management directory role-assignments list --filter "roleDefinition/isPrivileged eq true" --expand "roleDefinition"
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphrolemanagement "github.com/microsoftgraph/msgraph-beta-sdk-go/rolemanagement"
//other-imports
)
requestFilter := "roleDefinition/isPrivileged eq true"
requestParameters := &graphrolemanagement.DirectoryRoleAssignmentsRequestBuilderGetQueryParameters{
Expand: [] string {"roleDefinition"},
Filter: &requestFilter,
}
configuration := &graphrolemanagement.DirectoryRoleAssignmentsRequestBuilderGetRequestConfiguration{
QueryParameters: requestParameters,
}
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().Directory().RoleAssignments().Get(context.Background(), configuration)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignmentCollectionResponse result = graphClient.roleManagement().directory().roleAssignments().get(requestConfiguration -> {
requestConfiguration.queryParameters.expand = new String []{"roleDefinition"};
requestConfiguration.queryParameters.filter = "roleDefinition/isPrivileged eq true";
});
const options = {
authProvider,
};
const client = Client.init(options);
let roleAssignments = await client.api('/roleManagement/directory/roleAssignments')
.version('beta')
.filter('roleDefinition/isPrivileged eq true')
.expand('roleDefinition')
.get();
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\RoleManagement\Directory\RoleAssignments\RoleAssignmentsRequestBuilderGetRequestConfiguration;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestConfiguration = new RoleAssignmentsRequestBuilderGetRequestConfiguration();
$queryParameters = RoleAssignmentsRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->expand = ["roleDefinition"];
$queryParameters->filter = "roleDefinition/isPrivileged eq true";
$requestConfiguration->queryParameters = $queryParameters;
$result = $graphServiceClient->roleManagement()->directory()->roleAssignments()->get($requestConfiguration)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
Get-MgBetaRoleManagementDirectoryRoleAssignment -ExpandProperty "roleDefinition" -Filter "roleDefinition/isPrivileged eq true"
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.role_management.directory.role_assignments.role_assignments_request_builder import RoleAssignmentsRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
query_params = RoleAssignmentsRequestBuilder.RoleAssignmentsRequestBuilderGetQueryParameters(
expand = ["roleDefinition"],
filter = "roleDefinition/isPrivileged eq true",
)
request_configuration = RequestConfiguration(
query_parameters = query_params,
)
result = await graph_client.role_management.directory.role_assignments.get(request_configuration = request_configuration)
応答
次の例は応答を示しています。
注: ここに示す応答オブジェクトは、読みやすさのために短縮されている場合があります。
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleAssignments(roleDefinition())",
"value": [
{
"id": "{id}",
"principalId": "{principalId}",
"principalOrganizationId": "{principalOrganizationId}",
"resourceScope": "/",
"directoryScopeId": "/",
"roleDefinitionId": "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
"roleDefinition": {
"id": "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
"description": "Can manage Conditional Access capabilities.",
"displayName": "Conditional Access Administrator",
"isBuiltIn": true,
"isEnabled": true,
"isPrivileged": true,
"resourceScopes": [
"/"
],
"templateId": "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
"version": "1",
"rolePermissions": [
{
"allowedResourceActions": [
"microsoft.directory/namedLocations/create",
"microsoft.directory/namedLocations/delete",
"microsoft.directory/namedLocations/standard/read",
"microsoft.directory/namedLocations/basic/update",
"microsoft.directory/conditionalAccessPolicies/create",
"microsoft.directory/conditionalAccessPolicies/delete",
"microsoft.directory/conditionalAccessPolicies/standard/read",
"microsoft.directory/conditionalAccessPolicies/owners/read",
"microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read",
"microsoft.directory/conditionalAccessPolicies/basic/update",
"microsoft.directory/conditionalAccessPolicies/owners/update",
"microsoft.directory/conditionalAccessPolicies/tenantDefault/update"
],
"condition": null
}
]
}
},
{
"id": "{id}",
"principalId": "{principalId}",
"principalOrganizationId": "{principalOrganizationId}",
"resourceScope": "/",
"directoryScopeId": "/",
"roleDefinitionId": "c4e39bd9-1100-46d3-8c65-fb160da0071f",
"roleDefinition": {
"id": "c4e39bd9-1100-46d3-8c65-fb160da0071f",
"description": "Can access to view, set and reset authentication method information for any non-admin user.",
"displayName": "Authentication Administrator",
"isBuiltIn": true,
"isEnabled": true,
"isPrivileged": true,
"resourceScopes": [
"/"
],
"templateId": "c4e39bd9-1100-46d3-8c65-fb160da0071f",
"version": "1",
"rolePermissions": [
{
"allowedResourceActions": [
"microsoft.directory/users/authenticationMethods/create",
"microsoft.directory/users/authenticationMethods/delete",
"microsoft.directory/users/authenticationMethods/standard/restrictedRead",
"microsoft.directory/users/authenticationMethods/basic/update",
"microsoft.directory/deletedItems.users/restore",
"microsoft.directory/users/delete",
"microsoft.directory/users/disable",
"microsoft.directory/users/enable",
"microsoft.directory/users/invalidateAllRefreshTokens",
"microsoft.directory/users/restore",
"microsoft.directory/users/basic/update",
"microsoft.directory/users/manager/update",
"microsoft.directory/users/password/update",
"microsoft.directory/users/userPrincipalName/update",
"microsoft.azure.serviceHealth/allEntities/allTasks",
"microsoft.azure.supportTickets/allEntities/allTasks",
"microsoft.office365.serviceHealth/allEntities/allTasks",
"microsoft.office365.supportTickets/allEntities/allTasks",
"microsoft.office365.webPortal/allEntities/standard/read"
],
"condition": null
}
]
}
}
]
}