命名空间：microsoft.graph
重要
Microsoft Graph /beta 版本下的 API 可能会发生更改。 不支持在生产应用程序中使用这些 API。 若要确定 API 是否在 v1.0 中可用，请使用 版本 选择器。
创建新的 unifiedRoleAssignment 对象。
此 API 可用于以下国家级云部署。
| 全局服务 |
美国政府 L4 |
美国政府 L5 (DOD) |
由世纪互联运营的中国 |
| ✅ |
✅ |
✅ |
✅ |
权限
要调用此 API，需要以下权限之一。 若要了解详细信息，包括如何选择权限的信息，请参阅权限。
对于目录 (Microsoft Entra ID) 提供程序
| 权限类型 |
权限（从最低特权到最高特权） |
| 委派（工作或学校帐户） |
RoleManagement.ReadWrite.Directory |
| 委派（个人 Microsoft 帐户） |
不支持。 |
| 应用程序 |
RoleManagement.ReadWrite.Directory |
重要
在具有工作或学校帐户的委托方案中，必须为登录用户分配受支持的Microsoft Entra角色或具有支持的角色权限的自定义角色。
特权角色管理员 是此操作支持的最低特权角色。
对于权利管理提供程序
| 权限类型 |
权限（从最低特权到最高特权） |
| 委派（工作或学校帐户） |
EntitlementManagement.ReadWrite.All |
| 委派（个人 Microsoft 帐户） |
不支持。 |
| 应用程序 |
不支持。 |
对于Exchange Online提供程序
| 权限类型 |
权限（从最低特权到最高特权） |
| 委派（工作或学校帐户） |
RoleManagement.ReadWrite.Exchange |
| 委派（个人 Microsoft 帐户） |
不支持。 |
| 应用程序 |
RoleManagement.ReadWrite.Exchange |
HTTP 请求
为目录提供程序创建角色分配：
POST /roleManagement/directory/roleAssignments
为权利管理提供程序创建角色分配：
POST /roleManagement/entitlementManagement/roleAssignments
为Exchange Online提供程序创建角色分配：
POST /roleManagement/exchange/roleAssignments
| 名称 |
说明 |
| Authorization |
持有者 {token}。 必填。 详细了解 身份验证和授权。 |
请求正文
在请求正文中，提供 unifiedRoleAssignment 对象的 JSON 表示形式。
创建 unifiedRoleAssignment 时，可以指定以下属性。
| 属性 |
类型 |
说明 |
| appScopeId |
String |
必填。 分配范围特定于应用的作用域的标识符。 分配的范围确定已向其授予主体访问权限的资源集。 应用范围是仅由资源应用程序定义和理解的范围。
对于权利管理提供程序，请使用此属性指定目录，例如 /AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997。
必须指定 appScopeId 或 directoryScopeId 。 |
| directoryScopeId |
String |
必填。 表示分配范围的 目录对象的 标识符。 分配的范围确定已向其授予主体访问权限的资源集。 目录范围是存储在目录中的共享范围，可由多个应用程序理解，这与仅由资源应用程序定义和理解的应用范围不同。
对于目录 (Microsoft Entra ID) 提供程序，此属性支持以下格式：
/ 租户范围
/administrativeUnits/{administrativeunit-ID} 将 范围限定为管理单元
/{application-objectID} 将范围限定为资源应用程序
/attributeSets/{attributeSet-ID} 将范围限定为属性集
对于权利管理提供程序， / 适用于租户范围。 若要限定为访问包目录，请使用 appScopeId 属性。
对于Exchange Online提供程序，此属性支持以下格式：
/ 租户范围
/Users/{ObjectId of user} 将角色分配范围限定为特定用户
/AdministrativeUnits/{ObjectId of AU} 将角色分配范围限定为管理单元
/Groups/{ObjectId of group} 将角色权限限定为定向特定组的成员
必须指定 appScopeId 或 directoryScopeId 。 |
| principalId |
String |
必填。 向其授予分配的主体的标识符。 |
| roleDefinitionId |
String |
分配所针对的 unifiedRoleDefinition 的标识符。 只读。 支持 $filter（eq、in）。 |
响应
如果成功，此方法在响应正文中返回响应 201 Created 代码和新的 unifiedRoleAssignment 对象。
示例
示例 1：创建具有租户范围的角色分配
请求
以下示例显示了一个请求。 请注意，将 roleTemplateId 用于 roleDefinitionId。 roleDefinitionId 可以是服务范围的模板 ID 或特定于目录的 roleDefinitionId。
POST https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments
Content-type: application/json
{
"@odata.type": "#microsoft.graph.unifiedRoleAssignment",
"roleDefinitionId": "c2cf284d-6c41-4e6b-afac-4b80928c9034",
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
"directoryScopeId": "/"
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new UnifiedRoleAssignment
{
OdataType = "#microsoft.graph.unifiedRoleAssignment",
RoleDefinitionId = "c2cf284d-6c41-4e6b-afac-4b80928c9034",
PrincipalId = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
DirectoryScopeId = "/",
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.Directory.RoleAssignments.PostAsync(requestBody);
mgc-beta role-management directory role-assignments create --body '{\
"@odata.type": "#microsoft.graph.unifiedRoleAssignment",\
"roleDefinitionId": "c2cf284d-6c41-4e6b-afac-4b80928c9034",\
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",\
"directoryScopeId": "/"\
}\
'
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewUnifiedRoleAssignment()
roleDefinitionId := "c2cf284d-6c41-4e6b-afac-4b80928c9034"
requestBody.SetRoleDefinitionId(&roleDefinitionId)
principalId := "f8ca5a85-489a-49a0-b555-0a6d81e56f0d"
requestBody.SetPrincipalId(&principalId)
directoryScopeId := "/"
requestBody.SetDirectoryScopeId(&directoryScopeId)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().Directory().RoleAssignments().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignment unifiedRoleAssignment = new UnifiedRoleAssignment();
unifiedRoleAssignment.setOdataType("#microsoft.graph.unifiedRoleAssignment");
unifiedRoleAssignment.setRoleDefinitionId("c2cf284d-6c41-4e6b-afac-4b80928c9034");
unifiedRoleAssignment.setPrincipalId("f8ca5a85-489a-49a0-b555-0a6d81e56f0d");
unifiedRoleAssignment.setDirectoryScopeId("/");
UnifiedRoleAssignment result = graphClient.roleManagement().directory().roleAssignments().post(unifiedRoleAssignment);
const options = {
authProvider,
};
const client = Client.init(options);
const unifiedRoleAssignment = {
'@odata.type': '#microsoft.graph.unifiedRoleAssignment',
roleDefinitionId: 'c2cf284d-6c41-4e6b-afac-4b80928c9034',
principalId: 'f8ca5a85-489a-49a0-b555-0a6d81e56f0d',
directoryScopeId: '/'
};
await client.api('/roleManagement/directory/roleAssignments')
.version('beta')
.post(unifiedRoleAssignment);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\UnifiedRoleAssignment;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new UnifiedRoleAssignment();
$requestBody->setOdataType('#microsoft.graph.unifiedRoleAssignment');
$requestBody->setRoleDefinitionId('c2cf284d-6c41-4e6b-afac-4b80928c9034');
$requestBody->setPrincipalId('f8ca5a85-489a-49a0-b555-0a6d81e56f0d');
$requestBody->setDirectoryScopeId('/');
$result = $graphServiceClient->roleManagement()->directory()->roleAssignments()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
$params = @{
"@odata.type" = "#microsoft.graph.unifiedRoleAssignment"
roleDefinitionId = "c2cf284d-6c41-4e6b-afac-4b80928c9034"
principalId = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d"
directoryScopeId = "/"
}
New-MgBetaRoleManagementDirectoryRoleAssignment -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.unified_role_assignment import UnifiedRoleAssignment
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = UnifiedRoleAssignment(
odata_type = "#microsoft.graph.unifiedRoleAssignment",
role_definition_id = "c2cf284d-6c41-4e6b-afac-4b80928c9034",
principal_id = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
directory_scope_id = "/",
)
result = await graph_client.role_management.directory.role_assignments.post(request_body)
响应
以下示例显示了相应的响应。
注意：为了提高可读性，可能缩短了此处显示的响应对象。
HTTP/1.1 201 Created
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleAssignments/$entity",
"id": "YUb1sHQtUEyvox7IA_Eu_mm3jqnUe4lEhvatluHVi2I-1",
"roleDefinitionId": "c2cf284d-6c41-4e6b-afac-4b80928c9034",
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
"directoryScopeId": "/"
}
示例 2：创建具有管理单元范围的角色分配
请求
以下示例将用户管理员角色分配给具有管理单元范围的主体。
POST https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments
Content-type: application/json
{
"@odata.type": "#microsoft.graph.unifiedRoleAssignment",
"roleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1",
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
"directoryScopeId": "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a"
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new UnifiedRoleAssignment
{
OdataType = "#microsoft.graph.unifiedRoleAssignment",
RoleDefinitionId = "fe930be7-5e62-47db-91af-98c3a49a38b1",
PrincipalId = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
DirectoryScopeId = "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a",
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.Directory.RoleAssignments.PostAsync(requestBody);
mgc-beta role-management directory role-assignments create --body '{\
"@odata.type": "#microsoft.graph.unifiedRoleAssignment",\
"roleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1",\
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",\
"directoryScopeId": "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a"\
}\
'
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewUnifiedRoleAssignment()
roleDefinitionId := "fe930be7-5e62-47db-91af-98c3a49a38b1"
requestBody.SetRoleDefinitionId(&roleDefinitionId)
principalId := "f8ca5a85-489a-49a0-b555-0a6d81e56f0d"
requestBody.SetPrincipalId(&principalId)
directoryScopeId := "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a"
requestBody.SetDirectoryScopeId(&directoryScopeId)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().Directory().RoleAssignments().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignment unifiedRoleAssignment = new UnifiedRoleAssignment();
unifiedRoleAssignment.setOdataType("#microsoft.graph.unifiedRoleAssignment");
unifiedRoleAssignment.setRoleDefinitionId("fe930be7-5e62-47db-91af-98c3a49a38b1");
unifiedRoleAssignment.setPrincipalId("f8ca5a85-489a-49a0-b555-0a6d81e56f0d");
unifiedRoleAssignment.setDirectoryScopeId("/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a");
UnifiedRoleAssignment result = graphClient.roleManagement().directory().roleAssignments().post(unifiedRoleAssignment);
const options = {
authProvider,
};
const client = Client.init(options);
const unifiedRoleAssignment = {
'@odata.type': '#microsoft.graph.unifiedRoleAssignment',
roleDefinitionId: 'fe930be7-5e62-47db-91af-98c3a49a38b1',
principalId: 'f8ca5a85-489a-49a0-b555-0a6d81e56f0d',
directoryScopeId: '/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a'
};
await client.api('/roleManagement/directory/roleAssignments')
.version('beta')
.post(unifiedRoleAssignment);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\UnifiedRoleAssignment;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new UnifiedRoleAssignment();
$requestBody->setOdataType('#microsoft.graph.unifiedRoleAssignment');
$requestBody->setRoleDefinitionId('fe930be7-5e62-47db-91af-98c3a49a38b1');
$requestBody->setPrincipalId('f8ca5a85-489a-49a0-b555-0a6d81e56f0d');
$requestBody->setDirectoryScopeId('/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a');
$result = $graphServiceClient->roleManagement()->directory()->roleAssignments()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
$params = @{
"@odata.type" = "#microsoft.graph.unifiedRoleAssignment"
roleDefinitionId = "fe930be7-5e62-47db-91af-98c3a49a38b1"
principalId = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d"
directoryScopeId = "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a"
}
New-MgBetaRoleManagementDirectoryRoleAssignment -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.unified_role_assignment import UnifiedRoleAssignment
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = UnifiedRoleAssignment(
odata_type = "#microsoft.graph.unifiedRoleAssignment",
role_definition_id = "fe930be7-5e62-47db-91af-98c3a49a38b1",
principal_id = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
directory_scope_id = "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a",
)
result = await graph_client.role_management.directory.role_assignments.post(request_body)
响应
以下示例显示了相应的响应。
注意：为了提高可读性，可能缩短了此处显示的响应对象。
HTTP/1.1 201 Created
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleAssignments/$entity",
"id": "BH21sHQtUEyvox7IA_Eu_mm3jqnUe4lEhvatluHIWb7-1",
"roleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1",
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
"directoryScopeId": "/administrativeUnits/5d107bba-d8e2-4e13-b6ae-884be90e5d1a"
}
示例 3：创建具有属性集范围的角色分配
请求
以下示例将属性分配管理员角色分配给具有名为 Engineering 的属性集范围的主体。 有关Microsoft Entra自定义安全属性和属性集范围的详细信息，请参阅在 Microsoft Entra ID 中管理对自定义安全属性的访问。
POST https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments
Content-type: application/json
{
"@odata.type": "#microsoft.graph.unifiedRoleAssignment",
"roleDefinitionId": "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
"directoryScopeId": "/attributeSets/Engineering"
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new UnifiedRoleAssignment
{
OdataType = "#microsoft.graph.unifiedRoleAssignment",
RoleDefinitionId = "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",
PrincipalId = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
DirectoryScopeId = "/attributeSets/Engineering",
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.Directory.RoleAssignments.PostAsync(requestBody);
mgc-beta role-management directory role-assignments create --body '{\
"@odata.type": "#microsoft.graph.unifiedRoleAssignment",\
"roleDefinitionId": "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",\
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",\
"directoryScopeId": "/attributeSets/Engineering"\
}\
'
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewUnifiedRoleAssignment()
roleDefinitionId := "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d"
requestBody.SetRoleDefinitionId(&roleDefinitionId)
principalId := "f8ca5a85-489a-49a0-b555-0a6d81e56f0d"
requestBody.SetPrincipalId(&principalId)
directoryScopeId := "/attributeSets/Engineering"
requestBody.SetDirectoryScopeId(&directoryScopeId)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().Directory().RoleAssignments().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignment unifiedRoleAssignment = new UnifiedRoleAssignment();
unifiedRoleAssignment.setOdataType("#microsoft.graph.unifiedRoleAssignment");
unifiedRoleAssignment.setRoleDefinitionId("58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d");
unifiedRoleAssignment.setPrincipalId("f8ca5a85-489a-49a0-b555-0a6d81e56f0d");
unifiedRoleAssignment.setDirectoryScopeId("/attributeSets/Engineering");
UnifiedRoleAssignment result = graphClient.roleManagement().directory().roleAssignments().post(unifiedRoleAssignment);
const options = {
authProvider,
};
const client = Client.init(options);
const unifiedRoleAssignment = {
'@odata.type': '#microsoft.graph.unifiedRoleAssignment',
roleDefinitionId: '58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d',
principalId: 'f8ca5a85-489a-49a0-b555-0a6d81e56f0d',
directoryScopeId: '/attributeSets/Engineering'
};
await client.api('/roleManagement/directory/roleAssignments')
.version('beta')
.post(unifiedRoleAssignment);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\UnifiedRoleAssignment;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new UnifiedRoleAssignment();
$requestBody->setOdataType('#microsoft.graph.unifiedRoleAssignment');
$requestBody->setRoleDefinitionId('58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d');
$requestBody->setPrincipalId('f8ca5a85-489a-49a0-b555-0a6d81e56f0d');
$requestBody->setDirectoryScopeId('/attributeSets/Engineering');
$result = $graphServiceClient->roleManagement()->directory()->roleAssignments()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
$params = @{
"@odata.type" = "#microsoft.graph.unifiedRoleAssignment"
roleDefinitionId = "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d"
principalId = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d"
directoryScopeId = "/attributeSets/Engineering"
}
New-MgBetaRoleManagementDirectoryRoleAssignment -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.unified_role_assignment import UnifiedRoleAssignment
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = UnifiedRoleAssignment(
odata_type = "#microsoft.graph.unifiedRoleAssignment",
role_definition_id = "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",
principal_id = "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
directory_scope_id = "/attributeSets/Engineering",
)
result = await graph_client.role_management.directory.role_assignments.post(request_body)
响应
以下示例显示了相应的响应。
注意：为了提高可读性，可能缩短了此处显示的响应对象。
HTTP/1.1 201 Created
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/directory/roleAssignments/$entity",
"id": "oz6hWDLGrkae4JwNQ81_PU-mYqx8m71OpqEQPdN1u",
"roleDefinitionId": "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",
"principalId": "f8ca5a85-489a-49a0-b555-0a6d81e56f0d",
"directoryScopeId": "/attributeSets/Engineering"
}
示例 4：创建具有访问包目录范围的角色分配
请求
以下示例显示了一个请求。
POST https://graph.microsoft.com/beta/roleManagement/entitlementManagement/roleAssignments
Content-type: application/json
{
"principalId": "679a9213-c497-48a4-830a-8d3d25d94ddc",
"roleDefinitionId": "ae79f266-94d4-4dab-b730-feca7e132178",
"appScopeId": "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997"
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new UnifiedRoleAssignment
{
PrincipalId = "679a9213-c497-48a4-830a-8d3d25d94ddc",
RoleDefinitionId = "ae79f266-94d4-4dab-b730-feca7e132178",
AppScopeId = "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997",
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.EntitlementManagement.RoleAssignments.PostAsync(requestBody);
mgc-beta role-management entitlement-management role-assignments create --body '{\
"principalId": "679a9213-c497-48a4-830a-8d3d25d94ddc",\
"roleDefinitionId": "ae79f266-94d4-4dab-b730-feca7e132178",\
"appScopeId": "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997"\
}\
'
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewUnifiedRoleAssignment()
principalId := "679a9213-c497-48a4-830a-8d3d25d94ddc"
requestBody.SetPrincipalId(&principalId)
roleDefinitionId := "ae79f266-94d4-4dab-b730-feca7e132178"
requestBody.SetRoleDefinitionId(&roleDefinitionId)
appScopeId := "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997"
requestBody.SetAppScopeId(&appScopeId)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().EntitlementManagement().RoleAssignments().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignment unifiedRoleAssignment = new UnifiedRoleAssignment();
unifiedRoleAssignment.setPrincipalId("679a9213-c497-48a4-830a-8d3d25d94ddc");
unifiedRoleAssignment.setRoleDefinitionId("ae79f266-94d4-4dab-b730-feca7e132178");
unifiedRoleAssignment.setAppScopeId("/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997");
UnifiedRoleAssignment result = graphClient.roleManagement().entitlementManagement().roleAssignments().post(unifiedRoleAssignment);
const options = {
authProvider,
};
const client = Client.init(options);
const unifiedRoleAssignment = {
principalId: '679a9213-c497-48a4-830a-8d3d25d94ddc',
roleDefinitionId: 'ae79f266-94d4-4dab-b730-feca7e132178',
appScopeId: '/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997'
};
await client.api('/roleManagement/entitlementManagement/roleAssignments')
.version('beta')
.post(unifiedRoleAssignment);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\UnifiedRoleAssignment;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new UnifiedRoleAssignment();
$requestBody->setPrincipalId('679a9213-c497-48a4-830a-8d3d25d94ddc');
$requestBody->setRoleDefinitionId('ae79f266-94d4-4dab-b730-feca7e132178');
$requestBody->setAppScopeId('/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997');
$result = $graphServiceClient->roleManagement()->entitlementManagement()->roleAssignments()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.Identity.Governance
$params = @{
principalId = "679a9213-c497-48a4-830a-8d3d25d94ddc"
roleDefinitionId = "ae79f266-94d4-4dab-b730-feca7e132178"
appScopeId = "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997"
}
New-MgBetaRoleManagementEntitlementManagementRoleAssignment -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.unified_role_assignment import UnifiedRoleAssignment
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = UnifiedRoleAssignment(
principal_id = "679a9213-c497-48a4-830a-8d3d25d94ddc",
role_definition_id = "ae79f266-94d4-4dab-b730-feca7e132178",
app_scope_id = "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997",
)
result = await graph_client.role_management.entitlement_management.role_assignments.post(request_body)
响应
以下示例显示了相应的响应。
注意：为了提高可读性，可能缩短了此处显示的响应对象。
HTTP/1.1 201 Created
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/entitlementManagement/roleAssignments/$entity",
"id": "f3092518-7874-462e-93e9-0cd6c11ffc52",
"principalId": "679a9213-c497-48a4-830a-8d3d25d94ddc",
"roleDefinitionId": "ae79f266-94d4-4dab-b730-feca7e132178",
"appScopeId": "/AccessPackageCatalog/beedadfe-01d5-4025-910b-84abb9369997"
}
示例 5：为具有管理单元范围的Exchange Online提供程序创建角色分配
请求
以下示例显示了一个请求。
POST https://graph.microsoft.com/beta/roleManagement/exchange/roleAssignments
Content-type: application/json
{
"principalId": "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece",
"roleDefinitionId": "f66ab1ee-3cac-4d03-8a64-dadc56e563f8",
"directoryScopeId": "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb",
"appScopeId": null
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new UnifiedRoleAssignment
{
PrincipalId = "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece",
RoleDefinitionId = "f66ab1ee-3cac-4d03-8a64-dadc56e563f8",
DirectoryScopeId = "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb",
AppScopeId = null,
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.RoleManagement.Exchange.RoleAssignments.PostAsync(requestBody);
mgc-beta role-management exchange role-assignments create --body '{\
"principalId": "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece",\
"roleDefinitionId": "f66ab1ee-3cac-4d03-8a64-dadc56e563f8",\
"directoryScopeId": "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb",\
"appScopeId": null\
}\
'
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewUnifiedRoleAssignment()
principalId := "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece"
requestBody.SetPrincipalId(&principalId)
roleDefinitionId := "f66ab1ee-3cac-4d03-8a64-dadc56e563f8"
requestBody.SetRoleDefinitionId(&roleDefinitionId)
directoryScopeId := "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb"
requestBody.SetDirectoryScopeId(&directoryScopeId)
appScopeId := null
requestBody.SetAppScopeId(&appScopeId)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
roleAssignments, err := graphClient.RoleManagement().Exchange().RoleAssignments().Post(context.Background(), requestBody, nil)
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
UnifiedRoleAssignment unifiedRoleAssignment = new UnifiedRoleAssignment();
unifiedRoleAssignment.setPrincipalId("/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece");
unifiedRoleAssignment.setRoleDefinitionId("f66ab1ee-3cac-4d03-8a64-dadc56e563f8");
unifiedRoleAssignment.setDirectoryScopeId("/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb");
unifiedRoleAssignment.setAppScopeId(null);
UnifiedRoleAssignment result = graphClient.roleManagement().exchange().roleAssignments().post(unifiedRoleAssignment);
const options = {
authProvider,
};
const client = Client.init(options);
const unifiedRoleAssignment = {
principalId: '/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece',
roleDefinitionId: 'f66ab1ee-3cac-4d03-8a64-dadc56e563f8',
directoryScopeId: '/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb',
appScopeId: null
};
await client.api('/roleManagement/exchange/roleAssignments')
.version('beta')
.post(unifiedRoleAssignment);
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\UnifiedRoleAssignment;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new UnifiedRoleAssignment();
$requestBody->setPrincipalId('/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece');
$requestBody->setRoleDefinitionId('f66ab1ee-3cac-4d03-8a64-dadc56e563f8');
$requestBody->setDirectoryScopeId('/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb');
$requestBody->setAppScopeId(null);
$result = $graphServiceClient->roleManagement()->exchange()->roleAssignments()->post($requestBody)->wait();
Import-Module Microsoft.Graph.Beta.DeviceManagement.Enrollment
$params = @{
principalId = "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece"
roleDefinitionId = "f66ab1ee-3cac-4d03-8a64-dadc56e563f8"
directoryScopeId = "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb"
appScopeId = $null
}
New-MgBetaRoleManagementExchangeRoleAssignment -BodyParameter $params
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.unified_role_assignment import UnifiedRoleAssignment
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = UnifiedRoleAssignment(
principal_id = "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece",
role_definition_id = "f66ab1ee-3cac-4d03-8a64-dadc56e563f8",
directory_scope_id = "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb",
app_scope_id = None,
)
result = await graph_client.role_management.exchange.role_assignments.post(request_body)
响应
以下示例显示了相应的响应。
HTTP/1.1 201 Created
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#roleManagement/exchange/roleAssignments/$entity",
"id": "c5dd3ab8-374f-42e9-b163-eb7c54b53755",
"principalId": "/ServicePrincipals/0451dbb9-6336-42ea-b58f-5953dc053ece",
"roleDefinitionId": "f66ab1ee-3cac-4d03-8a64-dadc56e563f8",
"directoryScopeId": "/AdministrativeUnits/8b532c7a-4d3e-4e99-8ffa-2dfec92c62eb",
"appScopeId": null
}