New-MgPolicyPermissionGrantPolicyInclude

Reference

Module:: Microsoft.Graph.Identity.SignIns

Add conditions under which a permission grant event is included in a permission grant policy. You do this by adding a permissionGrantConditionSet to the includes collection of a permissionGrantPolicy.

Note

To view the beta release of this cmdlet, view New-MgBetaPolicyPermissionGrantPolicyInclude

Syntax

New-MgPolicyPermissionGrantPolicyInclude
   -PermissionGrantPolicyId <String>
   [-ResponseHeadersVariable <String>]
   [-AdditionalProperties <Hashtable>]
   [-ClientApplicationIds <String[]>]
   [-ClientApplicationPublisherIds <String[]>]
   [-ClientApplicationTenantIds <String[]>]
   [-ClientApplicationsFromVerifiedPublisherOnly]
   [-Id <String>]
   [-PermissionClassification <String>]
   [-PermissionType <String>]
   [-Permissions <String[]>]
   [-ResourceApplication <String>]
   [-Headers <IDictionary>]
   [-ProgressAction <ActionPreference>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

New-MgPolicyPermissionGrantPolicyInclude
   -PermissionGrantPolicyId <String>
   -BodyParameter <IMicrosoftGraphPermissionGrantConditionSet>
   [-ResponseHeadersVariable <String>]
   [-Headers <IDictionary>]
   [-ProgressAction <ActionPreference>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

New-MgPolicyPermissionGrantPolicyInclude
   -InputObject <IIdentitySignInsIdentity>
   [-ResponseHeadersVariable <String>]
   [-AdditionalProperties <Hashtable>]
   [-ClientApplicationIds <String[]>]
   [-ClientApplicationPublisherIds <String[]>]
   [-ClientApplicationTenantIds <String[]>]
   [-ClientApplicationsFromVerifiedPublisherOnly]
   [-Id <String>]
   [-PermissionClassification <String>]
   [-PermissionType <String>]
   [-Permissions <String[]>]
   [-ResourceApplication <String>]
   [-Headers <IDictionary>]
   [-ProgressAction <ActionPreference>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

New-MgPolicyPermissionGrantPolicyInclude
   -InputObject <IIdentitySignInsIdentity>
   -BodyParameter <IMicrosoftGraphPermissionGrantConditionSet>
   [-ResponseHeadersVariable <String>]
   [-Headers <IDictionary>]
   [-ProgressAction <ActionPreference>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Description

Permissions

Permission type	Least privileged permissions	Higher privileged permissions
Delegated (work or school account)	Policy.ReadWrite.PermissionGrant	Not available.
Delegated (personal Microsoft account)	Not supported.	Not supported.
Application	Policy.ReadWrite.PermissionGrant	Not available.

Examples

Example 1: Create a permission grant policy include

Connect-MgGraph -Scopes "Policy.Read.PermissionGrant,Policy.ReadWrite.PermissionGrant"  
New-MgPolicyPermissionGrantPolicyInclude -PermissionGrantPolicyId "testtenant-sampleapp-permissions" -PermissionType "application" -ResourceApplication "00000000-0000-0000-0000-000000000000" -Permissions "00000000-0000-0000-0000-000000000000"  | fl

ClientApplicationIds                        : {all}
ClientApplicationPublisherIds               : {all}
ClientApplicationTenantIds                  : {all}
ClientApplicationsFromVerifiedPublisherOnly : False
Id                                          : 084b9abc-cf56-4d84-bdb0-5ad8f3a51038
PermissionClassification                    : all
PermissionType                              : application
Permissions                                 : {00000000-0000-0000-0000-000000000000}
ResourceApplication                         : 00000000-0000-0000-0000-000000000000
AdditionalProperties                        : {[@odata.context, https://graph.microsoft.com/v1.0/$metadata#policies/permissionGrantPolicies('testtenant-sampleapp-permissions')/includes/$entity]}

This command creates a new permission grant policy include configuration for the specified permission grant policy in Azure AD.

Parameters

-AdditionalProperties

Additional Parameters

Type:	Hashtable
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-BodyParameter

permissionGrantConditionSet To construct, see NOTES section for BODYPARAMETER properties and create a hash table.

Type:	IMicrosoftGraphPermissionGrantConditionSet
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-ClientApplicationIds

A list of appId values for the client applications to match with, or a list with the single value all to match any client application. Default is the single value all.

Type:	String[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ClientApplicationPublisherIds

A list of Microsoft Partner Network (MPN) IDs for verified publishers of the client application, or a list with the single value all to match with client apps from any publisher. Default is the single value all.

Type:	String[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ClientApplicationsFromVerifiedPublisherOnly

Set to true to only match on client applications with a verified publisher. Set to false to match on any client app, even if it doesn't have a verified publisher. Default is false.

Type:	SwitchParameter
Position:	Named
Default value:	False
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ClientApplicationTenantIds

A list of Microsoft Entra tenant IDs in which the client application is registered, or a list with the single value all to match with client apps registered in any tenant. Default is the single value all.

Type:	String[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type:	SwitchParameter
Aliases:	cf
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Headers

Optional headers that will be added to the request.

Type:	IDictionary
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-Id

The unique identifier for an entity. Read-only.

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-InputObject

Identity Parameter To construct, see NOTES section for INPUTOBJECT properties and create a hash table.

Type:	IIdentitySignInsIdentity
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-PermissionClassification

The permission classification for the permission being granted, or all to match with any permission classification (including permissions that aren't classified). Default is all.

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-PermissionGrantPolicyId

The unique identifier of permissionGrantPolicy

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-Permissions

The list of id values for the specific permissions to match with, or a list with the single value all to match with any permission. The id of delegated permissions can be found in the oauth2PermissionScopes property of the API's servicePrincipal object. The id of application permissions can be found in the appRoles property of the API's servicePrincipal object. The id of resource-specific application permissions can be found in the resourceSpecificApplicationPermissions property of the API's servicePrincipal object. Default is the single value all.

Type:	String[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-PermissionType

permissionType

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ProgressAction

Type:	ActionPreference
Aliases:	proga
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ResourceApplication

The appId of the resource application (for example the API) for which a permission is being granted, or any to match with any resource application or API. Default is any.

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ResponseHeadersVariable

Optional Response Headers Variable.

Type:	String
Aliases:	RHV
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type:	SwitchParameter
Aliases:	wi
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

Inputs

Microsoft.Graph.PowerShell.Models.IIdentitySignInsIdentity

Microsoft.Graph.PowerShell.Models.IMicrosoftGraphPermissionGrantConditionSet

System.Collections.IDictionary

Outputs