@@ -37,7 +37,7 @@ App consent policies where the ID begins with "microsoft-" are built-in policies
37
37
38
38
:::zone pivot="ms-powershell"
39
39
40
- 1 . Connect to [ Microsoft Graph PowerShell] ( /powershell/microsoftgraph/get-started?view=graph-powershell-1.0&preserve-view=true ) .
40
+ 2 . Connect to [ Microsoft Graph PowerShell] ( /powershell/microsoftgraph/get-started?view=graph-powershell-1.0&preserve-view=true ) .
41
41
42
42
``` powershell
43
43
Connect-MgGraph -Scopes "Policy.ReadWrite.PermissionGrant"
@@ -129,67 +129,67 @@ It's a good idea to start by getting familiar with the existing app consent poli
129
129
130
130
1 . List all app consent policies:
131
131
132
- ``` http
133
- GET /policies/permissionGrantPolicies?$select=id,displayName,description
134
- ```
132
+ ``` http
133
+ GET /policies/permissionGrantPolicies?$select=id,displayName,description
134
+ ```
135
135
136
136
1 . View the "include" condition sets of a policy:
137
137
138
- ``` http
139
- GET /policies/permissionGrantPolicies/{ microsoft-application-admin }/includes
140
- ```
138
+ ``` http
139
+ GET /policies/permissionGrantPolicies/{ microsoft-application-admin }/includes
140
+ ```
141
141
142
142
1 . View the "exclude" condition sets:
143
143
144
- ``` http
145
- GET /policies/permissionGrantPolicies/{ microsoft-application-admin }/excludes
146
- ```
144
+ ``` http
145
+ GET /policies/permissionGrantPolicies/{ microsoft-application-admin }/excludes
146
+ ```
147
147
148
148
## Create a custom app consent policy
149
149
150
150
Follow these steps to create a custom app consent policy:
151
151
152
152
1 . Create a new empty app consent policy.
153
153
154
- ``` http
155
- POST https://graph.microsoft.com/v1.0/policies/permissionGrantPolicies
156
- Content-Type: application/json
157
-
158
- {
159
- "id": "my-custom-policy",
160
- "displayName": "My first custom consent policy",
161
- "description": "This is a sample custom app consent policy"
162
- }
163
- ```
154
+ ``` http
155
+ POST https://graph.microsoft.com/v1.0/policies/permissionGrantPolicies
156
+ Content-Type: application/json
157
+
158
+ {
159
+ "id": "my-custom-policy",
160
+ "displayName": "My first custom consent policy",
161
+ "description": "This is a sample custom app consent policy"
162
+ }
163
+ ```
164
164
165
165
1 . Add "include" condition sets.
166
166
167
167
Include delegated permissions classified "low", for apps from verified publishers
168
168
169
- ``` http
170
- POST https://graph.microsoft.com/v1.0/policies/permissionGrantPolicies/{ my-custom-policy }/includes
171
- Content-Type: application/json
172
-
173
- {
174
- "permissionType": "delegated",
175
- “PermissionClassification: "low",
176
- "clientApplicationsFromVerifiedPublisherOnly": true
177
- }
178
- ```
169
+ ``` http
170
+ POST https://graph.microsoft.com/v1.0/policies/permissionGrantPolicies/{ my-custom-policy }/includes
171
+ Content-Type: application/json
172
+
173
+ {
174
+ "permissionType": "delegated",
175
+ “PermissionClassification: "low",
176
+ "clientApplicationsFromVerifiedPublisherOnly": true
177
+ }
178
+ ```
179
179
180
180
Repeat this step to add more "include" condition sets.
181
181
182
182
1 . Optionally, add "exclude" condition sets.
183
183
Exclude delegated permissions for the Azure Management API (appId 46e6adf4-a9cf-4b60-9390-0ba6fb00bf6b)
184
- ``` http
185
- POST https://graph.microsoft.com/v1.0/policies/permissionGrantPolicies/my-custom-policy /excludes
186
- Content-Type: application/json
187
-
188
- {
189
- "permissionType": "delegated",
190
- "resourceApplication": "46e6adf4-a9cf-4b60-9390-0ba6fb00bf6b "
191
- }
192
- ```
184
+ ``` http
185
+ POST https://graph.microsoft.com/v1.0/policies/permissionGrantPolicies/my-custom-policy /excludes
186
+ Content-Type: application/json
187
+
188
+ {
189
+ "permissionType": "delegated",
190
+ "resourceApplication": "46e6adf4-a9cf-4b60-9390-0ba6fb00bf6b "
191
+ }
192
+ ```
193
193
194
194
Repeat this step to add more "exclude" condition sets.
195
195
0 commit comments