permission_grant_policies_excludes

Creates, updates, deletes, gets or lists a permission_grant_policies_excludes resource.

Overview

Name	permission_grant_policies_excludes
Type	Resource
Id	entra_id.policies.permission_grant_policies_excludes

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
clientApplicationIds	array	A list of appId values for the client applications to match with, or a list with the single value all to match any client application. Default is the single value all.
clientApplicationPublisherIds	array	A list of Microsoft Partner Network (MPN) IDs for verified publishers of the client application, or a list with the single value all to match with client apps from any publisher. Default is the single value all.
clientApplicationTenantIds	array	A list of Microsoft Entra tenant IDs in which the client application is registered, or a list with the single value all to match with client apps registered in any tenant. Default is the single value all.
clientApplicationsFromVerifiedPublisherOnly	boolean	Set to true to only match on client applications with a verified publisher. Set to false to match on any client app, even if it doesn't have a verified publisher. Default is false.
permissionClassification	string	The permission classification for the permission being granted, or all to match with any permission classification (including permissions that aren't classified). Default is all.
permissionType		The permission type of the permission being granted. Possible values: application for application permissions (for example app roles), or delegated for delegated permissions. The value delegatedUserConsentable indicates delegated permissions that haven't been configured by the API publisher to require admin consent—this value may be used in built-in permission grant policies, but can't be used in custom permission grant policies. Required.
permissions	array	The list of id values for the specific permissions to match with, or a list with the single value all to match with any permission. The id of delegated permissions can be found in the oauth2PermissionScopes property of the API's servicePrincipal object. The id of application permissions can be found in the appRoles property of the API's servicePrincipal object. The id of resource-specific application permissions can be found in the resourceSpecificApplicationPermissions property of the API's servicePrincipal object. Default is the single value all.
resourceApplication	string	The appId of the resource application (for example the API) for which a permission is being granted, or any to match with any resource application or API. Default is any.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
clientApplicationIds	array	A list of appId values for the client applications to match with, or a list with the single value all to match any client application. Default is the single value all.
clientApplicationPublisherIds	array	A list of Microsoft Partner Network (MPN) IDs for verified publishers of the client application, or a list with the single value all to match with client apps from any publisher. Default is the single value all.
clientApplicationTenantIds	array	A list of Microsoft Entra tenant IDs in which the client application is registered, or a list with the single value all to match with client apps registered in any tenant. Default is the single value all.
clientApplicationsFromVerifiedPublisherOnly	boolean	Set to true to only match on client applications with a verified publisher. Set to false to match on any client app, even if it doesn't have a verified publisher. Default is false.
permissionClassification	string	The permission classification for the permission being granted, or all to match with any permission classification (including permissions that aren't classified). Default is all.
permissionType		The permission type of the permission being granted. Possible values: application for application permissions (for example app roles), or delegated for delegated permissions. The value delegatedUserConsentable indicates delegated permissions that haven't been configured by the API publisher to require admin consent—this value may be used in built-in permission grant policies, but can't be used in custom permission grant policies. Required.
permissions	array	The list of id values for the specific permissions to match with, or a list with the single value all to match with any permission. The id of delegated permissions can be found in the oauth2PermissionScopes property of the API's servicePrincipal object. The id of application permissions can be found in the appRoles property of the API's servicePrincipal object. The id of resource-specific application permissions can be found in the resourceSpecificApplicationPermissions property of the API's servicePrincipal object. Default is the single value all.
resourceApplication	string	The appId of the resource application (for example the API) for which a permission is being granted, or any to match with any resource application or API. Default is any.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	permission_grant_policy_id, permission_grant_condition_set_id		Condition sets that are excluded in this permission grant policy. Automatically expanded on GET.
list	select	permission_grant_policy_id		Retrieve the condition sets which are excluded in a permissionGrantPolicy.
insert	insert	permission_grant_policy_id		Add conditions under which a permission grant event is excluded in a permission grant policy. You do this by adding a permissionGrantConditionSet to the excludes collection of a permissionGrantPolicy.
update	update	permission_grant_policy_id, permission_grant_condition_set_id
delete	delete	permission_grant_policy_id, permission_grant_condition_set_id	If-Match	Deletes a permissionGrantConditionSet from the excludes collection of a permissionGrantPolicy.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
permission_grant_condition_set_id	string	The unique identifier of permissionGrantConditionSet
permission_grant_policy_id	string	The unique identifier of permissionGrantPolicy
If-Match	string	ETag

SELECT examples

get

Condition sets that are excluded in this permission grant policy. Automatically expanded on GET.

SELECT
id,
clientApplicationIds,
clientApplicationPublisherIds,
clientApplicationTenantIds,
clientApplicationsFromVerifiedPublisherOnly,
permissionClassification,
permissionType,
permissions,
resourceApplication
FROM entra_id.policies.permission_grant_policies_excludes
WHERE permission_grant_policy_id = '{{ permission_grant_policy_id }}' -- required
AND permission_grant_condition_set_id = '{{ permission_grant_condition_set_id }}' -- required
;

list

Retrieve the condition sets which are excluded in a permissionGrantPolicy.

SELECT
id,
clientApplicationIds,
clientApplicationPublisherIds,
clientApplicationTenantIds,
clientApplicationsFromVerifiedPublisherOnly,
permissionClassification,
permissionType,
permissions,
resourceApplication
FROM entra_id.policies.permission_grant_policies_excludes
WHERE permission_grant_policy_id = '{{ permission_grant_policy_id }}' -- required
;

INSERT examples

insert

Add conditions under which a permission grant event is excluded in a permission grant policy. You do this by adding a permissionGrantConditionSet to the excludes collection of a permissionGrantPolicy.

INSERT INTO entra_id.policies.permission_grant_policies_excludes (
id,
clientApplicationIds,
clientApplicationPublisherIds,
clientApplicationsFromVerifiedPublisherOnly,
clientApplicationTenantIds,
permissionClassification,
permissions,
permissionType,
resourceApplication,
permission_grant_policy_id
)
SELECT 
'{{ id }}',
'{{ clientApplicationIds }}',
'{{ clientApplicationPublisherIds }}',
{{ clientApplicationsFromVerifiedPublisherOnly }},
'{{ clientApplicationTenantIds }}',
'{{ permissionClassification }}',
'{{ permissions }}',
'{{ permissionType }}',
'{{ resourceApplication }}',
'{{ permission_grant_policy_id }}'
RETURNING
id,
clientApplicationIds,
clientApplicationPublisherIds,
clientApplicationTenantIds,
clientApplicationsFromVerifiedPublisherOnly,
permissionClassification,
permissionType,
permissions,
resourceApplication
;

Manifest

# Description fields are for documentation purposes
- name: permission_grant_policies_excludes
props:
  - name: permission_grant_policy_id
    value: "{{ permission_grant_policy_id }}"
    description: Required parameter for the permission_grant_policies_excludes resource.
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: clientApplicationIds
    value:
      - "{{ clientApplicationIds }}"
    description: |
      A list of appId values for the client applications to match with, or a list with the single value all to match any client application. Default is the single value all.
  - name: clientApplicationPublisherIds
    value:
      - "{{ clientApplicationPublisherIds }}"
    description: |
      A list of Microsoft Partner Network (MPN) IDs for verified publishers of the client application, or a list with the single value all to match with client apps from any publisher. Default is the single value all.
  - name: clientApplicationsFromVerifiedPublisherOnly
    value: {{ clientApplicationsFromVerifiedPublisherOnly }}
    description: |
      Set to true to only match on client applications with a verified publisher. Set to false to match on any client app, even if it doesn't have a verified publisher. Default is false.
  - name: clientApplicationTenantIds
    value:
      - "{{ clientApplicationTenantIds }}"
    description: |
      A list of Microsoft Entra tenant IDs in which the client application is registered, or a list with the single value all to match with client apps registered in any tenant. Default is the single value all.
  - name: permissionClassification
    value: "{{ permissionClassification }}"
    description: |
      The permission classification for the permission being granted, or all to match with any permission classification (including permissions that aren't classified). Default is all.
  - name: permissions
    value:
      - "{{ permissions }}"
    description: |
      The list of id values for the specific permissions to match with, or a list with the single value all to match with any permission. The id of delegated permissions can be found in the oauth2PermissionScopes property of the API's servicePrincipal object. The id of application permissions can be found in the appRoles property of the API's servicePrincipal object. The id of resource-specific application permissions can be found in the resourceSpecificApplicationPermissions property of the API's servicePrincipal object. Default is the single value all.
  - name: permissionType
    value: "{{ permissionType }}"
    description: |
      The permission type of the permission being granted. Possible values: application for application permissions (for example app roles), or delegated for delegated permissions. The value delegatedUserConsentable indicates delegated permissions that haven't been configured by the API publisher to require admin consent—this value may be used in built-in permission grant policies, but can't be used in custom permission grant policies. Required.
  - name: resourceApplication
    value: "{{ resourceApplication }}"
    description: |
      The appId of the resource application (for example the API) for which a permission is being granted, or any to match with any resource application or API. Default is any.

UPDATE examples

update

No description available.

UPDATE entra_id.policies.permission_grant_policies_excludes
SET 
id = '{{ id }}',
clientApplicationIds = '{{ clientApplicationIds }}',
clientApplicationPublisherIds = '{{ clientApplicationPublisherIds }}',
clientApplicationsFromVerifiedPublisherOnly = {{ clientApplicationsFromVerifiedPublisherOnly }},
clientApplicationTenantIds = '{{ clientApplicationTenantIds }}',
permissionClassification = '{{ permissionClassification }}',
permissions = '{{ permissions }}',
permissionType = '{{ permissionType }}',
resourceApplication = '{{ resourceApplication }}'
WHERE 
permission_grant_policy_id = '{{ permission_grant_policy_id }}' --required
AND permission_grant_condition_set_id = '{{ permission_grant_condition_set_id }}' --required
RETURNING
id,
clientApplicationIds,
clientApplicationPublisherIds,
clientApplicationTenantIds,
clientApplicationsFromVerifiedPublisherOnly,
permissionClassification,
permissionType,
permissions,
resourceApplication;

DELETE examples

delete

Deletes a permissionGrantConditionSet from the excludes collection of a permissionGrantPolicy.

DELETE FROM entra_id.policies.permission_grant_policies_excludes
WHERE permission_grant_policy_id = '{{ permission_grant_policy_id }}' --required
AND permission_grant_condition_set_id = '{{ permission_grant_condition_set_id }}' --required
AND If-Match = '{{ If-Match }}'
;