Show / Hide Table of Contents

PermissionGrantPolicy.ReadWrite.All

Graph Methods

Type: A = Application Permission, D = Delegate Permission

Ver	Type	Method
V1	A,D	DELETE /policies/permissionGrantPolicies/{permissiongrantpolicy-id}/excludes/{exclude-id}
V1	A,D	DELETE /policies/permissionGrantPolicies/{permissiongrantpolicy-id}/includes/{include-id}
V1	A,D	DELETE /servicePrincipals/{id}/delegatedPermissionClassifications/{id}
V1	A,D	POST /policies/permissionGrantPolicies
V1	A,D	POST /servicePrincipals/{id}/delegatedPermissionClassifications

Delegate Permission


Id
Consent Type
Display String
Description

Application Permission


Id
Display String
Description

Resources

delegatedPermissionClassification

Property	Type	Description
id	String	A unique identifier for the delegatedPermissionClassification Key. Not nullable. Read-only.
classification	permissionClassificationType	The classification value being given. Possible value: `low`. Does not support `$filter`.
permissionId	Guid	The unique identifier (id) for the delegated permission listed in the oauth2PermissionScopes collection of the servicePrincipal. Required on create. Does not support `$filter`.
permissionName	String	The claim value (**v

permissionGrantConditionSet

Property	Type	Description
id	String	The unique identifier for the permission grant condition set. Key. Read-only.
permissionClassification	String	The permission classification for the permission being granted, or `all` to match with any permission classification (including permissions which are not classified). Default is `all`.
permissionType	permissionType	The permission type of the permission being granted. Possible values: `application` for application permissions (e.g. app roles), or `delegated` for delegated permissions. The value `delegatedUserConsentable` indicates delegated permissions which have not been configured by the API publisher to require admin consent—this value may be used in built-in permission grant policies, but cannot be used in custom permission grant policies. Required.
resourceApplication	String	The appId of the resource application (e.g. the API) for which a permission is being granted, or `any` to match with any resource application or API. Default is `any`.
permissions	String collection	The list of id values for the specific permissions to match with, or a list with the single value `all` to match with any permission. The id of delegated permissions can be found in the oauth2PermissionScopes property of the API's servicePrincipal object. The id of application permissions can be found in the appRoles property of the API's servicePrincipal object. The id of resource-specific application permissions can be found in the resourceSpecificApplicationPermissions property of the API's servicePrincipal object. Default is the single value `all`.
clientApplicationIds	String collection	A list of appId values for the client applications to match with, or a list with the single value `all` to match any client application. Default is the single value `all`.
clientApplicationTenantIds	String collection	A list of Azure Active Directory tenant IDs in which the client application is registered, or a list with the single value `all` to match with client apps registered in any tenant. Default is the single value `all`.
clientApplicationPublisherIds	String collection	A list of Microsoft Partner Network (MPN) IDs for verified publishers of the client application, or a list with the single value `all` to match with client apps from any publisher. Default is the single value `all`.
clientApplicationsFromVerifiedPublisherOnly	Boolean	Set to `true` to only match on client applications with a verified publisher. Set to `false` to match on any client app, even if it does not have a verified publisher. Default is `false`.

permissionGrantPolicy

Property	Type	Description
id	String	The unique identifier for the permission grant policy. The id prefix `microsoft-` is reserved for built-in permission grant policies, and may not be used in a custom permission grant policy. Only letters, numbers, hyphens (`-`) and underscores (`_`) are allowed. Key. Not nullable. Required on create. Immutable.
displayName	String	The display name for the permission grant policy.
description	String	The description for the permission grant policy.
includes	permissionGrantConditionSet collection	Condition sets which are included in this permission grant policy. Automatically expanded on `GET`.
excludes	permissionGrantConditionSet collection	Condition sets which are *e