Selvstudium: Administrer avancerede connectorpolitikker programmatisk

Avancerede connectorpolitikker (ACP) styrer connectorforbruget med en streng allowlist, der blokerer connectors som standard. Ud over Power Platform Administration-oplevelsen kan du administrere ACP med kode ved hjælp af Power Platform-API'en og administrations-SDK'erne. Det er nyttigt at automatisere ACP, når du standardiserer styring på tværs af mange miljøgrupper, replikerer en oprindelig politik mellem grupper eller administrerer politikker som en del af en udrulningspipeline.

I dette selvstudium lærer du, hvordan du kan:

Godkend ved hjælp af Power Platform API.
Forstå ACP-politikskabelonen.
Opret en politik, og føj den til en miljøgruppe.
Aktivér en enkelt handling for en forbindelseskomponent.
Anvend eller opdater en politik på et enkelt miljø.
Kopiér en politik fra én miljøgruppe til en anden.
Fjern ACP fra en miljøgruppe.

Avancerede connectorpolitikker vises via handlingerne governance/ruleBasedPolicies i Power Platform-API'en. En politik indeholder et eller flere regelsæt. regelsættet med id'et ConnectorManagement indeholder listen over tilladte ACP-connectors. Alle eksempler i artiklen bruger API-version 2024-10-01.

Forudsætninger

En appregistrering, der er konfigureret til Power Platform API. Bemærk appregistreringens program-id (klient) og mappe-id (lejer).
Tilladelse til at administrere politikker for styring. For tjenesteprincipaler skal du tildele en rolle som RBAC, der kan skrive ressourcer, f.eks. Bidragyder til Power Platform eller Ejer af Power Platform. Du kan få flere oplysninger under Selvstudium: Tildel roller til tjenesteprincipaler.
I SDK-eksemplerne skal du installere det SDK, der sendes månedligt, i det offentlige galleri:
- C#: Microsoft. PowerPlatform.Management NuGet-pakke.
- Python: PyPI-pakken til administration af powerplatform.
```
dotnet add package Microsoft.PowerPlatform.Management
```
```
pip install powerplatform-management
```

Trin 1. Autentificer ved hjælp af Power Platform API

Alle eksempler godkendes med klient-id'et for din appregistrering efter vejledningen i Godkendelse. Følgende eksempler logger på interaktivt som den aktuelle bruger. Hvis du vil køre uden brugerinput som en tjenesteprincipal, skal du se flowet for fortrolige klienter i artiklen Godkendelse og tildele tjenesteprincipalen en RBAC-rolle.

# Requires the MSAL.PS module: Install-Module MSAL.PS -Scope CurrentUser
Import-Module "MSAL.PS"

$clientId  = "<application (client) ID of your app registration>"
$apiBaseUrl = "https://api.powerplatform.com"
$apiVersion = "2024-10-01"

# Sign in interactively and request a token for the Power Platform API
$auth = Get-MsalToken -ClientId $clientId -Scope "https://api.powerplatform.com/.default" -Interactive
$headers = @{ Authorization = "Bearer $($auth.AccessToken)" }

using Microsoft.PowerPlatform.Management;
using Microsoft.PowerPlatform.Management.Models;

// Create an interactive client using your app registration's client ID.
// A browser window opens for sign-in.
var factory = new ServiceClientFactory();
var client = factory.Create("YOUR_CLIENT_ID");

import asyncio
from azure.identity import InteractiveBrowserCredential
from kiota_authentication_azure.azure_identity_authentication_provider import (
    AzureIdentityAuthenticationProvider,
)
from kiota_http.httpx_request_adapter import HttpxRequestAdapter
from mspp_management.service_client_base import ServiceClientBase

# Sign in interactively using your app registration's client ID.
credential = InteractiveBrowserCredential(client_id="YOUR_CLIENT_ID")
auth_provider = AzureIdentityAuthenticationProvider(
    credentials=credential,
    scopes=["https://api.powerplatform.com/.default"],
)
adapter = HttpxRequestAdapter(authentication_provider=auth_provider)
client = ServiceClientBase(adapter)

Trin 2. Forstå ACP-politikkens struktur

En avanceret connectorpolitik er en regelbaseret politik, der indeholder et regelsæt med id'et ConnectorManagement. Dette regelsæt har en version, og dets inputs rummer en AllowedConnectorList, hvor hver post tillader en forbindelse og angiver, hvordan dens handlinger og forbindelsestyper styres:

{
  "name": "Contoso ACP baseline",
  "ruleSets": [
    {
      "id": "ConnectorManagement",
      "version": "1.0",
      "inputs": {
        "AllowedConnectorList": [
          {
            "AllowedConnector": "/providers/Microsoft.PowerApps/apis/shared_office365",
            "AllowedActionsMode": "AllAllowed",
            "AllowedConnectionTypesMode": "AllAllowed"
          },
          {
            "AllowedConnector": "/providers/Microsoft.PowerApps/apis/shared_commondataserviceforapps",
            "AllowedActionsMode": "SomeAllowed",
            "AllowedActions": ["GetItem", "CreateRecord"],
            "AllowedConnectionTypesMode": "AllAllowed"
          }
        ]
      }
    }
  ]
}

Vær opmærksom på følgende semantik:

En connector, der ikke er i AllowedConnectorList , er blokeret (standardafvis).
Hvert element sætter AllowedActionsMode. AllAllowed tillader alle handlinger på connectoren. SomeAllowed begrænser connectoren til de handlinger, der er angivet i postens AllowedActions matrix. Trin 4 viser, hvordan du tilføjer en handling og angiver denne tilstand.
AllowedConnectionTypesMode styrer, hvilke forbindelsestyper der er tilladt, og følger det samme AllAllowed mønster.
Medtag regelsættets version , når du opretter eller opdaterer en politik. Læs den fra en eksisterende politik, og bevar den værdi, som tjenesten returnerer.

Tip!

Den nøjagtige værdi af AllowedConnector er connectorens ressource-id. Den mest pålidelige måde at lære figuren for forbindelser, der allerede findes i din lejer, er at læse en eksisterende politik først (trin 4 viser, hvordan) eller bruge connectorkataloget (beskrevet næste), og derefter afspejle denne figur, når du opretter eller opdaterer politikker.

Find connector- og handlings-id'er med connectorkataloget

Hvis du vil finde ud af, hvilke connectors og handlinger du kan tillade, skal du bruge API'en til connectorkataloget. Den viser de connectors, der er tilgængelige i et miljø, sammen med de id'er, du placerer i AllowedConnector og AllowedActions.

Note

Handlingerne i forbindelseskataloget kræver et miljø-id i stienog en OData $filter , der angiver det samme miljø , $filter=environment eq '<environmentId>'f.eks. . Begge er påkrævet.

$environmentId = "<environment ID>"
$filter = [uri]::EscapeDataString("environment eq '$environmentId'")

# List connectors available in the environment
$connectors = Invoke-RestMethod -Method Get `
    -Uri "$apiBaseUrl/connectivity/environments/$environmentId/connectors?`$filter=$filter&api-version=$apiVersion" `
    -Headers $headers
$connectors.value | Select-Object name, @{ n = "displayName"; e = { $_.properties.displayName } }

# Get a single connector by ID (the connector's name, such as shared_office365)
$connectorId = "shared_office365"
$connector = Invoke-RestMethod -Method Get `
    -Uri "$apiBaseUrl/connectivity/environments/$environmentId/connectors/$connectorId?`$filter=$filter&api-version=$apiVersion" `
    -Headers $headers
$connector.id   # full resource path to use as AllowedConnector

Brug connectorens id (den fulde ressourcesti, f.eks /providers/Microsoft.PowerApps/apis/shared_office365. ) som AllowedConnector værdien, og connectorens handlings-id'er som værdierne i AllowedActions. Du kan få adgang til det samme katalog via connectivity navneområdet for administrator-SDK'erne.

Trin 3. Opret en politik, og føj den til en miljøgruppe

Tilføjelse af ACP til en miljøgruppe er en handling i to dele: Opret politikken, og tildel den derefter til gruppen. Oprettelsesopkaldet returnerer den nye politik id, som du bruger i tildelingsopkaldet.

Hvis du vil tildele politikken til hele gruppen, skal du sende en tildelingsanmodning med en tom brødtekst ({}). Alle miljøer i gruppen nedarver politikken og forbliver synkroniseret med den.

$environmentGroupId = "<environment group ID>"

# 1. Create the policy with a ConnectorManagement rule set
$policyBody = @{
    name     = "Contoso ACP baseline"
    ruleSets = @(
        @{
            id      = "ConnectorManagement"
            version = "1.0"
            inputs  = @{
                AllowedConnectorList = @(
                    @{
                        AllowedConnector           = "/providers/Microsoft.PowerApps/apis/shared_office365"
                        AllowedActionsMode         = "AllAllowed"
                        AllowedConnectionTypesMode = "AllAllowed"
                    }
                )
            }
        }
    )
} | ConvertTo-Json -Depth 10

$policy = Invoke-RestMethod -Method Post `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies?api-version=$apiVersion" `
    -Headers $headers -ContentType "application/json" -Body $policyBody
Write-Host "Created policy $($policy.id)"

# 2. Assign the policy to the environment group (empty body = whole group)
Invoke-RestMethod -Method Post `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$($policy.id)/environmentGroups/$environmentGroupId/assignments?api-version=$apiVersion" `
    -Headers $headers -ContentType "application/json" -Body "{}"
Write-Host "Assigned policy $($policy.id) to group $environmentGroupId"

var environmentGroupId = "<environment group ID>";

// 1. Create the policy with a ConnectorManagement rule set
var ruleSet = new RuleSet { Id = "ConnectorManagement", Version = "1.0", Inputs = new RuleSet_inputs() };
ruleSet.Inputs.AdditionalData["AllowedConnectorList"] = new List<object>
{
    new Dictionary<string, object>
    {
        ["AllowedConnector"] = "/providers/Microsoft.PowerApps/apis/shared_office365",
        ["AllowedActionsMode"] = "AllAllowed",
        ["AllowedConnectionTypesMode"] = "AllAllowed"
    }
};

var policyRequest = new PolicyRequest
{
    Name = "Contoso ACP baseline",
    RuleSets = new List<RuleSet> { ruleSet }
};

var policy = await client.Governance.RuleBasedPolicies.PostAsync(policyRequest);
Console.WriteLine($"Created policy {policy.Id}");

// 2. Assign the policy to the environment group (empty request = whole group)
await client.Governance.RuleBasedPolicies[policy.Id]
    .EnvironmentGroups[environmentGroupId]
    .Assignments.PostAsync(new PolicyAssignmentRequest());
Console.WriteLine($"Assigned policy {policy.Id} to group {environmentGroupId}");

from mspp_management.models.policy_request import PolicyRequest
from mspp_management.models.rule_set import RuleSet
from mspp_management.models.rule_set_inputs import RuleSet_inputs
from mspp_management.models.policy_assignment_request import PolicyAssignmentRequest

async def create_and_assign(client, environment_group_id: str):
    # 1. Create the policy with a ConnectorManagement rule set
    rule_set = RuleSet()
    rule_set.id = "ConnectorManagement"
    rule_set.version = "1.0"
    rule_set.inputs = RuleSet_inputs()
    rule_set.inputs.additional_data = {
        "AllowedConnectorList": [
            {
                "AllowedConnector": "/providers/Microsoft.PowerApps/apis/shared_office365",
                "AllowedActionsMode": "AllAllowed",
                "AllowedConnectionTypesMode": "AllAllowed",
            }
        ]
    }

    policy_request = PolicyRequest()
    policy_request.name = "Contoso ACP baseline"
    policy_request.rule_sets = [rule_set]

    policy = await client.governance.rule_based_policies.post(policy_request)
    print(f"Created policy {policy.id}")

    # 2. Assign the policy to the environment group (empty request = whole group)
    await (
        client.governance.rule_based_policies
        .by_policy_id(policy.id)
        .environment_groups.by_group_id(environment_group_id)
        .assignments.post(PolicyAssignmentRequest())
    )
    print(f"Assigned policy {policy.id} to group {environment_group_id}")

Trin 4. Aktivér en individuel forbindelseshandling

Hvis du kun vil tillade bestemte handlinger på en connector, skal du angive den AllowedActionsMode til SomeAllowed og angive de tilladte handlinger i AllowedActions. I dette eksempel føjes en handling, f.eks. en skjult handling, der ikke kan vælges i Administration, til en connectors allowlist og angiver connectoren til SomeAllowed. Læs politikken, opdater connectorposten, og send det opdaterede regelsæt tilbage ved hjælp af programrettelsen. Patch opdaterer en regel, der er angivet af id, og lader politikkens andre regelsæt være urørte.

$policyId     = "<policy ID>"
$connectorId  = "shared_commondataserviceforapps"   # last segment of AllowedConnector
$actionToAdd  = "aibuilderpredict_customprompt"

# 1. Read the current policy
$policy = Invoke-RestMethod -Method Get `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$policyId`?api-version=$apiVersion" `
    -Headers $headers

# 2. Find the ConnectorManagement rule set and the connector entry
$ruleSet = $policy.ruleSets | Where-Object { $_.id -eq "ConnectorManagement" }
$entry = $ruleSet.inputs.AllowedConnectorList |
    Where-Object { ($_.AllowedConnector -split "/")[-1] -eq $connectorId }

# 3. Restrict the connector to specific actions: add the action and set SomeAllowed
if ($entry) {
    $actions = @()
    if ($entry.PSObject.Properties.Name -contains "AllowedActions") { $actions = @($entry.AllowedActions) }
    if ($actions -notcontains $actionToAdd) { $actions += $actionToAdd }
    $entry | Add-Member -NotePropertyName AllowedActions -NotePropertyValue $actions -Force
    $entry.AllowedActionsMode = "SomeAllowed"

    # 4. Patch only the modified rule set back to the policy
    $patchBody = @{ name = $policy.name; ruleSets = @($ruleSet) } | ConvertTo-Json -Depth 10
    Invoke-RestMethod -Method Patch `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$policyId`?api-version=$apiVersion" `
        -Headers $headers -ContentType "application/json" -Body $patchBody
    Write-Host "Set '$connectorId' to SomeAllowed with '$actionToAdd' in policy $policyId"
}

var policyId = "<policy ID>";
var connectorId = "shared_commondataserviceforapps";   // last segment of AllowedConnector
var actionToAdd = "aibuilderpredict_customprompt";

// 1. Read the current policy
var policy = await client.Governance.RuleBasedPolicies[policyId].GetAsync();

// 2. Find the ConnectorManagement rule set and the connector entry
var ruleSet = policy.RuleSets.First(r => r.Id == "ConnectorManagement");
var connectorList = (List<object>)ruleSet.Inputs.AdditionalData["AllowedConnectorList"];
var entry = connectorList
    .Cast<Dictionary<string, object>>()
    .First(e => ((string)e["AllowedConnector"]).Split('/').Last() == connectorId);

// 3. Restrict the connector to specific actions: add the action and set SomeAllowed
if (!(entry.TryGetValue("AllowedActions", out var actionsObj) && actionsObj is List<object> actions))
{
    actions = new List<object>();
}
if (!actions.Contains(actionToAdd)) actions.Add(actionToAdd);
entry["AllowedActions"] = actions;
entry["AllowedActionsMode"] = "SomeAllowed";

// 4. Patch only the modified rule set back to the policy
var patch = new PolicyRequest { Name = policy.Name, RuleSets = new List<RuleSet> { ruleSet } };
await client.Governance.RuleBasedPolicies[policyId].PatchAsync(patch);
Console.WriteLine($"Set '{connectorId}' to SomeAllowed with '{actionToAdd}' in policy {policyId}");

async def enable_action(client, policy_id: str, connector_id: str, action_to_add: str):
    # 1. Read the current policy
    policy = await client.governance.rule_based_policies.by_policy_id(policy_id).get()

    # 2. Find the ConnectorManagement rule set and the connector entry
    rule_set = next(r for r in policy.rule_sets if r.id == "ConnectorManagement")
    connector_list = rule_set.inputs.additional_data["AllowedConnectorList"]
    entry = next(
        e for e in connector_list
        if e["AllowedConnector"].split("/")[-1] == connector_id
    )

    # 3. Restrict the connector to specific actions: add the action and set SomeAllowed
    actions = entry.get("AllowedActions") or []
    if action_to_add not in actions:
        actions.append(action_to_add)
    entry["AllowedActions"] = actions
    entry["AllowedActionsMode"] = "SomeAllowed"

    # 4. Patch only the modified rule set back to the policy
    from mspp_management.models.policy_request import PolicyRequest
    patch = PolicyRequest()
    patch.name = policy.name
    patch.rule_sets = [rule_set]
    await client.governance.rule_based_policies.by_policy_id(policy_id).patch(patch)
    print(f"Set '{connector_id}' to SomeAllowed with '{action_to_add}' in policy {policy_id}")

Trin 5. Anvend eller opdater en politik på et enkelt miljø

Du kan målrette en politik mod et enkelt miljø i stedet for en miljøgruppe. Denne fremgangsmåde er nyttig til miljøer med høj risiko, pilotmiljøer eller regulerede miljøer. Tildel politikken til miljøet, og brug det samme programrettelsesmønster fra trin 4 til at redigere den senere. Hvert miljø understøtter én effektiv AVS-politik.

$policyId       = "<policy ID>"
$environmentId  = "<environment ID>"

# Assign the policy directly to the environment
Invoke-RestMethod -Method Post `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$policyId/environments/$environmentId/assignments?api-version=$apiVersion" `
    -Headers $headers -ContentType "application/json" -Body "{}"
Write-Host "Assigned policy $policyId to environment $environmentId"

var policyId = "<policy ID>";
var environmentId = "<environment ID>";

// Assign the policy directly to the environment
await client.Governance.RuleBasedPolicies[policyId]
    .Environments[environmentId]
    .Assignments.PostAsync(new PolicyAssignmentRequest());
Console.WriteLine($"Assigned policy {policyId} to environment {environmentId}");

async def assign_to_environment(client, policy_id: str, environment_id: str):
    from mspp_management.models.policy_assignment_request import PolicyAssignmentRequest
    await (
        client.governance.rule_based_policies
        .by_policy_id(policy_id)
        .environments.by_environment_id(environment_id)
        .assignments.post(PolicyAssignmentRequest())
    )
    print(f"Assigned policy {policy_id} to environment {environment_id}")

Trin 6. Kopiér en politik fra én miljøgruppe til en anden

Når du replikerer en oprindelig plan for styring til en anden gruppe, skal du vælge, hvor meget der skal kopieres, ved hjælp af flaget CopyAllRules :

CopyAllRules = true: Opret en ny politik ud fra alle kildegruppens regelsæt, og tildel den til målgruppen. Målgruppens styring bliver en uafhængig kopi af kilden.
CopyAllRules = false: Udtræk kun regelsættet ConnectorManagement fra kildepolitikken, og flet det til målgruppens eksisterende politik. Programrettelseshandlingen tilføjer eller opdaterer den regel, der er angivet af id'et, så målgruppen bevarer sine andre regler.

$sourceGroupId = "<source environment group ID>"
$targetGroupId = "<target environment group ID>"
$CopyAllRules  = $true

# 1. Find and read the policy assigned to the source group
$sourceAssignments = Invoke-RestMethod -Method Get `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/environmentGroups/$sourceGroupId/assignments?api-version=$apiVersion" `
    -Headers $headers
$sourcePolicyId = $sourceAssignments.value[0].policyId
$source = Invoke-RestMethod -Method Get `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$sourcePolicyId`?api-version=$apiVersion" `
    -Headers $headers

if ($CopyAllRules) {
    # 2a. Copy ALL rule sets into a new policy and assign it to the target group
    $copyBody = @{ name = "$($source.name) (copy)"; ruleSets = $source.ruleSets } | ConvertTo-Json -Depth 20
    $copy = Invoke-RestMethod -Method Post `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies?api-version=$apiVersion" `
        -Headers $headers -ContentType "application/json" -Body $copyBody
    Invoke-RestMethod -Method Post `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$($copy.id)/environmentGroups/$targetGroupId/assignments?api-version=$apiVersion" `
        -Headers $headers -ContentType "application/json" -Body "{}"
    Write-Host "Copied all rules to policy $($copy.id) and assigned it to group $targetGroupId"
}
else {
    # 2b. Merge ONLY the ConnectorManagement rule into the target group's existing policy
    $sourceCm = $source.ruleSets | Where-Object { $_.id -eq "ConnectorManagement" }

    $targetAssignments = Invoke-RestMethod -Method Get `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies/environmentGroups/$targetGroupId/assignments?api-version=$apiVersion" `
        -Headers $headers
    $targetPolicyId = $targetAssignments.value[0].policyId
    $targetPolicy = Invoke-RestMethod -Method Get `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$targetPolicyId`?api-version=$apiVersion" `
        -Headers $headers

    # Patch adds or updates the ConnectorManagement rule set by ID, keeping the target's other rules
    $patchBody = @{ name = $targetPolicy.name; ruleSets = @($sourceCm) } | ConvertTo-Json -Depth 20
    Invoke-RestMethod -Method Patch `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$targetPolicyId`?api-version=$apiVersion" `
        -Headers $headers -ContentType "application/json" -Body $patchBody
    Write-Host "Merged the ConnectorManagement rule into target policy $targetPolicyId"
}

var sourceGroupId = "<source environment group ID>";
var targetGroupId = "<target environment group ID>";
var copyAllRules = true;

// 1. Find and read the policy assigned to the source group
var sourceAssignments = await client.Governance.RuleBasedPolicies
    .EnvironmentGroups[sourceGroupId].Assignments.GetAsync();
var sourcePolicyId = sourceAssignments.Value.First().PolicyId;
var source = await client.Governance.RuleBasedPolicies[sourcePolicyId].GetAsync();

if (copyAllRules)
{
    // 2a. Copy ALL rule sets into a new policy and assign it to the target group
    var copyRequest = new PolicyRequest { Name = $"{source.Name} (copy)", RuleSets = source.RuleSets };
    var copy = await client.Governance.RuleBasedPolicies.PostAsync(copyRequest);
    await client.Governance.RuleBasedPolicies[copy.Id]
        .EnvironmentGroups[targetGroupId]
        .Assignments.PostAsync(new PolicyAssignmentRequest());
    Console.WriteLine($"Copied all rules to policy {copy.Id} and assigned it to group {targetGroupId}");
}
else
{
    // 2b. Merge ONLY the ConnectorManagement rule into the target group's existing policy
    var sourceCm = source.RuleSets.First(r => r.Id == "ConnectorManagement");

    var targetAssignments = await client.Governance.RuleBasedPolicies
        .EnvironmentGroups[targetGroupId].Assignments.GetAsync();
    var targetPolicyId = targetAssignments.Value.First().PolicyId;
    var targetPolicy = await client.Governance.RuleBasedPolicies[targetPolicyId].GetAsync();

    // Patch adds or updates the ConnectorManagement rule set by ID, keeping the target's other rules
    var patch = new PolicyRequest { Name = targetPolicy.Name, RuleSets = new List<RuleSet> { sourceCm } };
    await client.Governance.RuleBasedPolicies[targetPolicyId].PatchAsync(patch);
    Console.WriteLine($"Merged the ConnectorManagement rule into target policy {targetPolicyId}");
}

async def copy_policy(client, source_group_id: str, target_group_id: str, copy_all_rules: bool = True):
    from mspp_management.models.policy_request import PolicyRequest
    from mspp_management.models.policy_assignment_request import PolicyAssignmentRequest

    # 1. Find and read the policy assigned to the source group
    source_assignments = await (
        client.governance.rule_based_policies
        .environment_groups.by_environment_group_id(source_group_id)
        .assignments.get()
    )
    source_policy_id = source_assignments.value[0].policy_id
    source = await client.governance.rule_based_policies.by_policy_id(source_policy_id).get()

    if copy_all_rules:
        # 2a. Copy ALL rule sets into a new policy and assign it to the target group
        copy_request = PolicyRequest()
        copy_request.name = f"{source.name} (copy)"
        copy_request.rule_sets = source.rule_sets
        copy = await client.governance.rule_based_policies.post(copy_request)
        await (
            client.governance.rule_based_policies
            .by_policy_id(copy.id)
            .environment_groups.by_group_id(target_group_id)
            .assignments.post(PolicyAssignmentRequest())
        )
        print(f"Copied all rules to policy {copy.id} and assigned it to group {target_group_id}")
    else:
        # 2b. Merge ONLY the ConnectorManagement rule into the target group's existing policy
        source_cm = next(r for r in source.rule_sets if r.id == "ConnectorManagement")

        target_assignments = await (
            client.governance.rule_based_policies
            .environment_groups.by_environment_group_id(target_group_id)
            .assignments.get()
        )
        target_policy_id = target_assignments.value[0].policy_id
        target_policy = await client.governance.rule_based_policies.by_policy_id(target_policy_id).get()

        # Patch adds or updates the ConnectorManagement rule set by ID, keeping the target's other rules
        patch = PolicyRequest()
        patch.name = target_policy.name
        patch.rule_sets = [source_cm]
        await client.governance.rule_based_policies.by_policy_id(target_policy_id).patch(patch)
        print(f"Merged the ConnectorManagement rule into target policy {target_policy_id}")

Trin 7. Fjern ACP fra en miljøgruppe

Selvom en gruppe har en aktiv AVS-regel, stemmer alle miljøer i gruppen overens med gruppens politik. Den måde, du fjerner håndhævelse på, afhænger af, om du vil have, at disse miljøer bevarer deres aktuelle konfiguration eller rydder ACP helt:

Fjern reglen fra gruppens politik for at forhindre gruppen i at administrere AVS. Brug handlingen removeRule til at fjerne regelsættet ConnectorManagement fra gruppens politik. Miljøerne bevarer deres senest anvendte ACP-konfiguration, men de holdes ikke længere synkroniseret med gruppen. Du kan administrere hvert miljø individuelt og lade dem divergere.
Fjern ACP fra gruppen og fra alle miljøer for at slå ACP fra overalt. Fjern reglen fra gruppens politik, gå derefter gennem gruppens miljøer, og fjern også regelsættet ConnectorManagement fra hvert miljøs politik.

Note

Hvis du fjerner reglen fra en gruppes politik, fjernes ACP ikke automatisk fra de miljøer, der har arvet den. Disse miljøer bevarer deres senest anvendte konfiguration for at undgå et hul i håndhævelse. Hvis du vil rydde ACP overalt, skal du fjerne det fra hvert miljø, som vist i eksemplet med løkken. Du kan få flere oplysninger under Avancerede connectorpolitikker.

Fjern reglen fra gruppens politik

I følgende eksempel fjernes regelsættet ConnectorManagement fra en politik ved hjælp af handlingen removeRule .

$policyId = "<policy ID>"

# Read the policy, then send the rule set to remove
$policy = Invoke-RestMethod -Method Get `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$policyId`?api-version=$apiVersion" `
    -Headers $headers
$ruleSet = $policy.ruleSets | Where-Object { $_.id -eq "ConnectorManagement" }

$body = @{ name = $policy.name; ruleSets = @($ruleSet) } | ConvertTo-Json -Depth 10
Invoke-RestMethod -Method Patch `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$policyId/removeRule?api-version=$apiVersion" `
    -Headers $headers -ContentType "application/json" -Body $body
Write-Host "Removed the ConnectorManagement rule set from policy $policyId"

var policyId = "<policy ID>";

// Remove the ConnectorManagement rule set from the policy
var policy = await client.Governance.RuleBasedPolicies[policyId].GetAsync();
var ruleSet = policy.RuleSets.First(r => r.Id == "ConnectorManagement");

var removeRequest = new PolicyRequest { Name = policy.Name, RuleSets = new List<RuleSet> { ruleSet } };
await client.Governance.RuleBasedPolicies[policyId].RemoveRule.PatchAsync(removeRequest);
Console.WriteLine($"Removed the ConnectorManagement rule set from policy {policyId}");

async def remove_rule(client, policy_id: str):
    from mspp_management.models.policy_request import PolicyRequest

    # Remove the ConnectorManagement rule set from the policy
    policy = await client.governance.rule_based_policies.by_policy_id(policy_id).get()
    rule_set = next(r for r in policy.rule_sets if r.id == "ConnectorManagement")

    remove_request = PolicyRequest()
    remove_request.name = policy.name
    remove_request.rule_sets = [rule_set]
    await client.governance.rule_based_policies.by_policy_id(policy_id).remove_rule.patch(remove_request)
    print(f"Removed the ConnectorManagement rule set from policy {policy_id}")

Fjern ACP fra alle miljøer i gruppen

Hvis du vil slå ACP fra på tværs af alle miljøer i en gruppe, skal du først fjerne reglen fra gruppens politik (forrige eksempel) og derefter gentage fjernelsen for hvert miljøs egen politik. Læs den politik, der er tildelt hvert miljø, fra dets miljøtilknytning, og kald derefter removeRule på den politik. Angiv de miljø-id'er, der tilhører gruppen, eller optæl dem ved hjælp af API'erne til miljøstyring.

# Environment IDs that belong to the group
$environmentIds = @("<environment ID 1>", "<environment ID 2>")

foreach ($environmentId in $environmentIds) {
    # Find the policy currently assigned to the environment
    $envAssignments = Invoke-RestMethod -Method Get `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies/environments/$environmentId/assignments?api-version=$apiVersion" `
        -Headers $headers
    if (-not $envAssignments.value) { continue }
    $envPolicyId = $envAssignments.value[0].policyId

    # Remove the ConnectorManagement rule set from that environment's policy
    $envPolicy = Invoke-RestMethod -Method Get `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$envPolicyId`?api-version=$apiVersion" `
        -Headers $headers
    $ruleSet = $envPolicy.ruleSets | Where-Object { $_.id -eq "ConnectorManagement" }
    if ($ruleSet) {
        $body = @{ name = $envPolicy.name; ruleSets = @($ruleSet) } | ConvertTo-Json -Depth 10
        Invoke-RestMethod -Method Patch `
            -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$envPolicyId/removeRule?api-version=$apiVersion" `
            -Headers $headers -ContentType "application/json" -Body $body
        Write-Host "Removed ACP from environment $environmentId"
    }
}

Det samme kald pr. miljø removeRule fungerer sammen med de C# og Python SDK'er, der er vist tidligere. Ombryd opkaldet i en løkke over gruppens miljø-id'er.

Avancerede connectorpolitikker
Regelbaserede politikker – REST API-reference
Godkendelse
Selvstudium: Tildel roller til tjenesteprincipaler
Oversigt over programmering og udvidelse

Feedback

Var denne side nyttig?

Last updated on 2026-07-16