Set-EntraPermissionGrantConditionSet

Module:

Microsoft.Entra.SignIns Module v1.3

Update an existing Microsoft Entra ID permission grant condition set.

Set-EntraPermissionGrantConditionSet

 -ConditionSetType <String>
 -Id <String>
 -PolicyId <String>
 [-Permissions <System.Collections.Generic.List`1[System.String]>]
 [-ClientApplicationTenantIds <System.Collections.Generic.List`1[System.String]>]
 [-ClientApplicationIds <System.Collections.Generic.List`1[System.String]>]
 [-ResourceApplication <String>]
 [-PermissionType <String>]
 [-PermissionClassification <String>]
 [-ClientApplicationsFromVerifiedPublisherOnly <Boolean>]
 [-ClientApplicationPublisherIds <System.Collections.Generic.List`1[System.String]>]
 [<CommonParameters>]

Updates a Microsoft Entra ID permission grant condition set object identified by Id.

Connect-Entra -Scopes 'Policy.ReadWrite.PermissionGrant'
$permissionGrantPolicy = Get-EntraPermissionGrantPolicy | Where-Object { $_.Id -eq 'my-custom-consent-policy' }
$conditionSet = Get-EntraPermissionGrantConditionSet -PolicyId $permissionGrantPolicy.Id -ConditionSetType 'includes' | Where-Object { $_.PermissionType -eq 'delegated' }
Set-EntraPermissionGrantConditionSet -PolicyId $permissionGrantPolicy -ConditionSetType 'includes' -Id $conditionSet.Id -PermissionClassification 'low'

This command updates sets the specified permission grant set to classify as low.

• -PolicyId parameter specifies the unique identifier of a permission grant policy.
• -ConditionSetType parameter indicates whether the condition sets are included in the policy or excluded.
• -Id parameter specifies the unique identifier of a permission grant condition set object.
• -PermissionClassification parameter specifies the specific classification (all, low, medium, high) to scope consent operation down to.

Connect-Entra -Scopes 'Policy.ReadWrite.PermissionGrant'
$permissionGrantPolicy = Get-EntraPermissionGrantPolicy | Where-Object { $_.Id -eq 'my-custom-consent-policy' }
$conditionSet = Get-EntraPermissionGrantConditionSet -PolicyId $permissionGrantPolicy.Id -ConditionSetType 'includes' | Where-Object { $_.PermissionType -eq 'delegated' }
$params = @{
 PolicyId = $permissionGrantPolicy.Id
 ConditionSetType = 'includes'
 Id = $conditionSet.Id
 PermissionType = 'delegated'
 PermissionClassification = 'low'
 ResourceApplication = 'a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1'
 Permissions = @('All')
 ClientApplicationIds = @('All')
 ClientApplicationTenantIds = @('All')
 ClientApplicationPublisherIds = @('All')
 ClientApplicationsFromVerifiedPublisherOnly = $true
}

Set-EntraPermissionGrantConditionSet @params

This command updates sets the specified permission grant set.

• -PolicyId parameter specifies the unique identifier of a permission grant policy.
• -ConditionSetType parameter indicates whether the condition sets are included in the policy or excluded.
• -Id parameter specifies the unique identifier of a permission grant condition set object.
• -PermissionType parameter specifies the type of permissions (application, delegated) to scope consent operation down to.
• -PermissionClassification parameter specifies the specific classification (all, low, medium, high) to scope consent operation down to.
• -ResourceApplication parameter specifies identifier of the resource application to scope consent operation down to. It could be "Any" or a specific resource application ID.
• -Permissions parameter specifies the identifier of the resource application to scope consent operation down to. It could be @("All") or a list of permission IDs.
• -ClientApplicationIds parameter specifies the set of client application IDs to scope consent operation down to. It could be @("All") or a list of client application IDs.
• -ClientApplicationTenantIds parameter specifies the set of client applications publisher IDs to scope consent operation down to. It could be @("All") or a list of client application publisher IDs.
• -ClientApplicationPublisherIds parameter specifies the set of client applications publisher IDs to scope consent operation down to. It could be @("All") or a list of client application publisher IDs.
• -ClientApplicationsFromVerifiedPublisherOnly parameter indicates whether to only includes client applications from verified publishers.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.