New-MgBetaOauth2PermissionGrant

Module:

Microsoft.Graph.Beta.Identity.SignIns Module

Create a delegated permission grant, represented by an oAuth2PermissionGrant object. A delegated permission grant authorizes a client service principal (representing a client application) to access a resource service principal (representing an API), on behalf of a signed-in user, for the level of access limited by the delegated permissions which were granted.

New-MgBetaOauth2PermissionGrant
 [-ResponseHeadersVariable <string>]
 [-AdditionalProperties <hashtable>]
 [-ClientId <string>]
 [-ConsentType <string>]
 [-ExpiryTime <datetime>]
 [-Id <string>]
 [-PrincipalId <string>]
 [-ResourceId <string>]
 [-Scope <string>]
 [-StartTime <datetime>]
 [-Break]
 [-Headers <IDictionary>]
 [-HttpPipelineAppend <SendAsyncStep[]>]
 [-HttpPipelinePrepend <SendAsyncStep[]>]
 [-Proxy <uri>]
 [-ProxyCredential <pscredential>]
 [-ProxyUseDefaultCredentials]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

New-MgBetaOauth2PermissionGrant
 -BodyParameter <IMicrosoftGraphOAuth2PermissionGrant>
 [-ResponseHeadersVariable <string>]
 [-Break]
 [-Headers <IDictionary>]
 [-HttpPipelineAppend <SendAsyncStep[]>]
 [-HttpPipelinePrepend <SendAsyncStep[]>]
 [-Proxy <uri>]
 [-ProxyCredential <pscredential>]
 [-ProxyUseDefaultCredentials]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

Create a delegated permission grant, represented by an oAuth2PermissionGrant object. A delegated permission grant authorizes a client service principal (representing a client application) to access a resource service principal (representing an API), on behalf of a signed-in user, for the level of access limited by the delegated permissions which were granted.

Permissions

Import-Module Microsoft.Graph.Beta.Identity.SignIns

$params = @{
	clientId = "ef969797-201d-4f6b-960c-e9ed5f31dab5"
	consentType = "AllPrincipals"
	resourceId = "943603e4-e787-4fe9-93d1-e30f749aae39"
	scope = "DelegatedPermissionGrant.ReadWrite.All"
	startTime = [System.DateTime]::Parse("2022-03-17T00:00:00Z")
	expiryTime = [System.DateTime]::Parse("2023-03-17T00:00:00Z")
}

New-MgBetaOauth2PermissionGrant -BodyParameter $params

This example shows how to use the New-MgBetaOauth2PermissionGrant Cmdlet.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

{{ Fill in the Description }}

{{ Fill in the Description }}

{{ Fill in the Description }}

COMPLEX PARAMETER PROPERTIES

To create the parameters described below, construct a hash table containing the appropriate properties. For information on hash tables, run Get-Help about_Hash_Tables.

BODYPARAMETER <IMicrosoftGraphOAuth2PermissionGrant>: oAuth2PermissionGrant [(Any) <Object>]: This indicates any property can be added to this object. [Id <String>]: The unique identifier for an entity. Read-only. [ClientId <String>]: The object id (not appId) of the client service principal for the application that is authorized to act on behalf of a signed-in user when accessing an API. Required. Supports $filter (eq only). [ConsentType <String>]: Indicates whether authorization is granted for the client application to impersonate all users or only a specific user. AllPrincipals indicates authorization to impersonate all users. Principal indicates authorization to impersonate a specific user. Consent on behalf of all users can be granted by an administrator. Nonadmin users may be authorized to consent on behalf of themselves in some cases, for some delegated permissions. Required. Supports $filter (eq only). [ExpiryTime <DateTime?>]: Currently, the end time value is ignored, but a value is required when creating an oAuth2PermissionGrant. Required. [PrincipalId <String>]: The id of the user on behalf of whom the client is authorized to access the resource, when consentType is Principal. If consentType is AllPrincipals this value is null. Required when consentType is Principal. Supports $filter (eq only). [ResourceId <String>]: The id of the resource service principal to which access is authorized. This identifies the API that the client is authorized to attempt to call on behalf of a signed-in user. Supports $filter (eq only). [Scope <String>]: A space-separated list of the claim values for delegated permissions that should be included in access tokens for the resource application (the API). For example, openid User.Read GroupMember.Read.All. Each claim value should match the value field of one of the delegated permissions defined by the API, listed in the publishedPermissionScopes property of the resource service principal. Must not exceed 3850 characters in length. [StartTime <DateTime?>]: Currently, the start time value is ignored, but a value is required when creating an oAuth2PermissionGrant. Required.