บทช่วยสอน: จัดการนโยบายตัวเชื่อมต่อขั้นสูงทางโปรแกรม

# Requires the MSAL.PS module: Install-Module MSAL.PS -Scope CurrentUser
Import-Module "MSAL.PS"

$clientId  = "<application (client) ID of your app registration>"
$apiBaseUrl = "https://api.powerplatform.com"
$apiVersion = "2024-10-01"

# Sign in interactively and request a token for the Power Platform API
$auth = Get-MsalToken -ClientId $clientId -Scope "https://api.powerplatform.com/.default" -Interactive
$headers = @{ Authorization = "Bearer $($auth.AccessToken)" }

using Microsoft.PowerPlatform.Management;
using Microsoft.PowerPlatform.Management.Models;

// Create an interactive client using your app registration's client ID.
// A browser window opens for sign-in.
var factory = new ServiceClientFactory();
var client = factory.Create("YOUR_CLIENT_ID");

import asyncio
from azure.identity import InteractiveBrowserCredential
from kiota_authentication_azure.azure_identity_authentication_provider import (
    AzureIdentityAuthenticationProvider,
)
from kiota_http.httpx_request_adapter import HttpxRequestAdapter
from mspp_management.service_client_base import ServiceClientBase

# Sign in interactively using your app registration's client ID.
credential = InteractiveBrowserCredential(client_id="YOUR_CLIENT_ID")
auth_provider = AzureIdentityAuthenticationProvider(
    credentials=credential,
    scopes=["https://api.powerplatform.com/.default"],
)
adapter = HttpxRequestAdapter(authentication_provider=auth_provider)
client = ServiceClientBase(adapter)

$environmentGroupId = "<environment group ID>"

# 1. Create the policy with a ConnectorManagement rule set
$policyBody = @{
    name     = "Contoso ACP baseline"
    ruleSets = @(
        @{
            id      = "ConnectorManagement"
            version = "1.0"
            inputs  = @{
                AllowedConnectorList = @(
                    @{
                        AllowedConnector           = "/providers/Microsoft.PowerApps/apis/shared_office365"
                        AllowedActionsMode         = "AllAllowed"
                        AllowedConnectionTypesMode = "AllAllowed"
                    }
                )
            }
        }
    )
} | ConvertTo-Json -Depth 10

$policy = Invoke-RestMethod -Method Post `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies?api-version=$apiVersion" `
    -Headers $headers -ContentType "application/json" -Body $policyBody
Write-Host "Created policy $($policy.id)"

# 2. Assign the policy to the environment group (empty body = whole group)
Invoke-RestMethod -Method Post `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$($policy.id)/environmentGroups/$environmentGroupId/assignments?api-version=$apiVersion" `
    -Headers $headers -ContentType "application/json" -Body "{}"
Write-Host "Assigned policy $($policy.id) to group $environmentGroupId"

var environmentGroupId = "<environment group ID>";

// 1. Create the policy with a ConnectorManagement rule set
var ruleSet = new RuleSet { Id = "ConnectorManagement", Version = "1.0", Inputs = new RuleSet_inputs() };
ruleSet.Inputs.AdditionalData["AllowedConnectorList"] = new List<object>
{
    new Dictionary<string, object>
    {
        ["AllowedConnector"] = "/providers/Microsoft.PowerApps/apis/shared_office365",
        ["AllowedActionsMode"] = "AllAllowed",
        ["AllowedConnectionTypesMode"] = "AllAllowed"
    }
};

var policyRequest = new PolicyRequest
{
    Name = "Contoso ACP baseline",
    RuleSets = new List<RuleSet> { ruleSet }
};

var policy = await client.Governance.RuleBasedPolicies.PostAsync(policyRequest);
Console.WriteLine($"Created policy {policy.Id}");

// 2. Assign the policy to the environment group (empty request = whole group)
await client.Governance.RuleBasedPolicies[policy.Id]
    .EnvironmentGroups[environmentGroupId]
    .Assignments.PostAsync(new PolicyAssignmentRequest());
Console.WriteLine($"Assigned policy {policy.Id} to group {environmentGroupId}");

from mspp_management.models.policy_request import PolicyRequest
from mspp_management.models.rule_set import RuleSet
from mspp_management.models.rule_set_inputs import RuleSet_inputs
from mspp_management.models.policy_assignment_request import PolicyAssignmentRequest

async def create_and_assign(client, environment_group_id: str):
    # 1. Create the policy with a ConnectorManagement rule set
    rule_set = RuleSet()
    rule_set.id = "ConnectorManagement"
    rule_set.version = "1.0"
    rule_set.inputs = RuleSet_inputs()
    rule_set.inputs.additional_data = {
        "AllowedConnectorList": [
            {
                "AllowedConnector": "/providers/Microsoft.PowerApps/apis/shared_office365",
                "AllowedActionsMode": "AllAllowed",
                "AllowedConnectionTypesMode": "AllAllowed",
            }
        ]
    }

    policy_request = PolicyRequest()
    policy_request.name = "Contoso ACP baseline"
    policy_request.rule_sets = [rule_set]

    policy = await client.governance.rule_based_policies.post(policy_request)
    print(f"Created policy {policy.id}")

    # 2. Assign the policy to the environment group (empty request = whole group)
    await (
        client.governance.rule_based_policies
        .by_policy_id(policy.id)
        .environment_groups.by_group_id(environment_group_id)
        .assignments.post(PolicyAssignmentRequest())
    )
    print(f"Assigned policy {policy.id} to group {environment_group_id}")

$policyId     = "<policy ID>"
$connectorId  = "shared_commondataserviceforapps"   # last segment of AllowedConnector
$actionToAdd  = "aibuilderpredict_customprompt"

# 1. Read the current policy
$policy = Invoke-RestMethod -Method Get `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$policyId`?api-version=$apiVersion" `
    -Headers $headers

# 2. Find the ConnectorManagement rule set and the connector entry
$ruleSet = $policy.ruleSets | Where-Object { $_.id -eq "ConnectorManagement" }
$entry = $ruleSet.inputs.AllowedConnectorList |
    Where-Object { ($_.AllowedConnector -split "/")[-1] -eq $connectorId }

# 3. Restrict the connector to specific actions: add the action and set SomeAllowed
if ($entry) {
    $actions = @()
    if ($entry.PSObject.Properties.Name -contains "AllowedActions") { $actions = @($entry.AllowedActions) }
    if ($actions -notcontains $actionToAdd) { $actions += $actionToAdd }
    $entry | Add-Member -NotePropertyName AllowedActions -NotePropertyValue $actions -Force
    $entry.AllowedActionsMode = "SomeAllowed"

    # 4. Patch only the modified rule set back to the policy
    $patchBody = @{ name = $policy.name; ruleSets = @($ruleSet) } | ConvertTo-Json -Depth 10
    Invoke-RestMethod -Method Patch `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$policyId`?api-version=$apiVersion" `
        -Headers $headers -ContentType "application/json" -Body $patchBody
    Write-Host "Set '$connectorId' to SomeAllowed with '$actionToAdd' in policy $policyId"
}

var policyId = "<policy ID>";
var connectorId = "shared_commondataserviceforapps";   // last segment of AllowedConnector
var actionToAdd = "aibuilderpredict_customprompt";

// 1. Read the current policy
var policy = await client.Governance.RuleBasedPolicies[policyId].GetAsync();

// 2. Find the ConnectorManagement rule set and the connector entry
var ruleSet = policy.RuleSets.First(r => r.Id == "ConnectorManagement");
var connectorList = (List<object>)ruleSet.Inputs.AdditionalData["AllowedConnectorList"];
var entry = connectorList
    .Cast<Dictionary<string, object>>()
    .First(e => ((string)e["AllowedConnector"]).Split('/').Last() == connectorId);

// 3. Restrict the connector to specific actions: add the action and set SomeAllowed
if (!(entry.TryGetValue("AllowedActions", out var actionsObj) && actionsObj is List<object> actions))
{
    actions = new List<object>();
}
if (!actions.Contains(actionToAdd)) actions.Add(actionToAdd);
entry["AllowedActions"] = actions;
entry["AllowedActionsMode"] = "SomeAllowed";

// 4. Patch only the modified rule set back to the policy
var patch = new PolicyRequest { Name = policy.Name, RuleSets = new List<RuleSet> { ruleSet } };
await client.Governance.RuleBasedPolicies[policyId].PatchAsync(patch);
Console.WriteLine($"Set '{connectorId}' to SomeAllowed with '{actionToAdd}' in policy {policyId}");

async def enable_action(client, policy_id: str, connector_id: str, action_to_add: str):
    # 1. Read the current policy
    policy = await client.governance.rule_based_policies.by_policy_id(policy_id).get()

    # 2. Find the ConnectorManagement rule set and the connector entry
    rule_set = next(r for r in policy.rule_sets if r.id == "ConnectorManagement")
    connector_list = rule_set.inputs.additional_data["AllowedConnectorList"]
    entry = next(
        e for e in connector_list
        if e["AllowedConnector"].split("/")[-1] == connector_id
    )

    # 3. Restrict the connector to specific actions: add the action and set SomeAllowed
    actions = entry.get("AllowedActions") or []
    if action_to_add not in actions:
        actions.append(action_to_add)
    entry["AllowedActions"] = actions
    entry["AllowedActionsMode"] = "SomeAllowed"

    # 4. Patch only the modified rule set back to the policy
    from mspp_management.models.policy_request import PolicyRequest
    patch = PolicyRequest()
    patch.name = policy.name
    patch.rule_sets = [rule_set]
    await client.governance.rule_based_policies.by_policy_id(policy_id).patch(patch)
    print(f"Set '{connector_id}' to SomeAllowed with '{action_to_add}' in policy {policy_id}")

$policyId       = "<policy ID>"
$environmentId  = "<environment ID>"

# Assign the policy directly to the environment
Invoke-RestMethod -Method Post `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$policyId/environments/$environmentId/assignments?api-version=$apiVersion" `
    -Headers $headers -ContentType "application/json" -Body "{}"
Write-Host "Assigned policy $policyId to environment $environmentId"

var policyId = "<policy ID>";
var environmentId = "<environment ID>";

// Assign the policy directly to the environment
await client.Governance.RuleBasedPolicies[policyId]
    .Environments[environmentId]
    .Assignments.PostAsync(new PolicyAssignmentRequest());
Console.WriteLine($"Assigned policy {policyId} to environment {environmentId}");

async def assign_to_environment(client, policy_id: str, environment_id: str):
    from mspp_management.models.policy_assignment_request import PolicyAssignmentRequest
    await (
        client.governance.rule_based_policies
        .by_policy_id(policy_id)
        .environments.by_environment_id(environment_id)
        .assignments.post(PolicyAssignmentRequest())
    )
    print(f"Assigned policy {policy_id} to environment {environment_id}")

$sourceGroupId = "<source environment group ID>"
$targetGroupId = "<target environment group ID>"
$CopyAllRules  = $true

# 1. Find and read the policy assigned to the source group
$sourceAssignments = Invoke-RestMethod -Method Get `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/environmentGroups/$sourceGroupId/assignments?api-version=$apiVersion" `
    -Headers $headers
$sourcePolicyId = $sourceAssignments.value[0].policyId
$source = Invoke-RestMethod -Method Get `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$sourcePolicyId`?api-version=$apiVersion" `
    -Headers $headers

if ($CopyAllRules) {
    # 2a. Copy ALL rule sets into a new policy and assign it to the target group
    $copyBody = @{ name = "$($source.name) (copy)"; ruleSets = $source.ruleSets } | ConvertTo-Json -Depth 20
    $copy = Invoke-RestMethod -Method Post `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies?api-version=$apiVersion" `
        -Headers $headers -ContentType "application/json" -Body $copyBody
    Invoke-RestMethod -Method Post `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$($copy.id)/environmentGroups/$targetGroupId/assignments?api-version=$apiVersion" `
        -Headers $headers -ContentType "application/json" -Body "{}"
    Write-Host "Copied all rules to policy $($copy.id) and assigned it to group $targetGroupId"
}
else {
    # 2b. Merge ONLY the ConnectorManagement rule into the target group's existing policy
    $sourceCm = $source.ruleSets | Where-Object { $_.id -eq "ConnectorManagement" }

    $targetAssignments = Invoke-RestMethod -Method Get `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies/environmentGroups/$targetGroupId/assignments?api-version=$apiVersion" `
        -Headers $headers
    $targetPolicyId = $targetAssignments.value[0].policyId
    $targetPolicy = Invoke-RestMethod -Method Get `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$targetPolicyId`?api-version=$apiVersion" `
        -Headers $headers

    # Patch adds or updates the ConnectorManagement rule set by ID, keeping the target's other rules
    $patchBody = @{ name = $targetPolicy.name; ruleSets = @($sourceCm) } | ConvertTo-Json -Depth 20
    Invoke-RestMethod -Method Patch `
        -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$targetPolicyId`?api-version=$apiVersion" `
        -Headers $headers -ContentType "application/json" -Body $patchBody
    Write-Host "Merged the ConnectorManagement rule into target policy $targetPolicyId"
}

var sourceGroupId = "<source environment group ID>";
var targetGroupId = "<target environment group ID>";
var copyAllRules = true;

// 1. Find and read the policy assigned to the source group
var sourceAssignments = await client.Governance.RuleBasedPolicies
    .EnvironmentGroups[sourceGroupId].Assignments.GetAsync();
var sourcePolicyId = sourceAssignments.Value.First().PolicyId;
var source = await client.Governance.RuleBasedPolicies[sourcePolicyId].GetAsync();

if (copyAllRules)
{
    // 2a. Copy ALL rule sets into a new policy and assign it to the target group
    var copyRequest = new PolicyRequest { Name = $"{source.Name} (copy)", RuleSets = source.RuleSets };
    var copy = await client.Governance.RuleBasedPolicies.PostAsync(copyRequest);
    await client.Governance.RuleBasedPolicies[copy.Id]
        .EnvironmentGroups[targetGroupId]
        .Assignments.PostAsync(new PolicyAssignmentRequest());
    Console.WriteLine($"Copied all rules to policy {copy.Id} and assigned it to group {targetGroupId}");
}
else
{
    // 2b. Merge ONLY the ConnectorManagement rule into the target group's existing policy
    var sourceCm = source.RuleSets.First(r => r.Id == "ConnectorManagement");

    var targetAssignments = await client.Governance.RuleBasedPolicies
        .EnvironmentGroups[targetGroupId].Assignments.GetAsync();
    var targetPolicyId = targetAssignments.Value.First().PolicyId;
    var targetPolicy = await client.Governance.RuleBasedPolicies[targetPolicyId].GetAsync();

    // Patch adds or updates the ConnectorManagement rule set by ID, keeping the target's other rules
    var patch = new PolicyRequest { Name = targetPolicy.Name, RuleSets = new List<RuleSet> { sourceCm } };
    await client.Governance.RuleBasedPolicies[targetPolicyId].PatchAsync(patch);
    Console.WriteLine($"Merged the ConnectorManagement rule into target policy {targetPolicyId}");
}

async def copy_policy(client, source_group_id: str, target_group_id: str, copy_all_rules: bool = True):
    from mspp_management.models.policy_request import PolicyRequest
    from mspp_management.models.policy_assignment_request import PolicyAssignmentRequest

    # 1. Find and read the policy assigned to the source group
    source_assignments = await (
        client.governance.rule_based_policies
        .environment_groups.by_environment_group_id(source_group_id)
        .assignments.get()
    )
    source_policy_id = source_assignments.value[0].policy_id
    source = await client.governance.rule_based_policies.by_policy_id(source_policy_id).get()

    if copy_all_rules:
        # 2a. Copy ALL rule sets into a new policy and assign it to the target group
        copy_request = PolicyRequest()
        copy_request.name = f"{source.name} (copy)"
        copy_request.rule_sets = source.rule_sets
        copy = await client.governance.rule_based_policies.post(copy_request)
        await (
            client.governance.rule_based_policies
            .by_policy_id(copy.id)
            .environment_groups.by_group_id(target_group_id)
            .assignments.post(PolicyAssignmentRequest())
        )
        print(f"Copied all rules to policy {copy.id} and assigned it to group {target_group_id}")
    else:
        # 2b. Merge ONLY the ConnectorManagement rule into the target group's existing policy
        source_cm = next(r for r in source.rule_sets if r.id == "ConnectorManagement")

        target_assignments = await (
            client.governance.rule_based_policies
            .environment_groups.by_environment_group_id(target_group_id)
            .assignments.get()
        )
        target_policy_id = target_assignments.value[0].policy_id
        target_policy = await client.governance.rule_based_policies.by_policy_id(target_policy_id).get()

        # Patch adds or updates the ConnectorManagement rule set by ID, keeping the target's other rules
        patch = PolicyRequest()
        patch.name = target_policy.name
        patch.rule_sets = [source_cm]
        await client.governance.rule_based_policies.by_policy_id(target_policy_id).patch(patch)
        print(f"Merged the ConnectorManagement rule into target policy {target_policy_id}")

$policyId = "<policy ID>"

# Read the policy, then send the rule set to remove
$policy = Invoke-RestMethod -Method Get `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$policyId`?api-version=$apiVersion" `
    -Headers $headers
$ruleSet = $policy.ruleSets | Where-Object { $_.id -eq "ConnectorManagement" }

$body = @{ name = $policy.name; ruleSets = @($ruleSet) } | ConvertTo-Json -Depth 10
Invoke-RestMethod -Method Patch `
    -Uri "$apiBaseUrl/governance/ruleBasedPolicies/$policyId/removeRule?api-version=$apiVersion" `
    -Headers $headers -ContentType "application/json" -Body $body
Write-Host "Removed the ConnectorManagement rule set from policy $policyId"

var policyId = "<policy ID>";

// Remove the ConnectorManagement rule set from the policy
var policy = await client.Governance.RuleBasedPolicies[policyId].GetAsync();
var ruleSet = policy.RuleSets.First(r => r.Id == "ConnectorManagement");

var removeRequest = new PolicyRequest { Name = policy.Name, RuleSets = new List<RuleSet> { ruleSet } };
await client.Governance.RuleBasedPolicies[policyId].RemoveRule.PatchAsync(removeRequest);
Console.WriteLine($"Removed the ConnectorManagement rule set from policy {policyId}");

async def remove_rule(client, policy_id: str):
    from mspp_management.models.policy_request import PolicyRequest

    # Remove the ConnectorManagement rule set from the policy
    policy = await client.governance.rule_based_policies.by_policy_id(policy_id).get()
    rule_set = next(r for r in policy.rule_sets if r.id == "ConnectorManagement")

    remove_request = PolicyRequest()
    remove_request.name = policy.name
    remove_request.rule_sets = [rule_set]
    await client.governance.rule_based_policies.by_policy_id(policy_id).remove_rule.patch(remove_request)
    print(f"Removed the ConnectorManagement rule set from policy {policy_id}")