教學課程：使用 REST API 來管理 Microsoft Purview 集合上的角色型存取控制

在 2021 年 8 月，Microsoft Purview 中的存取控制已從 Azure Identity & Access Management (IAM) (控制平面) 移至資料平面) (Microsoft Purview 集合。 此變更可讓企業資料管理者和系統管理員對其由 Microsoft Purview 掃描的資料來源進行更精確、更精細的存取控制。 這項變更還使組織能夠審核其資料的權利存取和權利使用。

本教學課程將逐步引導您使用 Microsoft Purview 中繼資料原則 API，以協助您將使用者、群組或服務主體新增至集合，並在該集合中管理或移除其角色。 REST API 是使用 Azure 入口網站或 Microsoft Purview 管理入口網站的替代方法，可達到相同的細微角色型存取控制。

如需 Microsoft Purview 內建角色的詳細資訊，請參閱 Microsoft Purview 權限指南。 指南會將角色對應至授與使用者的存取權限層級。

中繼資料原則 API 參考摘要

下表提供 Microsoft Purview 中繼資料原則 API 參考的概觀。

Microsoft Purview 目錄集合 API 參考摘要

下表提供 Microsoft Purview 集合 API 概觀。 如需每個 API 的完整文件，請選取左資料欄中的 API 作業。

• 如果您使用 API，執行 API 的服務主體、使用者或群組應該在 Microsoft Purview 中指派集合管理員角色，才能順利執行此 API。

• 針對需要 {collectionName} 的所有 Microsoft Purview API，您必須使用 “name” (，而不是 “friendlyName”) 。 將 {collectionName} 取代為實際的六個字元英數字元集合名稱字串。

  注意事項

  這個名稱與您建立集合時所提供的易記顯示名稱不同。 如果您手邊沒有 {collectionName}，請使用 清單集合 API 從 JSON 輸出中選取六個字元的集合名稱。

以下是 JSON 檔案範例：

{
    "name": "74dhe7", 
    "friendlyName": "Friendly Name",
    "parentCollection": {
        "type": "CollectionReference",
        "referenceName": "{your_purview_account_name}"
    },
    "systemData": {
        "createdBy": "{guid}",
        "createdByType": "Application",
        "createdAt": "2021-08-26T21:21:51.2646627Z",
        "lastModifiedBy": "7f8d47e2-330c-42f0-8744-fcfb1ecb3ea0",
        "lastModifiedByType": "Application",
        "lastModifiedAt": "2021-08-26T21:21:51.2646628Z"
    },
    "collectionProvisioningState": "Succeeded"
}

原則 JSON 描述

以下是從集合 API 接收的 JSON 輸出中的一些重要識別碼：

名稱：原則的名稱。

識別碼： 原則的唯一識別碼。

版本：原則的最新版本號碼。

DecisionRules：列出此原則的規則和效果。 對於中繼資料原則，效果一律為 “Allow”。

在集合或角色中新增或移除使用者

使用 Microsoft Purview REST API 在集合或角色中新增或移除使用者、群組或服務主體。 詳細的 API 使用方式與範例 JSON 輸出一起提供。 我們強烈建議您依序遵循接下來各節中的指示，以充分瞭解 Microsoft Purview 中繼資料原則 API。

取得所有中繼資料角色

若要列出所有可用的中繼資料存取權限角色，請根據您使用的入口網站執行下列其中一個命令：

傳統 Microsoft Purview 管理入口網站：

GET https://{your_purview_account_name}.purview.azure.com/policystore/metadataroles?api-version=2021-07-01

新的 Microsoft Purview 入口網站：

GET https://api.purview-service.microsoft.com/policystore/metadataroles?api-version=2021-07-01

輸出 JSON 會使用此格式描述角色及其相關聯的權限。

下表列出預設中繼資料角色：

{
  "values": [
    {
      "id": "purviewmetadatarole_builtin_data-curator",
      "name": "data-curator",
      "type": "Microsoft.Purview/role",
      "properties": {
        "provisioningState": "Provisioned",
        "roleType": "BuiltIn",
        "friendlyName": "Data Curator",
        "cnfCondition": [
          [
            {
              "attributeName": "request.azure.dataAction",
              "attributeValueIncludedIn": [
                "Microsoft.Purview/accounts/data/read",
                "Microsoft.Purview/accounts/data/write",
                "Microsoft.Purview/accounts/collection/read"
              ]
            }
          ]
        ],
        "version": 1
      }
    },
    {
      "id": "purviewmetadatarole_builtin_data-source-administrator",
      "name": "data-source-administrator",
      "type": "Microsoft.Purview/role",
      "properties": {
        "provisioningState": "Provisioned",
        "roleType": "BuiltIn",
        "friendlyName": "Data Source Administrator",
        "cnfCondition": [
          [
            {
              "attributeName": "request.azure.dataAction",
              "attributeValueIncludedIn": [
                "Microsoft.Purview/accounts/scan/read",
                "Microsoft.Purview/accounts/scan/write",
                "Microsoft.Purview/accounts/collection/read"
              ]
            }
          ]
        ],
        "version": 1
      }
    },
    {
      "id": "purviewmetadatarole_builtin_collection-administrator",
      "name": "collection-administrator",
      "type": "Microsoft.Purview/role",
      "properties": {
        "provisioningState": "Provisioned",
        "roleType": "BuiltIn",
        "friendlyName": "Collection Administrator",
        "cnfCondition": [
          [
            {
              "attributeName": "request.azure.dataAction",
              "attributeValueIncludedIn": [
                "Microsoft.Purview/accounts/collection/read",
                "Microsoft.Purview/accounts/collection/write"
              ]
            }
          ]
        ],
        "version": 1
      }
    },
    {
      "id": "purviewmetadatarole_builtin_purview-reader",
      "name": "purview-reader",
      "type": "Microsoft.Purview/role",
      "properties": {
        "provisioningState": "Provisioned",
        "roleType": "BuiltIn",
        "friendlyName": "Microsoft Purview Reader",
        "cnfCondition": [
          [
            {
              "attributeName": "request.azure.dataAction",
              "attributeValueIncludedIn": [
                "Microsoft.Purview/accounts/data/read",
                "Microsoft.Purview/accounts/collection/read"
              ]
            }
          ]
        ],
        "version": 1
      }
    },
    {
      "id": "purviewmetadatarole_builtin_data-share-contributor",
      "name": "data-share-contributor",
      "type": "Microsoft.Purview/role",
      "properties": {
        "provisioningState": "Provisioned",
        "roleType": "BuiltIn",
        "friendlyName": "Data share contributor",
        "cnfCondition": [
          [
            {
              "attributeName": "request.azure.dataAction",
              "attributeValueIncludedIn": [
                "Microsoft.Purview/accounts/share/read",
                "Microsoft.Purview/accounts/share/write"
              ]
            }
          ]
        ],
        "version": 1
      }
    }
  ]
}

取得所有中繼資料原則

傳統 Microsoft Purview 管理入口網站：

GET https://{your_purview_account_name}.purview.azure.com/policystore/metadataPolicies?api-version=2021-07-01

新的 Microsoft Purview 入口網站：

GET https://api.purview-service.microsoft.com/policystore/metadataPolicies?api-version=2021-07-01

上述命令會以樹狀格式列出整個集合階層的所有可用中繼資料原則，從頂端的根集合到其所有子原則。 每個子集合都包含其每個下一個層級的子系。

例如:

{
  "values": [
    {
      "name": "policy_FabrikamPurview",
      "id": "9b2f1cb9-584c-4a16-811e-9232884b5cac",
      "version": 30,
      "properties": {
        "description": "",
        "decisionRules": [
          {
            "kind": "decisionrule",
            "effect": "Permit",
            "dnfCondition": [
              [
                {
                  "attributeName": "resource.purview.collection",
                  "attributeValueIncludes": "fabrikampurview"
                },
                {
                  "fromRule": "permission:fabrikampurview",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "permission:fabrikampurview"
                }
              ]
            ]
          }
        ],
        "attributeRules": [
          {
            "kind": "attributerule",
            "id": "purviewmetadatarole_builtin_collection-administrator:fabrikampurview",
            "name": "purviewmetadatarole_builtin_collection-administrator:fabrikampurview",
            "dnfCondition": [
              [
                {
                  "attributeName": "principal.microsoft.id",
                  "attributeValueIncludedIn": [
                    "2f656762-e440-4b62-9eb6-a991d17d64b0",
                    "04314867-60a4-4e5a-ae16-8e5856f415d9",
                    "8988fe5c-5736-4179-9435-0a64c273b90b",
                    "6d563253-1d5b-48f2-baaa-5489f22ddce9",
                    "26f98046-5b02-4fa9-b709-e0519c658891",
                    "73fc02dc-becd-468b-a2a3-82238e722dae"
                  ]
                },
                {
                  "fromRule": "purviewmetadatarole_builtin_collection-administrator",
                  "attributeName": "derived.purview.role",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator"
                }
              ],
              [
                {
                  "fromRule": "purviewmetadatarole_builtin_collection-administrator",
                  "attributeName": "derived.purview.role",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator"
                },
                {
                  "attributeName": "principal.microsoft.groups",
                  "attributeValueIncludedIn": [
                    "ffd851fa-86ec-431b-95ea-8b84d5012383",
                    "cf84b126-4384-4952-91f1-7f705b25e569",
                    "5046aba1-5b81-411c-8fec-b84600f3f08b",
                    "b055a5c6-a04e-4d1a-8524-001ad81bfb28",
                    "cc194892-92fa-4ce3-96ae-1f98bef8211c"
                  ]
                }
              ]
            ]
          },
          {
            "kind": "attributerule",
            "id": "purviewmetadatarole_builtin_data-curator:fabrikampurview",
            "name": "purviewmetadatarole_builtin_data-curator:fabrikampurview",
            "dnfCondition": [
              [
                {
                  "attributeName": "principal.microsoft.id",
                  "attributeValueIncludedIn": [
                    "2f656762-e440-4b62-9eb6-a991d17d64b0",
                    "649f56ab-2dd2-40de-a731-3d3f28e7af92",
                    "c29a5809-f9ec-49fd-b762-2d4d64abb93e",
                    "04314867-60a4-4e5a-ae16-8e5856f415d9",
                    "73fc02dc-becd-468b-a2a3-82238e722dae",
                    "517a27d2-39ba-4c91-a032-dd9ecf8ad6f1",
                    "6d563253-1d5b-48f2-baaa-5489f22ddce9"
                  ]
                },
                {
                  "fromRule": "purviewmetadatarole_builtin_data-curator",
                  "attributeName": "derived.purview.role",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_data-curator"
                }
              ],
              [
                {
                  "fromRule": "purviewmetadatarole_builtin_data-curator",
                  "attributeName": "derived.purview.role",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_data-curator"
                },
                {
                  "attributeName": "principal.microsoft.groups",
                  "attributeValueIncludedIn": [
                    "b055a5c6-a04e-4d1a-8524-001ad81bfb28",
                    "cc194892-92fa-4ce3-96ae-1f98bef8211c",
                    "5046aba1-5b81-411c-8fec-b84600f3f08b"
                  ]
                }
              ]
            ]
          },
          {
            "kind": "attributerule",
            "id": "purviewmetadatarole_builtin_data-source-administrator:fabrikampurview",
            "name": "purviewmetadatarole_builtin_data-source-administrator:fabrikampurview",
            "dnfCondition": [
              [
                {
                  "attributeName": "principal.microsoft.id",
                  "attributeValueIncludedIn": [
                    "2f656762-e440-4b62-9eb6-a991d17d64b0",
                    "04314867-60a4-4e5a-ae16-8e5856f415d9",
                    "517a27d2-39ba-4c91-a032-dd9ecf8ad6f1",
                    "6d563253-1d5b-48f2-baaa-5489f22ddce9"
                  ]
                },
                {
                  "fromRule": "purviewmetadatarole_builtin_data-source-administrator",
                  "attributeName": "derived.purview.role",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_data-source-administrator"
                }
              ],
              [
                {
                  "fromRule": "purviewmetadatarole_builtin_data-source-administrator",
                  "attributeName": "derived.purview.role",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_data-source-administrator"
                },
                {
                  "attributeName": "principal.microsoft.groups",
                  "attributeValueIncludedIn": [
                    "b055a5c6-a04e-4d1a-8524-001ad81bfb28",
                    "cc194892-92fa-4ce3-96ae-1f98bef8211c",
                    "d34eb741-be5e-4098-90d7-eca8d4a5153f",
                    "664ec992-9af0-4773-88f2-dc39edc46f6f",
                    "5046aba1-5b81-411c-8fec-b84600f3f08b"
                  ]
                }
              ]
            ]
          },
          {
            "kind": "attributerule",
            "id": "permission:fabrikampurview",
            "name": "permission:fabrikampurview",
            "dnfCondition": [
              [
                {
                  "fromRule": "purviewmetadatarole_builtin_collection-administrator:fabrikampurview",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator:fabrikampurview"
                }
              ],
              [
                {
                  "fromRule": "purviewmetadatarole_builtin_purview-reader:fabrikampurview",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_purview-reader:fabrikampurview"
                }
              ],
              [
                {
                  "fromRule": "purviewmetadatarole_builtin_data-curator:fabrikampurview",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_data-curator:fabrikampurview"
                }
              ],
              [
                {
                  "fromRule": "purviewmetadatarole_builtin_data-source-administrator:fabrikampurview",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_data-source-administrator:fabrikampurview"
                }
              ]
            ]
          }
        ],
        "collection": {
          "type": "CollectionReference",
          "referenceName": "fabrikampurview"
        }
      }
    },
    {
      "name": "policy_b2zpf1",
      "id": "12b0bb28-2acc-413e-8fe1-179ff9cc54c3",
      "version": 0,
      "properties": {
        "description": "",
        "decisionRules": [
          {
            "kind": "decisionrule",
            "effect": "Permit",
            "dnfCondition": [
              [
                {
                  "attributeName": "resource.purview.collection",
                  "attributeValueIncludes": "b2zpf1"
                },
                {
                  "fromRule": "permission:b2zpf1",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "permission:b2zpf1"
                }
              ]
            ]
          }
        ],
        "attributeRules": [
          {
            "kind": "attributerule",
            "id": "purviewmetadatarole_builtin_collection-administrator:b2zpf1",
            "name": "purviewmetadatarole_builtin_collection-administrator:b2zpf1",
            "dnfCondition": [
              [
                {
                  "attributeName": "principal.microsoft.id",
                  "attributeValueIncludedIn": [
                    "2f656762-e440-4b62-9eb6-a991d17d64b0"
                  ]
                },
                {
                  "fromRule": "purviewmetadatarole_builtin_collection-administrator",
                  "attributeName": "derived.purview.role",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator"
                }
              ],
              [
                {
                  "fromRule": "purviewmetadatarole_builtin_collection-administrator:ukx7pq",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator:ukx7pq"
                }
              ]
            ]
          },
          {
            "kind": "attributerule",
            "id": "permission:b2zpf1",
            "name": "permission:b2zpf1",
            "dnfCondition": [
              [
                {
                  "fromRule": "purviewmetadatarole_builtin_collection-administrator:b2zpf1",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator:b2zpf1"
                }
              ],
              [
                {
                  "fromRule": "permission:ukx7pq",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "permission:ukx7pq"
                }
              ]
            ]
          }
        ],
        "collection": {
          "type": "CollectionReference",
          "referenceName": "b2zpf1"
        },
        "parentCollectionName": "ukx7pq"
      }
    },
    {
      "name": "policy_7wte2n",
      "id": "a72084e4-ccab-4aec-a364-08ab001e4999",
      "version": 0,
      "properties": {
        "description": "",
        "decisionRules": [
          {
            "kind": "decisionrule",
            "effect": "Permit",
            "dnfCondition": [
              [
                {
                  "attributeName": "resource.purview.collection",
                  "attributeValueIncludes": "7wte2n"
                },
                {
                  "fromRule": "permission:7wte2n",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "permission:7wte2n"
                }
              ]
            ]
          }
        ],
        "attributeRules": [
          {
            "kind": "attributerule",
            "id": "purviewmetadatarole_builtin_collection-administrator:7wte2n",
            "name": "purviewmetadatarole_builtin_collection-administrator:7wte2n",
            "dnfCondition": [
              [
                {
                  "attributeName": "principal.microsoft.id",
                  "attributeValueIncludedIn": [
                    "2f656762-e440-4b62-9eb6-a991d17d64b0"
                  ]
                },
                {
                  "fromRule": "purviewmetadatarole_builtin_collection-administrator",
                  "attributeName": "derived.purview.role",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator"
                }
              ],
              [
                {
                  "fromRule": "purviewmetadatarole_builtin_collection-administrator:ukx7pq",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator:ukx7pq"
                }
              ]
            ]
          },
          {
            "kind": "attributerule",
            "id": "permission:7wte2n",
            "name": "permission:7wte2n",
            "dnfCondition": [
              [
                {
                  "fromRule": "purviewmetadatarole_builtin_collection-administrator:7wte2n",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator:7wte2n"
                }
              ],
              [
                {
                  "fromRule": "permission:ukx7pq",
                  "attributeName": "derived.purview.permission",
                  "attributeValueIncludes": "permission:ukx7pq"
                }
              ]
            ]
          }
        ],
        "collection": {
          "type": "CollectionReference",
          "referenceName": "7wte2n"
        },
        "parentCollectionName": "ukx7pq"
      }
    }
  ]
}

取得選取的中繼資料原則

您可以透過提供 {collectionName} 或 {PolicyID}，使用兩個 API 的其中一個來擷取特定集合的中繼資料原則 JSON 結構。

如以下兩節所述，這兩個 API 的用途相同，而且兩者的 JSON 輸出完全相同。

使用集合名稱取得集合的中繼資料原則

傳統 Microsoft Purview 管理入口網站：

GET https://{your_purview_account_name}.purview.azure.com/policystore/collections/{collectionName}/metadataPolicy?api-version=2021-07-01

新的 Microsoft Purview 入口網站：

GET https://api.purview-service.microsoft.com/policystore/collections/{collectionName}/metadataPolicy?api-version=2021-07-01

1. Microsoft Purview 帳戶名稱為 {your_purview_account_name}。 請使用您的 Microsoft Purview 帳戶名稱取代。

2. 在上一個 API 的 JSON 輸出「取得所有中繼資料原則」中，請尋找下一節：

   { “type”： “CollectionReference”， “referenceName”： “7xkdg2”}

3. 將 API URL 中的 “{collectionName}” 取代為 “referenceName”： “{6-char-collection-name}”。 例如，如果您的六個字元集合名稱是 “7xkdg2”，則 API URL 的格式將會是：

   https://{your_purview_account_name}.purview.azure.com/policystore/collections/7xkdg2/metadataPolicy?api-version=2021-07-01

4. 執行下列 API：

   {
     "name": "policy_qu45fs",
     "id": "aaaabbbb-0000-cccc-1111-dddd2222eeee",
     "version": 0,
     "properties": {
       "description": "",
       "decisionRules": [
         {
           "kind": "decisionrule",
           "effect": "Permit",
           "dnfCondition": [
             [
               {
                 "attributeName": "resource.purview.collection",
                 "attributeValueIncludes": "qu45fs"
               },
               {
                 "fromRule": "permission:qu45fs",
                 "attributeName": "derived.purview.permission",
                 "attributeValueIncludes": "permission:qu45fs"
               }
             ]
           ]
         }
       ],
       "attributeRules": [
         {
           "kind": "attributerule",
           "id": "purviewmetadatarole_builtin_collection-administrator:qu45fs",
           "name": "purviewmetadatarole_builtin_collection-administrator:qu45fs",
           "dnfCondition": [
             [
               {
                 "attributeName": "principal.microsoft.id",
                 "attributeValueIncludedIn": [
                   "2f656762-e440-4b62-9eb6-a991d17d64b0"
                 ]
               },
               {
                 "fromRule": "purviewmetadatarole_builtin_collection-administrator",
                 "attributeName": "derived.purview.role",
                 "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator"
               }
             ],
             [
               {
                 "fromRule": "purviewmetadatarole_builtin_collection-administrator:fabrikampurview",
                 "attributeName": "derived.purview.permission",
                 "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator:fabrikampurview"
               }
             ]
           ]
         },
         {
           "kind": "attributerule",
           "id": "permission:qu45fs",
           "name": "permission:qu45fs",
           "dnfCondition": [
             [
               {
                 "fromRule": "purviewmetadatarole_builtin_collection-administrator:qu45fs",
                 "attributeName": "derived.purview.permission",
                 "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator:qu45fs"
               }
             ],
             [
               {
                 "fromRule": "permission:fabrikampurview",
                 "attributeName": "derived.purview.permission",
                 "attributeValueIncludes": "permission:fabrikampurview"
               }
             ]
           ]
         }
       ],
       "collection": {
         "type": "CollectionReference",
         "referenceName": "qu45fs"
       },
       "parentCollectionName": "fabrikampurview"
     }
   }
   

使用原則識別碼取得集合的中繼資料原則

傳統 Microsoft Purview 管理入口網站：

GET https://{your_purview_account_name}.purview.azure.com/policystore/metadataPolicies/{policyId}?api-version=2021-07-01

新的 Microsoft Purview 入口網站：

GET https://api.purview-service.microsoft.com/policystore/metadataPolicies/{policyId}?api-version=2021-07-01

1. Microsoft Purview 帳戶名稱為 {your_purview_account_name}。 請使用您的 Microsoft Purview 帳戶名稱取代。

2. 在上一個 API 的 JSON 輸出「取得所有中繼資料原則」中，請尋找下一節：

   {....“name”： “policy_qu45fs”， “id”： “{policy-guid}”， “version”： N ....}

3. 將 API URL 中的「{policyId}」取代為 “id” 的值。 例如，如果您的「{policy-guid}」是「aaaabbbb-0000-cccc-1111-dddd2222eeee」，則 API URL 的格式將會是：

   https://{your_purview_account_name}.purview.azure.com/policystore/metadataPolicies/aaaabbbb-0000-cccc-1111-dddd2222eeee?api-version=2021-07-01

4. 現在請執行下列 API：

   注意事項

   此 API 呼叫和上一個 API 呼叫的輸出相同。 如前所述，您可以選擇其中一種。

{
  "name": "policy_qu45fs",
  "id": "aaaabbbb-0000-cccc-1111-dddd2222eeee",
  "version": 0,
  "properties": {
    "description": "",
    "decisionRules": [
      {
        "kind": "decisionrule",
        "effect": "Permit",
        "dnfCondition": [
          [
            {
              "attributeName": "resource.purview.collection",
              "attributeValueIncludes": "qu45fs"
            },
            {
              "fromRule": "permission:qu45fs",
              "attributeName": "derived.purview.permission",
              "attributeValueIncludes": "permission:qu45fs"
            }
          ]
        ]
      }
    ],
    "attributeRules": [
      {
        "kind": "attributerule",
        "id": "purviewmetadatarole_builtin_collection-administrator:qu45fs",
        "name": "purviewmetadatarole_builtin_collection-administrator:qu45fs",
        "dnfCondition": [
          [
            {
              "attributeName": "principal.microsoft.id",
              "attributeValueIncludedIn": [
                "2f656762-e440-4b62-9eb6-a991d17d64b0"
              ]
            },
            {
              "fromRule": "purviewmetadatarole_builtin_collection-administrator",
              "attributeName": "derived.purview.role",
              "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator"
            }
          ],
          [
            {
              "fromRule": "purviewmetadatarole_builtin_collection-administrator:fabrikampurview",
              "attributeName": "derived.purview.permission",
              "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator:fabrikampurview"
            }
          ]
        ]
      },
      {
        "kind": "attributerule",
        "id": "permission:qu45fs",
        "name": "permission:qu45fs",
        "dnfCondition": [
          [
            {
              "fromRule": "purviewmetadatarole_builtin_collection-administrator:qu45fs",
              "attributeName": "derived.purview.permission",
              "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator:qu45fs"
            }
          ],
          [
            {
              "fromRule": "permission:fabrikampurview",
              "attributeName": "derived.purview.permission",
              "attributeValueIncludes": "permission:fabrikampurview"
            }
          ]
        ]
      }
    ],
    "collection": {
      "type": "CollectionReference",
      "referenceName": "qu45fs"
    },
    "parentCollectionName": "fabrikampurview"
  }
}

更新集合原則

PUT https://{your_purview_account_name}.purview.azure.com/policystore/metadataPolicies/{policyId}?api-version=2021-07-01

在本節中，您會新增或移除集合中的使用者、群組或服務主體，以更新在上一個步驟中取得的原則 JSON。 然後，使用 PUT REST 方法，將它推送至 Microsoft Purview 服務。

無論您是要新增或移除使用者、群組或服務主體，您都會遵循相同的 API 程序。

1. 在 JSON 的「attributeValueIncludedIn」陣列中提供使用者、群組或服務主體物件識別碼 {guid}。

2. 在上一個步驟中搜尋 “attributeValueIncludedIn” 陣列的 Get-Policy-by-ID API 的 JSON 輸出，並在陣列中新增或移除使用者、群組或服務主體物件識別碼。 如果您不確定如何擷取使用者、群組或服務主體物件識別碼，請參閱 Get-MgUser。

3. JSON 對應中有四個角色中的每一個角色的多個區段。 對於集合管理員權限角色，請使用帶有名為 “purviewmetadatarole_builtin_collection-administrator” 的識別碼的區段。 同樣地，請使用其他角色的對應區段。

4. 若要更瞭解新增/移除作業，請仔細檢查先前 API 的 JSON 輸出與下列輸出之間的差異。 在下列 JSON 輸出中，我們已將使用者識別碼 “aaaabbbb-0000-cccc-1111-dddd2222eeee” 新增為集合管理員。

{
  "name": "policy_qu45fs",
  "id": "aaaabbbb-0000-cccc-1111-dddd2222eeee",
  "version": 0,
  "properties": {
    "description": "",
    "decisionRules": [
      {
        "kind": "decisionrule",
        "effect": "Permit",
        "dnfCondition": [
          [
            {
              "attributeName": "resource.purview.collection",
              "attributeValueIncludes": "qu45fs"
            },
            {
              "fromRule": "permission:qu45fs",
              "attributeName": "derived.purview.permission",
              "attributeValueIncludes": "permission:qu45fs"
            }
          ]
        ]
      }
    ],
    "attributeRules": [
      {
        "kind": "attributerule",
        "id": "purviewmetadatarole_builtin_collection-administrator:qu45fs",
        "name": "purviewmetadatarole_builtin_collection-administrator:qu45fs",
        "dnfCondition": [
          [
            {
              "attributeName": "principal.microsoft.id",
              "attributeValueIncludedIn": [
                "2f656762-e440-4b62-9eb6-a991d17d64b0",
                "00aa00aa-bb11-cc22-dd33-44ee44ee44ee"
              ]
            },
            {
              "fromRule": "purviewmetadatarole_builtin_collection-administrator",
              "attributeName": "derived.purview.role",
              "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator"
            }
          ],
          [
            {
              "fromRule": "purviewmetadatarole_builtin_collection-administrator:fabrikampurview",
              "attributeName": "derived.purview.permission",
              "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator:fabrikampurview"
            }
          ]
        ]
      },
      {
        "kind": "attributerule",
        "id": "permission:qu45fs",
        "name": "permission:qu45fs",
        "dnfCondition": [
          [
            {
              "fromRule": "purviewmetadatarole_builtin_collection-administrator:qu45fs",
              "attributeName": "derived.purview.permission",
              "attributeValueIncludes": "purviewmetadatarole_builtin_collection-administrator:qu45fs"
            }
          ],
          [
            {
              "fromRule": "permission:fabrikampurview",
              "attributeName": "derived.purview.permission",
              "attributeValueIncludes": "permission:fabrikampurview"
            }
          ]
        ]
      }
    ],
    "collection": {
      "type": "CollectionReference",
      "referenceName": "qu45fs"
    },
    "parentCollectionName": "fabrikampurview"
  }
}

新增根集合系統管理員角色

根據預設，建立 Microsoft Purview 帳戶的使用者是根集合系統管理員 (也就是集合階層最頂層的系統管理員) 。 不過，在某些情況下，組織可能會想要使用 API 變更根集合系統管理員。

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Purview/accounts/{accountName}/addRootCollectionAdmin?api-version=2021-07-01

若要執行上述命令，您只需要傳遞新的根集合系統管理員的物件識別碼。 如先前所述，物件識別碼可以是任何使用者、群組或服務主體的物件識別碼。

{"objectId": "{guid}"}

其他資源

您可以選擇使用 PowerShell 公用程式來執行 Microsoft Purview REST API。 您可以從 PowerShell 資源庫輕鬆地安裝它。 使用此公用程式，您可以執行所有相同的命令，但從 Windows PowerShell 執行。

後續步驟