你当前正在访问 Microsoft Azure Global Edition 技术文档网站。如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。

Deny Assignments - List For Scope

参考

服务:: Authorization

API 版本:: 2022-04-01

获取范围的拒绝分配。

GET https://management.azure.com/{scope}/providers/Microsoft.Authorization/denyAssignments?api-version=2022-04-01

具有可选参数:

GET https://management.azure.com/{scope}/providers/Microsoft.Authorization/denyAssignments?api-version=2022-04-01&$filter={$filter}

URI 参数

名称	在	必需	类型	说明
scope	path	True	string	拒绝分配的范围。
api-version	query	True	string minLength: 1	用于此作的 API 版本。
$filter	query		string	要应用于作的筛选器。使用 $filter=atScope（）返回范围或以上的所有拒绝分配。使用 $filter=denyAssignmentName eq “{name}” 按指定范围按名称搜索拒绝分配。使用 $filter=principalId eq “{id}” 返回指定主体范围上方和以下的所有拒绝分配。使用 $filter=gdprExportPrincipalId eq “{id}” 返回指定主体范围上方和下方的所有拒绝分配。此筛选器不同于 principalId 筛选器，因为它不仅返回包含指定主体的拒绝分配是主体列表，而且返回包含指定主体的拒绝分配是 ExcludePrincipals 列表。此外，如果使用 gdprExportPrincipalId 筛选器，则仅返回拒绝分配名称和说明属性。

响应

名称	类型	说明
200 OK	DenyAssignmentListResult	确定 - 返回拒绝分配的数组。
Other Status Codes	ErrorResponse	描述作失败的原因的错误响应。

权限

若要调用此 API，必须具备带有以下权限的角色。有关详细信息，请参阅 Azure 内置角色。

Microsoft.Authorization/denyAssignments/read

安全性

azure_auth

Azure Active Directory OAuth2 Flow

类型: oauth2
流向: implicit
授权 URL: https://login.microsoftonline.com/common/oauth2/authorize

作用域

名称	说明
user_impersonation	模拟用户帐户

示例

List deny assignments for scope

示例请求

GET https://management.azure.com/subscriptions/subId/providers/Microsoft.Authorization/denyAssignments?api-version=2022-04-01


/**
 * Samples for DenyAssignments ListForScope.
 */
public final class Main {
    /*
     * x-ms-original-file:
     * specification/authorization/resource-manager/Microsoft.Authorization/stable/2022-04-01/examples/
     * GetDenyAssignmentByScope.json
     */
    /**
     * Sample code: List deny assignments for scope.
     * 
     * @param azure The entry point for accessing resource management APIs in Azure.
     */
    public static void listDenyAssignmentsForScope(com.azure.resourcemanager.AzureResourceManager azure) {
        azure.accessManagement().roleAssignments().manager().roleServiceClient().getDenyAssignments()
            .listForScope("subscriptions/subId", null, com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

from azure.identity import DefaultAzureCredential
from azure.mgmt.authorization import AuthorizationManagementClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-authorization
# USAGE
    python get_deny_assignment_by_scope.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = AuthorizationManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.deny_assignments.list_for_scope(
        scope="subscriptions/subId",
    )
    for item in response:
        print(item)


# x-ms-original-file: specification/authorization/resource-manager/Microsoft.Authorization/stable/2022-04-01/examples/GetDenyAssignmentByScope.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

package armauthorization_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v3"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/310a0100f5b020c1900c527a6aa70d21992f078a/specification/authorization/resource-manager/Microsoft.Authorization/stable/2022-04-01/examples/GetDenyAssignmentByScope.json
func ExampleDenyAssignmentsClient_NewListForScopePager() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armauthorization.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	pager := clientFactory.NewDenyAssignmentsClient().NewListForScopePager("subscriptions/subId", &armauthorization.DenyAssignmentsClientListForScopeOptions{Filter: nil})
	for pager.More() {
		page, err := pager.NextPage(ctx)
		if err != nil {
			log.Fatalf("failed to advance page: %v", err)
		}
		for _, v := range page.Value {
			// You could use page here. We use blank identifier for just demo purposes.
			_ = v
		}
		// If the HTTP response code is 200 as defined in example definition, your page structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
		// page.DenyAssignmentListResult = armauthorization.DenyAssignmentListResult{
		// 	Value: []*armauthorization.DenyAssignment{
		// 		{
		// 			Name: to.Ptr("denyAssignmentId"),
		// 			Type: to.Ptr("Microsoft.Authorization/denyAssignments"),
		// 			ID: to.Ptr("/subscriptions/subId/providers/Microsoft.Authorization/denyAssignments/denyAssignmentId"),
		// 			Properties: &armauthorization.DenyAssignmentProperties{
		// 				Description: to.Ptr("Deny assignment description"),
		// 				DenyAssignmentName: to.Ptr("Deny assignment name"),
		// 				DoNotApplyToChildScopes: to.Ptr(false),
		// 				ExcludePrincipals: []*armauthorization.Principal{
		// 					{
		// 						Type: to.Ptr("principalType2"),
		// 						ID: to.Ptr("principalId2"),
		// 				}},
		// 				IsSystemProtected: to.Ptr(true),
		// 				Permissions: []*armauthorization.DenyAssignmentPermission{
		// 					{
		// 						Actions: []*string{
		// 							to.Ptr("action")},
		// 							DataActions: []*string{
		// 								to.Ptr("action")},
		// 								NotActions: []*string{
		// 								},
		// 								NotDataActions: []*string{
		// 								},
		// 						}},
		// 						Principals: []*armauthorization.Principal{
		// 							{
		// 								Type: to.Ptr("principalType1"),
		// 								ID: to.Ptr("principalId1"),
		// 						}},
		// 						Scope: to.Ptr("/subscriptions/subId"),
		// 					},
		// 			}},
		// 		}
	}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { AuthorizationManagementClient } = require("@azure/arm-authorization");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to Gets deny assignments for a scope.
 *
 * @summary Gets deny assignments for a scope.
 * x-ms-original-file: specification/authorization/resource-manager/Microsoft.Authorization/stable/2022-04-01/examples/GetDenyAssignmentByScope.json
 */
async function listDenyAssignmentsForScope() {
  const scope = "subscriptions/subId";
  const credential = new DefaultAzureCredential();
  const client = new AuthorizationManagementClient(credential);
  const resArray = new Array();
  for await (let item of client.denyAssignments.listForScope(scope)) {
    resArray.push(item);
  }
  console.log(resArray);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

using Azure;
using Azure.ResourceManager;
using System;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.Authorization;

// Generated from example definition: specification/authorization/resource-manager/Microsoft.Authorization/stable/2022-04-01/examples/GetDenyAssignmentByScope.json
// this example is just showing the usage of "DenyAssignments_ListForScope" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// get the collection of this DenyAssignmentResource
string scope = "subscriptions/subId";
DenyAssignmentCollection collection = client.GetDenyAssignments(new ResourceIdentifier(scope));

// invoke the operation and iterate over the result
await foreach (DenyAssignmentResource item in collection.GetAllAsync())
{
    // the variable item is a resource, you could call other operations on this instance as well
    // but just for demo, we get its data from this resource instance
    DenyAssignmentData resourceData = item.Data;
    // for demo we just print out the id
    Console.WriteLine($"Succeeded on id: {resourceData.Id}");
}

Console.WriteLine("Succeeded");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

示例响应

状态代码:: 200

{
  "value": [
    {
      "properties": {
        "denyAssignmentName": "Deny assignment name",
        "description": "Deny assignment description",
        "permissions": [
          {
            "actions": [
              "action"
            ],
            "notActions": [],
            "dataActions": [
              "action"
            ],
            "notDataActions": []
          }
        ],
        "scope": "/subscriptions/subId",
        "doNotApplyToChildScopes": false,
        "principals": [
          {
            "id": "principalId1",
            "type": "principalType1"
          }
        ],
        "excludePrincipals": [
          {
            "id": "principalId2",
            "type": "principalType2"
          }
        ],
        "isSystemProtected": true
      },
      "id": "/subscriptions/subId/providers/Microsoft.Authorization/denyAssignments/denyAssignmentId",
      "type": "Microsoft.Authorization/denyAssignments",
      "name": "denyAssignmentId"
    }
  ]
}

定义

名称	说明
DenyAssignment	拒绝分配
DenyAssignmentListResult	拒绝分配列表作结果。
DenyAssignmentPermission	拒绝分配权限。
ErrorAdditionalInfo	资源管理错误附加信息。
ErrorDetail	错误详细信息。
ErrorResponse	错误响应
Principal	上次修改实体的名称

DenyAssignment

Object

拒绝分配

名称	类型	说明
id	string	拒绝分配 ID。
name	string	拒绝分配名称。
properties.condition	string	拒绝分配的条件。这会限制可分配给的资源。例如：@Resource[Microsoft.Storage/storageAccounts/blobServices/containers：ContainerName] StringEqualsIgnoreCase “foo_storage_container”
properties.conditionVersion	string	条件的版本。
properties.createdBy	string	创建分配的用户的 ID
properties.createdOn	string (date-time)	创建时间
properties.denyAssignmentName	string	拒绝分配的显示名称。
properties.description	string	拒绝分配的说明。
properties.doNotApplyToChildScopes	boolean	确定拒绝分配是否适用于子范围。默认值为 false。
properties.excludePrincipals	Principal[]	拒绝分配不适用的主体数组。
properties.isSystemProtected	boolean	指定此拒绝分配是否由 Azure 创建，并且无法编辑或删除。
properties.permissions	DenyAssignmentPermission[]	拒绝分配拒绝的权限数组。
properties.principals	Principal[]	拒绝分配应用到的主体数组。
properties.scope	string	拒绝分配范围。
properties.updatedBy	string	更新分配的用户的 ID
properties.updatedOn	string (date-time)	更新时间
type	string	拒绝分配类型。

DenyAssignmentListResult

Object

拒绝分配列表作结果。

名称	类型	说明
nextLink	string	用于获取下一组结果的 URL。
value	DenyAssignment[]	拒绝分配列表。

DenyAssignmentPermission

Object

拒绝分配权限。

名称	类型	说明
actions	string[]	拒绝分配不向其授予访问权限的作。
condition	string	拒绝分配权限的条件。这会限制它适用的资源。
conditionVersion	string	条件的版本。
dataActions	string[]	拒绝分配不向其授予访问权限的数据作。
notActions	string[]	要从该拒绝分配中排除的作不会授予访问权限。
notDataActions	string[]	要从中排除拒绝分配的数据作不会授予访问权限。

ErrorAdditionalInfo

Object

资源管理错误附加信息。

名称	类型	说明
info	object	其他信息。
type	string	其他信息类型。

ErrorDetail

Object

错误详细信息。

名称	类型	说明
additionalInfo	ErrorAdditionalInfo[]	错误附加信息。
code	string	错误代码。
details	ErrorDetail[]	错误详细信息。
message	string	错误消息。
target	string	错误目标。

ErrorResponse

Object

错误响应

名称	类型	说明
error	ErrorDetail	错误对象。

Principal

Object

上次修改实体的名称

名称	类型	说明
displayName	string	主体的名称进行了更改
email	string	主体的电子邮件
id	string	主体的 ID 进行了更改
type	string	主体类型，如用户、组等