編輯

共用方式為


Create customSecurityAttributeDefinition

Namespace: microsoft.graph

Create a new customSecurityAttributeDefinition object.

This API is available in the following national cloud deployments.

Global service US Government L4 US Government L5 (DOD) China operated by 21Vianet

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

Permission type Least privileged permissions Higher privileged permissions
Delegated (work or school account) CustomSecAttributeDefinition.ReadWrite.All Not available.
Delegated (personal Microsoft account) Not supported. Not supported.
Application CustomSecAttributeDefinition.ReadWrite.All Not available.

Important

In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported Microsoft Entra role or a custom role with a supported role permission. Attribute Definition Administrator is the only privileged role supported for this operation.

By default, Global Administrator and other administrator roles don't have permissions to read, define, or assign custom security attributes.

HTTP request

POST /directory/customSecurityAttributeDefinitions

Request headers

Name Description
Authorization Bearer {token}. Required. Learn more about authentication and authorization.
Content-Type application/json. Required.

Request body

In the request body, supply a JSON representation of the customSecurityAttributeDefinition object.

The following table shows the properties that you can configure when you create a customSecurityAttributeDefinition.

Property Type Description
attributeSet String Name of the attribute set. Case sensitive. Required.
description String Description of the custom security attribute. Can be up to 128 characters long and include Unicode characters. Cannot contain spaces or special characters. Can be changed later. Optional.
isCollection Boolean Indicates whether multiple values can be assigned to the custom security attribute. Cannot be changed later. If type is set to Boolean, isCollection cannot be set to true. Required.
isSearchable Boolean Indicates whether custom security attribute values are indexed for searching on objects that are assigned attribute values. Cannot be changed later. Required.
name String Name of the custom security attribute. Must be unique within an attribute set. Can be up to 32 characters long and include Unicode characters. Cannot contain spaces or special characters. Cannot be changed later. Case sensitive. Required.
status String Specifies whether the custom security attribute is active or deactivated. Acceptable values are Available and Deprecated. Can be changed later. Required.
type String Data type for the custom security attribute values. Supported types are: Boolean, Integer, and String. Cannot be changed later. Required.
usePreDefinedValuesOnly Boolean Indicates whether only predefined values can be assigned to the custom security attribute. If set to false, free-form values are allowed. Can later be changed from true to false, but cannot be changed from false to true. If type is set to Boolean, usePreDefinedValuesOnly cannot be set to true. Required.

The id property is auto generated and cannot be set.

Response

If successful, this method returns a 201 Created response code and a customSecurityAttributeDefinition object in the response body.

Examples

Example 1: Add a custom security attribute

The following example adds a new custom security attribute definition that is a single free-form value of type String.

  • Attribute set: Engineering
  • Attribute: ProjectDate

Request

The following example shows a request.

POST https://graph.microsoft.com/v1.0/directory/customSecurityAttributeDefinitions
Content-Type: application/json

{
    "attributeSet":"Engineering",
    "description":"Target completion date",
    "isCollection":false,
    "isSearchable":true,
    "name":"ProjectDate",
    "status":"Available",
    "type":"String",
    "usePreDefinedValuesOnly": false
}

Response

The following example shows the response.

HTTP/1.1 201 Created
Content-Type: application/json

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#directory/customSecurityAttributeDefinitions/$entity",
    "attributeSet": "Engineering",
    "description": "Target completion date",
    "id": "Engineering_ProjectDate",
    "isCollection": false,
    "isSearchable": true,
    "name": "ProjectDate",
    "status": "Available",
    "type": "String",
    "usePreDefinedValuesOnly": false
}

Example 2: Add a custom security attribute that supports multiple predefined values

The following example adds a new custom security attribute definition that supports multiple values of type String that are predefined.

  • Attribute set: Engineering
  • Attribute: Project

Request

The following example shows a request.

POST https://graph.microsoft.com/v1.0/directory/customSecurityAttributeDefinitions
Content-Type: application/json
Content-length: 310

{
    "attributeSet":"Engineering",
    "description":"Active projects for user",
    "isCollection":true,
    "isSearchable":true,
    "name":"Project",
    "status":"Available",
    "type":"String",
    "usePreDefinedValuesOnly": true
}

Response

The following example shows the response.

HTTP/1.1 201 Created
Content-Type: application/json

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#directory/customSecurityAttributeDefinitions/$entity",
    "attributeSet": "Engineering",
    "description": "Active projects for user",
    "id": "Engineering_Project",
    "isCollection": true,
    "isSearchable": true,
    "name": "Project",
    "status": "Available",
    "type": "String",
    "usePreDefinedValuesOnly": true
}

Example 3: Add a custom security attribute with a list of predefined values

The following example adds a new custom security attribute definition with a list of predefined values as a collection of Strings.

  • Attribute set: Engineering
  • Attribute: Project
  • Attribute data type: Collection of Strings
  • Predefined values: Alpine, Baker, Cascade

Request

The following example shows a request.

POST https://graph.microsoft.com/v1.0/directory/customSecurityAttributeDefinitions
Content-Type: application/json

{
    "attributeSet": "Engineering",
    "description": "Active projects for user",
    "isCollection": true,
    "isSearchable": true,
    "name": "Project",
    "status": "Available",
    "type": "String",
    "usePreDefinedValuesOnly": true,
    "allowedValues": [
        {
            "id": "Alpine",
            "isActive": true
        },
        {
            "id": "Baker",
            "isActive": true
        },
        {
            "id": "Cascade",
            "isActive": true
        }
    ]
}

Response

The following example shows the response.

HTTP/1.1 201 Created
Content-Type: application/json

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#directory/customSecurityAttributeDefinitions/$entity",
    "attributeSet": "Engineering",
    "description": "Active projects for user",
    "id": "Engineering_Project",
    "isCollection": true,
    "isSearchable": true,
    "name": "Project",
    "status": "Available",
    "type": "String",
    "usePreDefinedValuesOnly": true
}