Dodjela resursa klasama na razini pomoću komponenti PowerShell i Microsoft Graph

Budući da Microsoft poboljšava svoje sigurnosno stanje u svim proizvodima i uslugama, došlo je do promjena u funkcionalnosti API-ja koje mogu utjecati na korisnike koji su se prije oslanjali na dozvole samo za aplikaciju za dodjelu resursa Bilježnicama za predmete i timovima predmeta pomoću API-ja.

I dalje možete dodjeljivati predmete i bilježnice na razini pomoću ljuske PowerShell i Microsoft Graph slijedeći podržane metode. U ovom se članku navode koraci i navode veze na relevantnu dokumentaciju.

Dodjela novih predmeta

1. mogućnost (preporučeno): Korištenje komponente Teams PowerShell

Dodjela novih predmeta pomoću komponente PowerShell aplikacije Teams jednostavno je koja će uključivati sve potrebne postavke za predmete i bilježnice. Jednostavno prilagodite željeni zaslonski naziv u sljedećoj skripti i pokrenite ga kao administrator.

Ogledna skripta

# Using the Teams PowerShell SDK
Install-Module -MicrosoftTeams -Force -AllowClobber
New-Team -DisplayName 'Test Class 20251208.4' -Template 'EDU\_Class' 

2. mogućnost: korištenje komponente Microsoft Graph PowerShell

Ako nemate pristup komponenti Teams PowerShell, možda ćete htjeti istražiti dodjelu razreda na razini pomoću platforme Microsoft Graph. Po potrebi uredite parametre na vrhu sljedeće skripte, a zatim pokrenite skriptu kao administrator da biste resurse dodjeljivali predmete i bilježnice na razini

Ogledna skripta

# Using the MS Graph API
Install-Module Microsoft.Graph -AllowClobber -Force

# PARAMETERS
$Name = "Test Class 20251208.3"
$Description = "A Test Class"
$Mail = $Name -replace '[^a-zA-Z0-9\\s]\|[ ]', '' # Replace this mail alias with a preferred generation method
$OwnerId = "000-000-00000-000000-000" # Replace this with the Owner's GUID
# ------------

# Create a new M365 Group
$CreateGroupBody = @"
{
  "description": "$Name",
  "displayName": "$Description",
  "groupTypes": [
    "Unified"
  ],
  "mailEnabled": false,
  "mailNickname": "$Mail",
  "securityEnabled": false,
  "members@odata.bind": [
    "https:⁠//graph.microsoft.com/v1.0/users/$OwnerId"
  ],
  "owners@odata.bind": [
    "https:⁠//graph.microsoft.com/v1.0/users/$OwnerId"
  ],
  "visibility": "HiddenMembership",
  "creationOptions": [
    "ExchangeProvisioningFlags:461",
    "classAssignments"
  ],
  "extension\_fe2174665583431c953114ff7268b7b3\_Education\_ObjectType": "Section",
  "resourceBehaviorOptions": [
    "appRoleForSite:22d27567-b3f0-4dc2-9ec2-46ed368ba538:fullcontrol",
    "appRoleForSite:c9a559d2-7aab-4f13-a6ed-e7e9c52aec87:fullcontrol",
    "appRoleForSite:13291f5a-59ac-4c59-b0fa-d1632e8f3292:fullcontrol",
    "appRoleForSite:2d4d3d8e-2be3-4bef-9f87-7875a61c29de:fullcontrol",
    "appRoleForSite:8f348934-64be-4bb2-bc16-c54c96789f43:fullcontrol"
  ]
}
"@
$NewGroup = Invoke-MgGraphRequest -uri 'https:⁠//graph.microsoft.com/v1.0/groups/' -Body $CreateGroupBody -Method POST -ContentType "application/json"

# Create Teams Class Team from group
$CreateTeamBody = @{
  "template@odata.bind" = "https:⁠//graph.microsoft.com/v1.0/teamsTemplates('educationClass')"
  "group@odata.bind" = "https:⁠//graph.microsoft.com/v1.0/groups('$($NewGroup.Id)')"
}
New-MgTeam -BodyParameter $CreateTeamBody 

Otklanjanje poteškoća: dodjeljivanje dozvola postojećim web-mjestima razreda

Ako ste već dodijelili nastavu i uočavate pogreške ili probleme s dozvolama u Bilježnici za predmete ili zadacima u aplikaciji Teams, dozvole web-mjesta za svoje predmete možete ažurirati pomoću sljedeće skripte zamjenjujući parametar rawGroups s groupID-jevima zahvaćenih klasa:

Ogledna skripta

#You will need to connect to SharePoint, Exchange Online, and Graph with the following -Scopes Sites.FullControl.All, as well as collect the groupIDs of Class Teams affected
$rawGroups =@("b0a5905d-09ae-4605-8e12-94da93ecbe92","e0eec729-24ef-451e-b079-56d0baf4dfc9")
# Convert to array of objects with .groupid
$groups = $rawGroups \| ForEach-Object { Get-UnifiedGroup -Identity $\_ }
$step = 0

#get the currently logged in user's account to add as a site admin
$CUA = (get-mgcontext).account

foreach ($group in $groups) {
  $step = $step + 1
  Set-SPOUser -Site $group.SharePointSiteUrl -LoginName $CUA -IsSiteCollectionAdmin $true
  Write-Host "SiteCollectionAdmin added on $step of $($Groups.Count) Class Sites"
}

#Pause for 5 minutes before tiggering the General Folder creation
Write-Host "Pausing for 5 Minutes before adding perms to allow SiteCollectionAdmin to propagate"
Start-Sleep -Seconds 300

Write-Host "Working on $($Groups.Count) Classes"

foreach ($group in $groups) {
  #$step = $step + 1
  $Site = Get-MgGroupSite -GroupId $group.ExternalDirectoryObjectId -SiteId "root"
  $SiteId = $Site.Id
  Write-Host "Processing permissions on $step of $($Groups.Count) Classes"
  # These are the AppIds for common Microsoft EDU Apps
  $AppIds = @{
    "8f348934-64be-4bb2-bc16-c54c96789f43"="EDU Assignments";
    "22d27567-b3f0-4dc2-9ec2-46ed368ba538"="Reading Assignments";
    "2d4d3d8e-2be3-4bef-9f87-7875a61c29de"="OneNote";
    "c9a559d2-7aab-4f13-a6ed-e7e9c52aec87"="Microsoft Forms";
    "13291f5a-59ac-4c59-b0fa-d1632e8f3292"="EDU OneNote";
  }
  # Apply the permissions to the group site
  $AppIds.Keys \| %{
    $AppId = $\_
    $Name = $AppIds[$\_]

    $Body = @" {
      "roles": ["fullcontrol"],
      "grantedToIdentities": [{
        "application": {
          "id": "$AppId",
          "displayName": "$Name"
        }
      }]
    }
"@

  Invoke-MgGraphRequest -Method POST -Uri "https:⁠//graph.microsoft.com/v1.0/sites/$SiteId/permissions" -Body $Body -ContentType "application/json"
}
}

Write-Host "Processed $($Groups.Count) Classes, removing sitecollectionadmin"
$step = 0
foreach ($group in $groups) {
  $step = $step + 1
  Set-SPOUser -Site $group.SharePointSiteUrl -LoginName $CUA -IsSiteCollectionAdmin $false
  Write-Host "SiteCollectionAdmin removed on $step of $($Groups.Count) Class Sites"
}