ImpersonationSessionMode
A model the API reference uses in a request or a response. The operation pages link every field typed as this model here.
How permissions are evaluated for the duration of an impersonation session.
Values
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Unspecified |
No mode has been derived. Treated as the most restrictive posture everywhere (equivalent to ReadOnly for enforcement), so an uninitialized value can never widen a session. |
ReadOnly |
Every permission classified Write, Delete or Manage is denied for the duration of the session. Read-classified permissions evaluate against the impersonated scope exactly as in Full. |
Intersect |
A permission is granted only where the impersonated scope grants it and the acting user's own roles or direct grants allow it. The permission-type classifier is not consulted: what the acting user may not do outside the session, they may not do inside it. |
Full |
The impersonated scope's own grants apply unmodified, including every write, delete and manage surface. The phase 1 read-write posture. |
Fields
| Field | Type | Description |
|---|
This model has no documented fields.