Policy API 概念
本文件說明 Cloud Identity Policy API 的概念和策略。
弱化
如要列出及取得政策，請參閱「設定 Policy API」和「列出及取得政策」。
術語
設定值：政策中提供的值
縮減設定值：套用至目標 (例如使用者、組織單位或群組) 的最終設定值
縮減：將政策設定值縮減為目標 (例如使用者、組織單位或群組) 的單一設定值
Reducer：這類規則會決定如何將政策設定值簡化為使用者的單一設定
管理員政策：管理員在管理控制台中建立的政策
系統政策：Google Workspace 提供的政策
縮減程序
如要降低特定使用者的特定設定：
篩除所有不適用於使用者的政策。
篩除不含該設定的政策。
篩除套用至目標使用者不屬於的機構單位政策。
篩除套用至目標使用者不屬於的群組的政策。
篩除適用於目標使用者未擁有的授權政策。如要進一步瞭解授權，請參閱「授權」一節。
套用指定設定的 Reducer。
Max：對於縮減設定中的每個欄位，Max 縮減器會從 sortOrder 最大的政策中選擇值。
Merge：針對縮減設定中的每個欄位，Merge 縮減器會從 sortOrder 最大且該欄位有值的政策中選擇值。如果欄位是陣列，Merge 縮減器會改為串連所有政策的值。
MaxMap：MaxMap 縮減器用於陣列項目具有主鍵欄位的設定。MaxMap 縮減器不會串連具有相同主鍵的陣列項目。而是使用 Max 縮減器，更新陣列項目中其他欄位的主鍵。
MergeMap：MergeMap 縮減器用於陣列項目具有主鍵欄位的設定。MergeMap 縮減器不會串連具有相同主鍵的陣列項目。而是使用合併歸納器，更新陣列項目中其他欄位的項目，這些欄位共用相同的主鍵。
清單：這些設定不會縮減為單一設定。而是保留整個設定序列，並以清單形式套用。
設定的 Reducer
| 設定名稱 | Reducer |
api_controls.custom_user_message
|
Max |
api_controls.google_services
|
MaxMap |
api_controls.internal_apps
|
Max |
api_controls.unconfigured_third_party_apps
|
合併 |
calendar.appointment_schedules
|
Max |
calendar.external_invitations
|
Max |
calendar.interoperability
|
合併 |
calendar.primary_calendar_max_allowed_external_sharing
|
合併 |
calendar.secondary_calendar_max_allowed_external_sharing
|
合併 |
chat.chat_apps_access
|
Max |
chat.chat_file_sharing
|
Max |
chat.chat_history
|
合併 |
chat.external_chat_restriction
|
合併 |
chat.space_history
|
Max |
classroom.api_data_access
|
Max |
classroom.class_membership
|
Max |
classroom.guardian_access
|
Max |
classroom.originality_reports
|
Max |
classroom.roster_import
|
Max |
classroom.student_unenrollment
|
Max |
classroom.teacher_permissions
|
Max |
cloud_sharing_options.cloud_data_sharing
|
Max |
detector.regular_expression
|
List |
detector.word_list
|
List |
drive_and_docs.drive_for_desktop
|
Max |
drive_and_docs.drive_sdk
|
合併 |
drive_and_docs.external_sharing
|
Max |
drive_and_docs.file_security_update
|
Max |
drive_and_docs.general_access_default
|
Max |
drive_and_docs.shared_drive_creation
|
Max |
gmail.attachment_compliance
|
MaxMap |
gmail.auto_forwarding
|
Max |
gmail.blocked_sender_lists
|
MaxMap |
gmail.comprehensive_mail_storage
|
Max |
gmail.confidential_mode
|
Max |
gmail.content_compliance
|
MaxMap |
gmail.email_address_lists
|
MaxMap |
gmail.email_attachment_safety
|
Max |
gmail.email_image_proxy_bypass
|
合併 |
gmail.email_spam_filter_ip_allowlist
|
Max |
gmail.enhanced_pre_delivery_message_scanning
|
Max |
gmail.enhanced_smime_encryption
|
Max |
gmail.imap_access
|
合併 |
gmail.links_and_external_images
|
Max |
gmail.mail_delegation
|
合併 |
gmail.name_format
|
合併 |
gmail.objectionable_content
|
MaxMap |
gmail.per_user_outbound_gateway
|
Max |
gmail.pop_access
|
Max |
gmail.rule_states
|
MaxMap |
gmail.spam_override_lists
|
MaxMap |
gmail.spoofing_and_authentication
|
Max |
gmail.user_email_uploads
|
Max |
gmail.workspace_sync_for_outlook
|
Max |
groups_for_business.groups_sharing
|
合併 |
meet.safety_access
|
Max |
meet.safety_domain
|
Max |
meet.safety_external_participants
|
Max |
meet.safety_host_management
|
Max |
meet.video_recording
|
Max |
rule.dlp
|
List |
rule.system_defined_alerts
|
List |
security.advanced_protection_program
|
Max |
security.less_secure_apps
|
合併 |
security.login_challenges
|
Max |
security.password
|
Max |
security.session_controls
|
Max |
security.super_admin_account_recovery
|
合併 |
security.two_step_verification_device_trust
|
Max |
security.two_step_verification_enforcement
|
Max |
security.two_step_verification_enforcement_factor
|
Max |
security.two_step_verification_enrollment
|
Max |
security.two_step_verification_grace_period
|
Max |
security.two_step_verification_sign_in_code
|
Max |
security.user_account_recovery
|
合併 |
SERVICE_STATUS_APP_NAME.service_status
|
Max |
sites.sites_creation_and_modification
|
Max |
user_takeout
|
Max |
workspace_marketplace.apps_access_options
|
合併 |
workspace_marketplace.apps_allowlist
|
MergeMap (主鍵為：application_id) |
授權
系統會根據使用者的 Workspace 授權套用政策。授權條件列於 PolicyQuery。
如需所有 Workspace 產品和 SKU ID 的完整清單，請參閱「Google 產品和 SKU ID」。
以下範例說明如何根據使用者的授權，將政策套用至特定使用者群組。
範例 1：僅限一般子句
entity.licenses.exists(license, license in ['/product/Google-Apps/sku/1010020027'])
如果使用者擁有清單中至少一個 SKU 的授權，系統就會套用這項政策。
範例 2：一般子句和倒裝子句
entity.licenses.exists(license, license in ['/product/Google-Apps/sku/1010020027']) && !entity.licenses.exists(license, license in ['/product/Google-Apps/sku/1010060005'])
如果使用者擁有第一項子句中至少一個 SKU 的授權，系統就會套用這項政策。不過，如果使用者擁有第二個子句中任何 SKU 的授權，這項政策就不會套用至該使用者。
範例 3：僅限倒裝子句
!entity.licenses.exists(license, license in ['/product/Google-Apps/sku/1010060005'])
如果使用者沒有清單中任何 SKU 的授權，系統就會套用這項政策。
預設欄位值
如果精簡設定中沒有某個欄位，則該欄位的預設值如下：
| 設定名稱 | 欄位 | 預設欄位值 |
api_controls.google_services
|
services | [] (空白清單)
|
calendar.external_invitations
|
warn_on_invite | true
|
calendar.interoperability
|
enable_interoperability | false
|
calendar.primary_calendar_max_allowed_external_sharing
|
max_allowed_external_sharing | EXTERNAL_FREE_BUSY_ONLY
|
calendar.secondary_calendar_max_allowed_external_sharing
|
max_allowed_external_sharing | EXTERNAL_ALL_INFO_READ_ONLY
|
chat.chat_apps_access
|
enable_apps | true (EDU SKU) 或 false (非 EDU SKU)。EDU SKU：
|
| enable_webhooks | true (EDU SKU) 或 false (非 EDU SKU)。教育版 SKU：
|
|
chat.chat_history
|
enable_chat_history | false
|
| history_on_by_default | false
|
|
| allow_user_modification | true
|
|
chat.external_chat_restriction
|
allow_external_chat | false
|
| external_chat_restriction | NO_RESTRICTION
|
|
chat.chat_and_space_restrictions
|
restriction_level | UNRESTRICTED
|
devices.android_available_apps
|
playstore_installable_apps | ALL
|
devices.android_verify_apps
|
turnoff_google_play_protect_allowed | false
|
devices.android_developer_options
|
allowed | false
|
devices.android_work_data_sync
|
allowed | true
|
devices.android_work_profile_sharing
|
allowed | false
|
devices.ios_apple_watch
|
no_wrist_detection_usage_allowed | true
|
devices.ios_backup_encryption
|
required | false
|
devices.ios_data_actions
|
external_data_sharing_allowed | true
|
| work_data_operation_type.non_workspace_apps_copy_paste_allowed | true
|
|
| work_data_operation_type.non_workspace_apps_sharing_allowed | true
|
|
| work_data_operation_type.personal_accounts_sharing_allowed | true
|
|
| work_data_operation_type.airdrop_sharing_allowed | true
|
|
| work_data_operation_type.files_printing_allowed | true
|
|
| work_data_operation_type.files_access_allowed | true
|
|
| work_data_operation_type.images_videos_saving_allowed | true
|
|
| work_data_operation_type.contacts_items_assignment_allowed | true
|
|
devices.ios_handoff
|
allowed | true
|
devices.ios_icloud_backup
|
allowed | true
|
devices.ios_lock_screen_control_center
|
allowed | true
|
devices.ios_lock_screen_notifications_view
|
allowed | true
|
devices.ios_safari_secure_browsing
|
fraudulent_website_warning_enforced | true
|
devices.android_google_play_private_apps
|
access_allowed | false
|
| publish_and_update_allowed | false
|
|
devices.android_screen_capture
|
allowed | true
|
devices.compromised_devices
|
compromised_android_devices_blocked | false
|
| jailbroken_ios_devices_blocked | false
|
|
devices.encryption
|
device_encryption_option | NOT_REQUIRED
|
devices.ios_icloud_storage
|
managed_apps_sync_allowed | true
|
devices.ios_screen_capture
|
allowed | true
|
devices.ios_keychain_sync
|
icloud_sync_allowed | true
|
devices.ios_document_sync
|
icloud_data_sync_allowed | true
|
devices.android_location_sharing
|
allowed | true
|
devices.android_apps_settings
|
modification_allowed | true
|
devices.android_trust_agents
|
smart_lock_allowed | true
|
devices.android_lock_screen_notifications
|
allowed | true
|
devices.android_lock_screen_notification_details
|
allowed | true
|
devices.android_unknown_source_apps
|
work_profile_installation_allowed | false
|
| personal_profile_installation_allowed | true
|
|
directory.external_directory_sharing
|
sharing_option | ORGANIZATION_DIRECTORY_DATA
|
drive_and_docs.drive_sdk
|
enable_drive_sdk_api_access | true
|
drive_and_docs.external_sharing
|
external_sharing_mode | ALLOWED
|
| allow_receiving_external_files | true
|
|
| warn_for_sharing_outside_allowlisted_domains | true
|
|
| allow_non_google_invites_in_allowlisted_domains | false
|
|
| allow_receiving_files_outside_allowlisted_domains | true
|
|
| warn_for_external_sharing | true
|
|
| allow_non_google_invites | true
|
|
| allow_publishing_files | true
|
|
| access_checker_suggestions | RECIPIENTS_OR_AUDIENCE_OR_PUBLIC
|
|
| allowed_parties_for_distributing_content | ALL_ELIGIBLE_USERS
|
|
drive_and_docs.general_access_default
|
default_file_access | LINK_SHARING_PRIVATE
|
gmail.auto_forwarding
|
enable_auto_forwarding | true
|
gmail.email_image_proxy_bypass
|
image_proxy_bypass_pattern | [] (空白清單)
|
| enable_image_proxy | true
|
|
gmail.email_spam_filter_ip_allowlist
|
allowed_ip_addresses | [] (空白清單)
|
gmail.links_and_external_images
|
apply_future_settings_automatically | true
|
| enable_aggressive_warnings_on_untrusted_links | false
|
|
gmail.mail_delegation
|
enable_mail_delegation | false
|
gmail.smime_encryption
|
enable_smime_encryption | STATUS_DISABLED
|
| allow_sha1_globally_in_smime_signature | false
|
|
gmail.spoofing_and_authentication
|
apply_future_settings_automatically | true
|
gmail.user_email_uploads
|
enable_mail_and_contacts_import | false
|
gmail.workspace_sync_for_outlook
|
enable_google_workspace_sync_for_microsoft_outlook | true
|
gmail.external_recipient_warning
|
enabled | true
|
groups_for_business.groups_sharing
|
collaboration_capability | DOMAIN_USERS_ONLY
|
| create_groups_access_level | USERS_IN_DOMAIN
|
|
| view_topics_default_access_level | DOMAIN_USERS
|
|
| owners_can_allow_external_members | false
|
|
| owners_can_allow_incoming_mail_from_public | true
|
|
| owners_can_hide_groups | false
|
|
| new_groups_are_hidden | false
|
|
security.less_secure_apps
|
allow_less_secure_apps | false
|
security.password
|
allowed_strength | STRONG
|
| minimum_length | 8
|
|
| maximum_length | 100
|
|
| enforce_requirements_at_login | false
|
|
| allow_reuse | false
|
|
| expiration_duration | 0
|
|
security.super_admin_account_recovery
|
enable_account_recovery | false
|
security.two_step_verification_device_trust
|
allow_trusting_device | true
|
security.two_step_verification_enforcement
|
enforced_from | 未設定 |
security.two_step_verification_enforcement_factor
|
allowed_sign_in_factor_set | ALL
|
security.two_step_verification_enrollment
|
allow_enrollment | true
|
security.two_step_verification_grace_period
|
enrollment_grace_period | 0s
|
security.user_account_recovery
|
enable_account_recovery | false
|
workspace_marketplace.apps_access_options
|
access_level | K-12 客戶：ALLOW_NONE
其他客戶：ALLOW_ALL
|
| allow_all_internal_apps | false
|
|
workspace_marketplace.apps_allowlist
|
apps | [] (空白清單)
|
系統群組
Google 系統群組不會顯示在 Groups API 中，且會連結至系統政策。與其他群組 ID 不同，這些群組 ID 的開頭並非 groups/。下表列出這些群組和所屬使用者。
| GroupId | 屬於這個群組的使用者 |
WORKSPACE_ALL_ADMIN_GROUP
|
所有管理員。 |
UNCONSENTED_CHILD_GROUP
|
EDU 使用者標示為未滿 18 歲，且未取得家長對一或多項額外服務的同意聲明。 |
不支援的 SKU 授權
License Manager API 不支援的 SKU 不會以標準格式顯示：
entity.licenses.exists(license, license in ['/product/{productId}/sku/{skuId}'])
而是以預留位置的形式出現在查詢字串中：
entity.licenses.exists(license, license in ['{placeholder}'])
例如：
entity.licenses.exists(license, license in ['CHROMEBOOK-SOFTWARE'])
下表列出這些 SKU 和對應的預留位置。
| 產品名稱 | Product ID | SKU ID | 預留位置 |
| Chromebook 軟體 | Google-Chrome-Device-Management
|
Google-Chrome-Device-Management-Perpetual
|
CHROMEBOOK-SOFTWARE
|
Google-Chrome-Device-Management
|
|||
Chrome-Active-Directory
|
|||
| Cloud Identity | 101001
|
1010010001
|
GOOGLE-IDENTITY
|