question

According to your description, I think what you need is API SetProfilePolicy. This API can modify the Policy of Group. You can see this Policy in [Game Manager]->[Groups]->[Policy].

You may need to implement a Cloud Script/Azure Function to handle all process in one execution. This CSAF should include the following features.

• Create Group

• Create Rule

• Set Profile Policy

It is important to note that the policies you write in parameter Statements will overwrite the original Policy. API GetProfile returns the original Policy.

For more information about Set Profile Policy please refer to Set Profile Policy.

In terms of Cloud Script, please refer to CloudScript quickstart.

Thank you for your answer.

So far I have made two functions in CloudScript to get old policy for a group and to set new permissions for a new role. Function to get policy works perfectly. For both functions I attach the code below:

handlers.createRoleInGroupWithSpecificPermissions = function (args, context) {


    // The profile of the entity specified in the 'ExecuteEntityCloudScript' request.
    // Defaults to the authenticated entity in the X-EntityToken header.
    var entityProfile = args;


    // The pre-defined 'entity' object has functions corresponding to each PlayFab Entity API,
    // including 'SetObjects' (https://api.playfab.com/documentation/Data/method/SetObjects).
    
    let stringStatementsInJSON = entityProfile.OldListOfPermissions;
    
    var request = 
    {
        Entity: {
            Id: entityProfile.Id,
            Type: entityProfile.Type,
            TypeString: entityProfile.TypeString
        },
        Statements: [
            stringStatementsInJSON,
            {
                Action: "*",
                Effect: "Allow",
                Resource: "pfrn:group--group!*/Applications/*",
                Principal: {
                    MemberOf: {
                        RoleId: "viceadmins"
                    },
                    ChildOf: {
                        EntityType: "title",
                        EntityId: "5ACE5"
                    }
               },
                Comment: "Vicedmins access to invitations",
                Condition: null
            }
        ]
    };
        
    var result = entity.SetProfilePolicy(request);//GetProfile(request);
    return result;
};


handlers.getGroupPolicy = function (args, context) {


    // The profile of the entity specified in the 'ExecuteEntityCloudScript' request.
    // Defaults to the authenticated entity in the X-EntityToken header.
    var entityProfile = args;


    // The pre-defined 'entity' object has functions corresponding to each PlayFab Entity API,
    // including 'SetObjects' (https://api.playfab.com/documentation/Data/method/SetObjects).
    var request = {
        Entity: {
            Id: entityProfile.Id,
            Type: entityProfile.Type,
            TypeString: entityProfile.TypeString
        },
        DataAsObject: false
    };
    var result = entity.GetProfile(request);
    return result;
};

I have a problem with passing existing permissions to request to set new ones (due to the fact that SetProfilePolicy overwrites everything as you mentioned).

My code in C# to get actual policy:

PlayFabClientAPI.ExecuteCloudScript(new PlayFab.ClientModels.ExecuteCloudScriptRequest()
            {
                FunctionName = "getGroupPolicy",
                RevisionSelection = PlayFab.ClientModels.CloudScriptRevisionOption.Live,
                GeneratePlayStreamEvent = true,
                FunctionParameter = new
                {
                    Id = groupEntity.Id,
                    Type = groupEntity.Type,
                    TypeString = groupEntity.Type
                }
            }, OnExecuteCloudScript, OnSharedError);


private void OnExecuteCloudScript(PlayFab.ClientModels.ExecuteCloudScriptResult result)
        {
            JsonObject jsonResult = (JsonObject)result.FunctionResult;
            jsonResult.TryGetValue("Profile", out object profileNode);
            JsonObject testJsonObj = (JsonObject)PluginManager.GetPlugin<ISerializerPlugin>(PluginContract.PlayFab_Serializer).DeserializeObject(profileNode.ToString());
            testJsonObj.TryGetValue("Permissions", out object oldListOfPermissionsTemp);
            oldListOfPermissions = oldListOfPermissionsTemp.ToString().Trim(new char[] { '[', ']' });

And to set new policy:

PlayFabClientAPI.ExecuteCloudScript(new PlayFab.ClientModels.ExecuteCloudScriptRequest()
            {
                FunctionName = "createRoleInGroupWithSpecificPermissions",
                RevisionSelection = PlayFab.ClientModels.CloudScriptRevisionOption.Live,
                GeneratePlayStreamEvent = true,
                FunctionParameter = new
                {
                    Id = groupEntity.Id,
                    Type = groupEntity.Type,
                    TypeString = groupEntity.Type,
                    OldListOfPermissions = oldListOfPermissions
                }
            }, OnExecuteSetCloudScript, OnSharedError);

private void OnExecuteSetCloudScript(PlayFab.ClientModels.ExecuteCloudScriptResult result)
        {
            JsonObject jsonResult = (JsonObject)result.FunctionResult;
            Debug.Log(jsonResult);

I invoke mentioned above ExectuteCloudScript on click one of two buttons for test.

When I invoked this method, I got an error to Unity Console with message "The Entity field is required". But when I paste old permissions directly to CloudScript function, everything is OK. I tried with re-serialization, JSON methods in CloudScript, but I still get the same error.

Do you have you any idea where the problem may be?