question

For clarification, most unlink APIs, such as UnlinkFacebookAccount, UnlinkGameCenterAccount, UnlinkCustomID, only have Client APIs. Only these two APIs - UnlinkPSNAccount, UnlinkXboxAccount have the corresponding Server APIs. And this API - UnlinkServerCustomId can be only accessed by servers. Besides, we don’t support calling the Client APIs on the server-side, such as on CoudScript using Azure Functions. It means you can only block the Client APIs - UnlinkPSNAccount, UnlinkXboxAccount to prevent clients from unlinking PSN and Xbox accounts, then call the Server APIs of them on CoudScript using Azure Functions. Your design don’t apply for other unlink APIs.

If you want to block the corresponding client APIs to prevent clients from unlinking the PSN account and Xbox account from the user’s PlayFab account, you can refer to the documentation - API Access Policy - PlayFab | Microsoft Docs to deny the accesses of the Client APIs - UnlinkPSNAccount, UnlinkXboxAccount, so that these two operations can only be accessed by servers. If except for the Server APIs UnlinkPSNAccount and UnlinkXboxAccount, you need the Server APIs to unlink other external accounts, you can try to add a feature request for them.