question

You can refer to the code below. I wrote 3 cases in one function, but you don't need to call them all at the same time.

If you're modifying the policy for the first time, I suggest you use Postman and create a new Title to do some testing to understand what they do.

        [FunctionName("UpdatePolicy")]
        public static async Task<IActionResult> UpdatePolicy(
             [HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = null)] HttpRequest req,
             ILogger log)
        {
            FunctionExecutionContext<dynamic> context = JsonConvert.DeserializeObject<FunctionExecutionContext<dynamic>>(await req.ReadAsStringAsync());
            var settings = new PlayFabApiSettings
            {
                TitleId = context.TitleAuthenticationContext.Id,
                DeveloperSecretKey = Environment.GetEnvironmentVariable("PLAYFAB_DEV_SECRET_KEY", EnvironmentVariableTarget.Process),
            };
            var adminApi=new PlayFabAdminInstanceAPI(settings);


            //Get
            var getPolicy=new GetPolicyRequest()
            {
                PolicyName="ApiPolicy"
            };
            var getPolicyResult=await adminApi.GetPolicyAsync(getPolicy);

            //Add
            var addPolicy=new UpdatePolicyRequest()
            {
                PolicyName="ApiPolicy",
                OverwritePolicy=false,
                PolicyVersion=getPolicyResult.Result.PolicyVersion,
                Statements=new List<PermissionStatement>()
                {
                    new PermissionStatement()
                    {
                        Resource="pfrn:api--/Client/LoginWithCustomID",
                        Action="*",
                        Effect=PlayFab.AdminModels.EffectType.Allow,
                        Principal="*",
                        Comment="Allow client to login with custom id."
                    }
                }
            };
            await adminApi.UpdatePolicyAsync(addPolicy);

            //Update
            var  newStatements=getPolicyResult.Result.Statements;
            foreach(var item in newStatements)
            {
                if(item.Resource=="pfrn:api--/Client/LoginWithCustomID")
                {
                    item.Effect=PlayFab.AdminModels.EffectType.Deny;
                    item.Comment="Deny client to login with custom id.";
                }
            }
            var updatePolicy=new UpdatePolicyRequest()
            {
                PolicyName="ApiPolicy",
                OverwritePolicy=true,
                PolicyVersion=getPolicyResult.Result.PolicyVersion,
                Statements=newStatements
            };
            await adminApi.UpdatePolicyAsync(updatePolicy);


            return null;
        }