Skip to content

Commit 5431a82

Browse files
LauragraLauragra
authored
Merge pull request #25643 from microsoftgraph/rbac-signIn-v2
Entra admin roles - sign ins + CA
2 parents 9524427 + edf8695 commit 5431a82

File tree

11 files changed

+32
-41
lines changed

11 files changed

+32
-41
lines changed

‎api-reference/beta/api/signin-get.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,6 @@ Choose the permission or permissions marked as least privileged for this API. Us
2828

2929
[!INCLUDE [rbac-signin-apis-read](../includes/rbac-for-apis/rbac-signin-apis-read.md)]
3030

31-
[!INCLUDE [signins-roles-for-ca-data](../../includes/signins-roles-for-ca-data.md)]
32-
3331
## HTTP request
3432

3533
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/signin-list.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,6 @@ Choose the permission or permissions marked as least privileged for this API. Us
3131

3232
[!INCLUDE [rbac-signin-apis-read](../includes/rbac-for-apis/rbac-signin-apis-read.md)]
3333

34-
### Viewing applied conditional access (CA) policies in sign-ins
35-
36-
[!INCLUDE [signins-roles-for-ca-data](../../includes/signins-roles-for-ca-data.md)]
37-
3834
## HTTP request
3935
<!-- { "blockType": "ignored" } -->
4036
```http

‎api-reference/beta/includes/rbac-for-apis/rbac-signin-apis-read.md

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,17 @@ ms.topic: include
99
> - Reports Reader
1010
> - Security Administrator
1111
> - Security Operator
12-
> - Security Reader
12+
> - Security Reader
13+
>
14+
> The applied Conditional Access (CA) policies listed in **appliedConditionalAccessPolicies** property are only available to users and apps with roles that allow them to read [conditional access data](/graph/api/resources/appliedconditionalaccesspolicy). If a user or app has permissions to read sign-in logs but not permission to read conditional access data, the **appliedConditionalAccessPolicies** property in the response will be omitted. The signed-in user must be assigned supported Microsoft Entra roles and the app granted supported Microsoft Graph permissions.
15+
> - The following least-privileged roles grant users permissions to view conditional access data:
16+
> - Global Reader
17+
> - Security Administrator
18+
> - Security Reader
19+
> - Conditional Access Administrator
20+
> - Applications must have at least one of the following permissions to see [appliedConditionalAccessPolicy](/graph/api/resources/appliedconditionalaccesspolicy) objects in the sign-in logs:
21+
> - Policy.Read.All
22+
> - Policy.Read.ConditionalAccess
23+
> - Policy.ReadWrite.ConditionalAccess
24+
>
25+
> Signed-in users with any permissions can read their own sign-in logs. This feature helps users spot unexpected activity in their accounts. However, the users can't read CA data from their own logs unless they have one of the supporting permissions identified above.

‎api-reference/beta/resources/appliedconditionalaccesspolicy.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ Namespace: microsoft.graph
1515

1616
Indicates the attributes related to applied conditional access policy or policies that are triggered by a [sign-in](signin.md) activity.
1717

18-
The data in this object is returned only for callers with privileges to read conditional access data. For more information, see [Viewing applied conditional access (CA) policies in sign-ins](../api/signin-list.md#viewing-applied-conditional-access-ca-policies-in-sign-ins).
18+
The data in this object is returned only for callers with privileges to read conditional access data. For more information, see [Permissions for viewing applied conditional access (CA) policies in sign-ins](../api/signin-list.md#permissions).
1919

2020
## Properties
2121

‎api-reference/beta/resources/signin.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ The [Microsoft Entra data retention policies](/azure/active-directory/reports-mo
3535
|:---------------|:--------|:----------|
3636
|appDisplayName|String|The application name displayed in the Microsoft Entra admin center. <br/><br/> Supports `$filter` (`eq`, `startsWith`).|
3737
|appId|String|The application identifier in Microsoft Entra ID. <br/><br/> Supports `$filter` (`eq`).|
38-
|appliedConditionalAccessPolicies|[appliedConditionalAccessPolicy](appliedconditionalaccesspolicy.md) collection|A list of conditional access policies that the corresponding sign-in activity triggers. Apps need more Conditional Access-related privileges to read the details of this property. For more information, see [Viewing applied conditional access (CA) policies in sign-ins](../api/signin-list.md#viewing-applied-conditional-access-ca-policies-in-sign-ins).|
38+
|appliedConditionalAccessPolicies|[appliedConditionalAccessPolicy](appliedconditionalaccesspolicy.md) collection|A list of conditional access policies that the corresponding sign-in activity triggers. Apps need more Conditional Access-related privileges to read the details of this property. For more information, see [Permissions for viewing applied conditional access (CA) policies in sign-ins](../api/signin-list.md#permissions).|
3939
|appliedEventListeners|[appliedAuthenticationEventListener](../resources/appliedauthenticationeventlistener.md) collection|Detailed information about the listeners, such as Azure Logic Apps and Azure Functions, which the corresponding events in the sign-in event triggered.|
4040
|appTokenProtectionStatus|tokenProtectionStatus|Token protection creates a cryptographically secure tie between the token and the device it's issued to. This field indicates whether the app token was bound to the device.|
4141
|authenticationAppDeviceDetails|[authenticationAppDeviceDetails](../resources/authenticationappdevicedetails.md)|Provides details about the app and device used during a Microsoft Entra authentication step.|

‎api-reference/includes/signins-roles-for-ca-data.md

Lines changed: 0 additions & 23 deletions
This file was deleted.

‎api-reference/v1.0/api/signin-get.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,6 @@ Choose the permission or permissions marked as least privileged for this API. Us
2727

2828
[!INCLUDE [rbac-signin-apis-read](../includes/rbac-for-apis/rbac-signin-apis-read.md)]
2929

30-
[!INCLUDE [signins-roles-for-ca-data](../../includes/signins-roles-for-ca-data.md)]
31-
3230
## HTTP request
3331

3432
<!-- { "blockType": "ignored" } -->

‎api-reference/v1.0/api/signin-list.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,6 @@ Choose the permission or permissions marked as least privileged for this API. Us
2929

3030
[!INCLUDE [rbac-signin-apis-read](../includes/rbac-for-apis/rbac-signin-apis-read.md)]
3131

32-
### Viewing applied conditional access (CA) policies in sign-ins
33-
34-
[!INCLUDE [signins-roles-for-ca-data](../../includes/signins-roles-for-ca-data.md)]
35-
3632
## HTTP request
3733

3834
<!-- { "blockType": "ignored" } -->

‎api-reference/v1.0/includes/rbac-for-apis/rbac-signin-apis-read.md

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,17 @@ ms.topic: include
99
> - Reports Reader
1010
> - Security Administrator
1111
> - Security Operator
12-
> - Security Reader
12+
> - Security Reader
13+
>
14+
> The applied Conditional Access (CA) policies listed in **appliedConditionalAccessPolicies** property are only available to users and apps with roles that allow them to read [conditional access data](/graph/api/resources/appliedconditionalaccesspolicy). If a user or app has permissions to read sign-in logs but not permission to read conditional access data, the **appliedConditionalAccessPolicies** property in the response will be omitted. The signed-in user must be assigned supported Microsoft Entra roles and the app granted supported Microsoft Graph permissions.
15+
> - The following least-privileged roles grant users permissions to view conditional access data:
16+
> - Global Reader
17+
> - Security Administrator
18+
> - Security Reader
19+
> - Conditional Access Administrator
20+
> - Applications must have at least one of the following permissions to see [appliedConditionalAccessPolicy](/graph/api/resources/appliedconditionalaccesspolicy) objects in the sign-in logs:
21+
> - Policy.Read.All
22+
> - Policy.Read.ConditionalAccess
23+
> - Policy.ReadWrite.ConditionalAccess
24+
>
25+
> Signed-in users with any permissions can read their own sign-in logs. This feature helps users spot unexpected activity in their accounts. However, the users can't read CA data from their own logs unless they have one of the supporting permissions identified above.

‎api-reference/v1.0/resources/appliedconditionalaccesspolicy.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ Namespace: microsoft.graph
1313

1414
Indicates the attributes related to applied conditional access policy or policies that are triggered by a [sign-in](signin.md) activity.
1515

16-
The data in this object is returned only for callers with privileges to read conditional access data. For more information, see [Viewing applied conditional access (CA) policies in sign-ins](../api/signin-list.md#viewing-applied-conditional-access-ca-policies-in-sign-ins).
16+
The data in this object is returned only for callers with privileges to read conditional access data. For more information, see [Permissions for viewing applied conditional access (CA) policies in sign-ins](../api/signin-list.md#permissions).
1717

1818
## Properties
1919

0 commit comments

Comments
 (0)