Merge pull request #25439 from microsoftgraph/rbac-trustFramework-b2c

Lauragra · web-flow · commit 585ef7c8e0c3 · 2024-10-16T18:46:51.000-07:00
Entra admin roles - Azure AD B2C trust framework keyset
diff --git a/api-reference/beta/api/trustframework-list-keysets.md b/api-reference/beta/api/trustframework-list-keysets.md
@@ -2,7 +2,7 @@
 title: "List keySets"
 description: "Retrieve a list of trustframeworkkeyset objects."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: "apiPageType"
 ---
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframework_list_keysets" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframework-list-keysets-permissions.md)]
 
+[!INCLUDE [rbac-b2c-trustframework-keyset-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md)]
+
 ## HTTP request
 
 <!-- { "blockType": "ignored" } -->
diff --git a/api-reference/beta/api/trustframework-list-trustframeworkpolicies.md b/api-reference/beta/api/trustframework-list-trustframeworkpolicies.md
@@ -2,7 +2,7 @@
 title: "List trustFrameworkPolicies"
 description: "This operation lists all trustFrameworkPolicy objects in an Azure AD B2C tenant."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: apiPageType
 ---
@@ -23,7 +23,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframework_list_trustframeworkpolicies" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframework-list-trustframeworkpolicies-permissions.md)]
 
-The work or school account must have at least the *B2C IEF Keyset Administrator* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
+[!INCLUDE [rbac-b2c-trustframework-policy-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-policy-apis.md)]
 
 ## HTTP request
 
diff --git a/api-reference/beta/api/trustframework-post-keysets.md b/api-reference/beta/api/trustframework-post-keysets.md
@@ -2,7 +2,7 @@
 title: "Create trustFrameworkKeySet"
 description: "Create a new **trustFrameworkKeySet** object."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: "apiPageType"
 ---
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframework_post_keysets" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframework-post-keysets-permissions.md)]
 
+[!INCLUDE [rbac-b2c-trustframework-keyset-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md)]
+
 ## HTTP request
 
 <!-- { "blockType": "ignored" } -->
diff --git a/api-reference/beta/api/trustframework-post-trustframeworkpolicy.md b/api-reference/beta/api/trustframework-post-trustframeworkpolicy.md
@@ -2,7 +2,7 @@
 title: "Create trustFrameworkPolicy"
 description: "This operation creates a new trustFrameworkPolicy object in an Azure AD B2C tenant."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: apiPageType
 ---
@@ -23,7 +23,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframework_post_trustframeworkpolicy" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframework-post-trustframeworkpolicy-permissions.md)]
 
-The work or school account must have at least the *B2C IEF Keyset Administrator* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
+[!INCLUDE [rbac-b2c-trustframework-policy-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-policy-apis.md)]
 
 ## HTTP request
 
diff --git a/api-reference/beta/api/trustframework-put-trustframeworkpolicy.md b/api-reference/beta/api/trustframework-put-trustframeworkpolicy.md
@@ -2,7 +2,7 @@
 title: "Update trustFrameworkPolicy"
 description: "This operation updates an existing trustFrameworkPolicy object, or if one doesn't exist, it creates one. "
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: apiPageType
 ---
@@ -23,7 +23,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframework_put_trustframeworkpolicy" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframework-put-trustframeworkpolicy-permissions.md)]
 
-The work or school account must have at least the *B2C IEF Keyset Administrator* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
+[!INCLUDE [rbac-b2c-trustframework-policy-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-policy-apis.md)]
 
 ## HTTP request
 
diff --git a/api-reference/beta/api/trustframeworkkey_v2-get.md b/api-reference/beta/api/trustframeworkkey_v2-get.md
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframeworkkey_v2_get" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframeworkkey_v2-get-permissions.md)]
 
+[!INCLUDE [rbac-b2c-trustframework-keyset-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/trustframeworkkey_v2-update.md b/api-reference/beta/api/trustframeworkkey_v2-update.md
@@ -22,6 +22,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframeworkkey_v2_update" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframeworkkey_v2-update-permissions.md)]
 
+[!INCLUDE [rbac-b2c-trustframework-keyset-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/trustframeworkkeyset-delete.md b/api-reference/beta/api/trustframeworkkeyset-delete.md
@@ -2,7 +2,7 @@
 title: "Delete trustFrameworkKeySet"
 description: "Delete a **trustFrameworkKeySet** object."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: "apiPageType"
 ---
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframeworkkeyset_delete" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframeworkkeyset-delete-permissions.md)]
 
+[!INCLUDE [rbac-b2c-trustframework-keyset-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md)]
+
 ## HTTP request
 
 <!-- { "blockType": "ignored" } -->
diff --git a/api-reference/beta/api/trustframeworkkeyset-generatekey.md b/api-reference/beta/api/trustframeworkkeyset-generatekey.md
@@ -2,7 +2,7 @@
 title: "trustFrameworkKeySet: generateKey"
 description: "Generate a key and a secret automatically in the keyset."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: "apiPageType"
 ---
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframeworkkeyset_generatekey" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframeworkkeyset-generatekey-permissions.md)]
 
+[!INCLUDE [rbac-b2c-trustframework-keyset-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md)]
+
 ## HTTP request
 
 <!-- { "blockType": "ignored" } -->
diff --git a/api-reference/beta/api/trustframeworkkeyset-get.md b/api-reference/beta/api/trustframeworkkeyset-get.md
@@ -2,7 +2,7 @@
 title: "Get trustFrameworkKeySet"
 description: "Retrieve the properties and relationships of trustframeworkkeyset object."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: "apiPageType"
 ---
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframeworkkeyset_get" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframeworkkeyset-get-permissions.md)]
 
+[!INCLUDE [rbac-b2c-trustframework-keyset-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md)]
+
 ## HTTP request
 
 <!-- { "blockType": "ignored" } -->
diff --git a/api-reference/beta/api/trustframeworkkeyset-getactivekey.md b/api-reference/beta/api/trustframeworkkeyset-getactivekey.md
@@ -2,7 +2,7 @@
 title: "trustFrameworkKeySet: getActiveKey"
 description: "Get the active key in the keyset."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: "apiPageType"
 ---
@@ -25,6 +25,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframeworkkeyset_getactivekey" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframeworkkeyset-getactivekey-permissions.md)]
 
+[!INCLUDE [rbac-b2c-trustframework-keyset-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md)]
+
 ## HTTP request
 
 <!-- { "blockType": "ignored" } -->
diff --git a/api-reference/beta/api/trustframeworkkeyset-update.md b/api-reference/beta/api/trustframeworkkeyset-update.md
@@ -2,7 +2,7 @@
 title: "Update trustFrameworkKeySet"
 description: "Update the properties of a **trustFrameworkKeySet** object."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: "apiPageType"
 ---
@@ -22,6 +22,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframeworkkeyset_update" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframeworkkeyset-update-permissions.md)]
 
+[!INCLUDE [rbac-b2c-trustframework-keyset-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md)]
+
 ## HTTP request
 
 <!-- { "blockType": "ignored" } -->
diff --git a/api-reference/beta/api/trustframeworkkeyset-uploadcertificate.md b/api-reference/beta/api/trustframeworkkeyset-uploadcertificate.md
@@ -2,7 +2,7 @@
 title: "trustFrameworkKeySet: uploadCertificate"
 description: "Upload a certificate to a keyset."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: "apiPageType"
 ---
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframeworkkeyset_uploadcertificate" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframeworkkeyset-uploadcertificate-permissions.md)]
 
+[!INCLUDE [rbac-b2c-trustframework-keyset-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md)]
+
 ## HTTP request
 
 <!-- { "blockType": "ignored" } -->
@@ -123,11 +125,11 @@ HTTP/1.1 200 OK
 Content-type: application/json
 
 {
-	"kid": "kid-value",
-	"use": "sig",
-	"kty": "oct",
-	"nbf": 1508969811,
-	"exp": 1508973711
+    "kid": "kid-value",
+    "use": "sig",
+    "kty": "oct",
+    "nbf": 1508969811,
+    "exp": 1508973711
 }
 ```
 
diff --git a/api-reference/beta/api/trustframeworkkeyset-uploadpkcs12.md b/api-reference/beta/api/trustframeworkkeyset-uploadpkcs12.md
@@ -2,7 +2,7 @@
 title: "trustFrameworkKeySet: uploadPkcs12"
 description: "Upload a PKCS 12 format key (PFX) to a keyset."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: "apiPageType"
 ---
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframeworkkeyset_uploadpkcs12" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframeworkkeyset-uploadpkcs12-permissions.md)]
 
+[!INCLUDE [rbac-b2c-trustframework-keyset-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md)]
+
 ## HTTP request
 
 <!-- { "blockType": "ignored" } -->
@@ -125,11 +127,11 @@ HTTP/1.1 200 OK
 Content-type: application/json
 
 {
-	"kid": "kid-value",
-	"use": "sig",
-	"kty": "OCT",
-	"nbf": 1508969811,
-	"exp": 1508973711
+    "kid": "kid-value",
+    "use": "sig",
+    "kty": "OCT",
+    "nbf": 1508969811,
+    "exp": 1508973711
 }
 ```
 
diff --git a/api-reference/beta/api/trustframeworkkeyset-uploadsecret.md b/api-reference/beta/api/trustframeworkkeyset-uploadsecret.md
@@ -2,7 +2,7 @@
 title: "trustFrameworkKeySet: uploadSecret"
 description: "Upload a secret to a keyset."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: "apiPageType"
 ---
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframeworkkeyset_uploadsecret" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframeworkkeyset-uploadsecret-permissions.md)]
 
+[!INCLUDE [rbac-b2c-trustframework-keyset-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md)]
+
 ## HTTP request
 
 <!-- { "blockType": "ignored" } -->
@@ -129,11 +131,11 @@ HTTP/1.1 200 OK
 Content-type: application/json
 
 {
-	"kid": "kid-value",
-	"use": "use-value",
-	"kty": "OCT",
-	"nbf": 1508969811,
-	"exp": 1508973711
+    "kid": "kid-value",
+    "use": "use-value",
+    "kty": "OCT",
+    "nbf": 1508969811,
+    "exp": 1508973711
 }
 ```
 
diff --git a/api-reference/beta/api/trustframeworkpolicy-delete.md b/api-reference/beta/api/trustframeworkpolicy-delete.md
@@ -2,7 +2,7 @@
 title: "Delete trustFrameworkPolicy"
 description: "This operation deletes an existing trustFrameworkPolicy object from an Azure AD B2C tenant."  
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: apiPageType
 ---
@@ -23,7 +23,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframeworkpolicy_delete" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframeworkpolicy-delete-permissions.md)]
 
-The work or school account must have at least the *B2C IEF Keyset Administrator* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
+[!INCLUDE [rbac-b2c-trustframework-policy-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-policy-apis.md)]
 
 ## HTTP request
 
diff --git a/api-reference/beta/api/trustframeworkpolicy-get.md b/api-reference/beta/api/trustframeworkpolicy-get.md
@@ -2,7 +2,7 @@
 title: "Get trustFrameworkPolicy"
 description: "This operation retrieves an existing trustFrameworkPolicy content from an Azure AD B2C tenant."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: apiPageType
 ---
@@ -23,7 +23,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "trustframeworkpolicy_get" } -->
 [!INCLUDE [permissions-table](../includes/permissions/trustframeworkpolicy-get-permissions.md)]
 
-The work or school account must have at least the *B2C IEF Keyset Administrator* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
+[!INCLUDE [rbac-b2c-trustframework-policy-apis](../includes/rbac-for-apis/rbac-b2c-trustframework-policy-apis.md)]
 
 ## HTTP request
 
diff --git a/api-reference/beta/includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md b/api-reference/beta/includes/rbac-for-apis/rbac-b2c-trustframework-keyset-apis.md
@@ -0,0 +1,7 @@
+---
+author: gysingh
+ms.topic: include
+---
+
+> [!IMPORTANT]
+> In delegated scenarios with work or school accounts, the admin must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. *B2C IEF Keyset Administrator* is the least privileged role supported for this operation.
diff --git a/api-reference/beta/includes/rbac-for-apis/rbac-b2c-trustframework-policy-apis.md b/api-reference/beta/includes/rbac-for-apis/rbac-b2c-trustframework-policy-apis.md
@@ -0,0 +1,7 @@
+---
+author: gysingh
+ms.topic: include
+---
+
+> [!IMPORTANT]
+> In delegated scenarios with work or school accounts, the admin must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. *B2C IEF Policy Administrator* is the least privileged role supported for this operation.
diff --git a/api-reference/beta/resources/trustframeworkpolicy.md b/api-reference/beta/resources/trustframeworkpolicy.md
@@ -2,7 +2,7 @@
 title: "trustFrameworkPolicy"
 description: "In the Azure AD B2C trust framework policy is referred to as custom policies. This describes the operations available on a trustFrameworkPolicy object for the tenant."
 ms.localizationpriority: medium
-author: "Nickgmicrosoft"
+author: "gysingh"
 ms.subservice: "entra-sign-in"
 doc_type: resourcePageType
 ---
diff --git a/api-reference/beta/toc/identity-and-access/toc.yml b/api-reference/beta/toc/identity-and-access/toc.yml
diff --git a/api-reference/beta/toc/toc.mapping.json b/api-reference/beta/toc/toc.mapping.json
