Skip to content

Commit 5b3f49b

Browse files
LauragraLauragra
authored
Merge pull request #25516 from microsoftgraph/rbac-device
Entra admin roles - Devices
2 parents 9c72e92 + 35344f3 commit 5b3f49b

35 files changed

+194
-91
lines changed

‎api-reference/beta/api/device-delete-registeredowners.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2626

2727
[!INCLUDE [limited-info](../../includes/limited-info.md)]
2828

29+
[!INCLUDE [rbac-devices-apis-write](../includes/rbac-for-apis/rbac-devices-apis-write.md)]
30+
2931
## HTTP request
3032
<!-- { "blockType": "ignored" } -->
3133
```http

‎api-reference/beta/api/device-delete-registeredusers.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
2626

2727
[!INCLUDE [limited-info](../../includes/limited-info.md)]
2828

29-
The calling user must also be in at least one of the following [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json): *Intune Administrator* or *Windows 365 Administrator*.
29+
[!INCLUDE [rbac-devices-apis-write](../includes/rbac-for-apis/rbac-devices-apis-write.md)]
3030

3131
## HTTP request
3232
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/device-delete.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,11 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "device_delete" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/device-delete-permissions.md)]
2626

27-
The calling user must also be in at least one of the following [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json): *Intune Administrator*, *Windows 365 Administrator*, or *Cloud Device Administrator*.
27+
> [!IMPORTANT]
28+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
29+
> - Intune Administrator
30+
> - Windows 365 Administrator
31+
> - Cloud Device Administrator
2832
2933
## HTTP request
3034

‎api-reference/beta/api/device-delta.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2323
<!-- { "blockType": "permissions", "name": "device_delta" } -->
2424
[!INCLUDE [permissions-table](../includes/permissions/device-delta-permissions.md)]
2525

26+
[!INCLUDE [rbac-devices-apis-read](../includes/rbac-for-apis/rbac-devices-apis-read.md)]
27+
2628
## HTTP request
2729
To begin tracking changes, you make a request including the delta function on the **device** resource.
2830

@@ -35,7 +37,7 @@ GET /devices/delta
3537

3638
Tracking changes incurs a round of one or more **delta** function calls. To use any query parameter other than `$deltatoken` and `$skiptoken`, you must specify it in the initial **delta** request and Microsoft Graph automatically encodes any specified parameters into the `$deltatoken` portion of the `@odata.nextLink` or `@odata.deltaLink` URL provided in the response.
3739

38-
| Query parameter | Type |Description|
40+
| Query parameter | Type |Description|
3941
|:---------------|:--------|:----------|
4042
| $deltatoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.deltaLink` URL of the previous **delta** function call for the same resource collection, indicating the completion of that round of change tracking. Save and apply the entire `@odata.deltaLink` URL including this token in the first request of the next round of change tracking for that collection.|
4143
| $skiptoken | string | A [state token](/graph/delta-query-overview) returned in the `@odata.nextLink` URL of the previous **delta** function call, indicating that there are further changes to be tracked in the same resource collection. |

‎api-reference/beta/api/device-get.md

Lines changed: 1 addition & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -26,33 +26,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
2626
<!-- { "blockType": "permissions", "name": "device_get" } -->
2727
[!INCLUDE [permissions-table](../includes/permissions/device-get-permissions.md)]
2828

29-
The calling user must also be in at least one of the following [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json):
30-
31-
* Users
32-
* Directory Readers
33-
* Directory Writers
34-
* Compliance Administrator
35-
* Device Managers
36-
* Application Administrator
37-
* Security Reader
38-
* Security Administrator
39-
* Privileged Role Administrator
40-
* Cloud Application Administrator
41-
* Customer LockBox Access Approver
42-
* Dynamics 365 Administrator
43-
* Power BI Administrator
44-
* Desktop Analytics Administrator
45-
* Microsoft Managed Desktop Administrator
46-
* Teams Communications Administrator
47-
* Teams Communications Support Engineer
48-
* Teams Communications Support Specialist
49-
* Teams Administrator
50-
* Compliance Data Administrator
51-
* Security Operator
52-
* Kaizala Administrator
53-
* Global Reader
54-
* Directory Reviewer
55-
* Windows 365 Administrator
29+
[!INCLUDE [rbac-devices-apis-read](../includes/rbac-for-apis/rbac-devices-apis-read.md)]
5630

5731
## HTTP request
5832

‎api-reference/beta/api/device-list-memberof.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,13 @@ Choose the permission or permissions marked as least privileged for this API. Us
2626

2727
[!INCLUDE [limited-info](../../includes/limited-info.md)]
2828

29+
> [!IMPORTANT]
30+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
31+
> - Directory Readers
32+
> - Global Reader
33+
> - Intune Administrator
34+
> - Windows 365 Administrator
35+
2936
## HTTP request
3037

3138
You can address the device using either its **id** or **deviceId**.

‎api-reference/beta/api/device-list-registeredowners.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,13 @@ Choose the permission or permissions marked as least privileged for this API. Us
2626

2727
[!INCLUDE [limited-info](../../includes/limited-info.md)]
2828

29+
> [!IMPORTANT]
30+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
31+
> - Directory Readers
32+
> - Global Reader
33+
> - Intune Administrator
34+
> - Windows 365 Administrator
35+
2936
## HTTP request
3037

3138
You can address the device using either its **id** or **deviceId**.

‎api-reference/beta/api/device-list-registeredusers.md

Lines changed: 6 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -27,33 +27,12 @@ Choose the permission or permissions marked as least privileged for this API. Us
2727

2828
[!INCLUDE [limited-info](../../includes/limited-info.md)]
2929

30-
The calling user must also be in at least one of the following [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json):
31-
32-
* Users
33-
* Directory Readers
34-
* Directory Writers
35-
* Compliance Administrator
36-
* Device Managers
37-
* Application Administrator
38-
* Security Reader
39-
* Security Administrator
40-
* Privileged Role Administrator
41-
* Cloud Application Administrator
42-
* Customer LockBox Access Approver
43-
* Dynamics 365 Administrator
44-
* Power BI Administrator
45-
* Desktop Analytics Administrator
46-
* Microsoft Managed Desktop Administrator
47-
* Teams Communications Administrator
48-
* Teams Communications Support Engineer
49-
* Teams Communications Support Specialist
50-
* Teams Administrator
51-
* Compliance Data Administrator
52-
* Security Operator
53-
* Kaizala Administrator
54-
* Global Reader
55-
* Directory Reviewer
56-
* Windows 365 Administrator
30+
> [!IMPORTANT]
31+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
32+
> - Directory Readers
33+
> - Global Reader
34+
> - Intune Administrator
35+
> - Windows 365 Administrator
5736
5837
## HTTP request
5938

‎api-reference/beta/api/device-list-transitivememberof.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,13 @@ Choose the permission or permissions marked as least privileged for this API. Us
2626

2727
[!INCLUDE [limited-info](../../includes/limited-info.md)]
2828

29+
> [!IMPORTANT]
30+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
31+
> - Directory Readers
32+
> - Global Reader
33+
> - Intune Administrator
34+
> - Windows 365 Administrator
35+
2936

3037
## HTTP request
3138

‎api-reference/beta/api/device-list-usagerights.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,13 @@ Choose the permission or permissions marked as least privileged for this API. Us
2222
<!-- { "blockType": "permissions", "name": "device_list_usagerights" } -->
2323
[!INCLUDE [permissions-table](../includes/permissions/device-list-usagerights-permissions.md)]
2424

25+
> [!IMPORTANT]
26+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
27+
> - Directory Readers
28+
> - Global Reader
29+
> - Intune Administrator
30+
> - Windows 365 Administrator
31+
2532
## HTTP request
2633

2734
You can address the device using either its **id** or **deviceId**.

0 commit comments

Comments
 (0)