Skip to content

Commit 72a48d7

Browse files
LauragraLauragra
authored
Merge pull request #25500 from microsoftgraph/rbac-bitLocker
Entra admin roles - Bitlocker
2 parents 448750a + 8cb54d6 commit 72a48d7

File tree

4 files changed

+36
-32
lines changed

4 files changed

+36
-32
lines changed

‎api-reference/beta/api/bitlocker-list-recoverykeys.md

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,15 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "bitlocker_list_recoverykeys" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/bitlocker-list-recoverykeys-permissions.md)]
2626

27-
For delegated permissions to allow apps to get **bitLockerRecoveryKey** resources on behalf of the signed-in user, the user must be the registered owner of the device that the BitLocker recovery key was originally backed up from, or the calling user must be in at least one of the following [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
28-
29-
* Cloud Device Administrator
30-
* Helpdesk Administrator
31-
* Intune Service Administrator
32-
* Security Administrator
33-
* Security Reader
34-
* Global Reader
27+
> [!IMPORTANT]
28+
> For delegated permissions, the calling user must be the registered owner of the device that the BitLocker recovery key was originally backed up from, or they must be assigned a supported [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).The following least privileged roles are supported for this operation.
29+
>
30+
> - Cloud device administrator
31+
> - Helpdesk administrator
32+
> - Intune service administrator
33+
> - Security administrator
34+
> - Security reader
35+
> - Global reader
3536

3637
## HTTP request
3738
To get a list of BitLocker keys within the tenant:

‎api-reference/beta/api/bitlockerrecoverykey-get.md

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,15 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "bitlockerrecoverykey_get" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/bitlockerrecoverykey-get-permissions.md)]
2626

27-
>**Note:** For delegated permissions to allow apps to get **bitLockerRecoveryKey** resources on behalf of the signed-in user, the tenant administrator must have assigned the user one of the following [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json), or the user must be the **registered owner** of the device that the BitLocker key was originally backed up from:
28-
29-
* Cloud Device Administrator
30-
* Helpdesk Administrator
31-
* Intune Service Administrator
32-
* Security Administrator
33-
* Security Reader
34-
* Global Reader
27+
> [!IMPORTANT]
28+
> For delegated permissions, the calling user must be the registered owner of the device that the BitLocker recovery key was originally backed up from, or they must be assigned a supported [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).The following least privileged roles are supported for this operation.
29+
>
30+
> - Cloud device administrator
31+
> - Helpdesk administrator
32+
> - Intune service administrator
33+
> - Security administrator
34+
> - Security reader
35+
> - Global reader
3536

3637
## HTTP request
3738
To get the specified BitLocker key without returning the **key** property:

‎api-reference/v1.0/api/bitlocker-list-recoverykeys.md

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,15 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "bitlocker_list_recoverykeys" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/bitlocker-list-recoverykeys-permissions.md)]
2626

27-
For delegated permissions, the calling user must be the registered owner of the device that the BitLocker recovery key was originally backed up from, or they must be in at least one of the following [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json):
28-
29-
* Cloud device administrator
30-
* Helpdesk administrator
31-
* Intune service administrator
32-
* Security administrator
33-
* Security reader
34-
* Global reader
27+
> [!IMPORTANT]
28+
> For delegated permissions, the calling user must be the registered owner of the device that the BitLocker recovery key was originally backed up from, or they must be assigned a supported [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).The following least privileged roles are supported for this operation.
29+
>
30+
> - Cloud device administrator
31+
> - Helpdesk administrator
32+
> - Intune service administrator
33+
> - Security administrator
34+
> - Security reader
35+
> - Global reader
3536

3637
## HTTP request
3738

‎api-reference/v1.0/api/bitlockerrecoverykey-get.md

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,15 @@ Choose the permission or permissions marked as least privileged for this API. Us
2222
<!-- { "blockType": "permissions", "name": "bitlockerrecoverykey_get" } -->
2323
[!INCLUDE [permissions-table](../includes/permissions/bitlockerrecoverykey-get-permissions.md)]
2424

25-
For delegated permissions, the calling user must be the registered owner of the device that the BitLocker recovery key was originally backed up from, or they must be in at least one of the following [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json):
26-
27-
* Cloud device administrator
28-
* Helpdesk administrator
29-
* Intune service administrator
30-
* Security administrator
31-
* Security reader
32-
* Global reader
25+
> [!IMPORTANT]
26+
> For delegated permissions, the calling user must be the registered owner of the device that the BitLocker recovery key was originally backed up from, or they must be assigned a supported [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).The following least privileged roles are supported for this operation.
27+
>
28+
> - Cloud device administrator
29+
> - Helpdesk administrator
30+
> - Intune service administrator
31+
> - Security administrator
32+
> - Security reader
33+
> - Global reader
3334

3435
## HTTP request
3536
To get the specified BitLocker key without returning the **key** property:

0 commit comments

Comments
 (0)