Skip to content

Commit 760ee4d

Browse files
FaithOmbongiFaithOmbongi
committed
Batch 2
1 parent fcf2070 commit 760ee4d

11 files changed

+39
-81
lines changed

‎api-reference/beta/api/approleassignment-get.md

Lines changed: 12 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -18,45 +18,6 @@ Read the properties and relationships of an [appRoleAssignment](../resources/app
1818

1919
## Permissions
2020

21-
<!--
22-
### For client service principals
23-
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
24-
<!--
25-
|Permission type | Permissions (from least to most privileged) |
26-
|:--------------------|:---------------------------------------------------------|
27-
|Delegated (work or school account) | Application.Read.All, Directory.Read.All, Application.ReadWrite.All, Directory.ReadWrite.All |
28-
|Delegated (personal Microsoft account) | Not supported. |
29-
|Application | Application.Read.All, Directory.Read.All, Application.ReadWrite.OwnedBy, Application.ReadWrite.All, Directory.ReadWrite.All |
30-
31-
### For resource service principals
32-
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
33-
<!--
34-
|Permission type | Permissions (from least to most privileged) |
35-
|:--------------------|:---------------------------------------------------------|
36-
|Delegated (work or school account) | Application.Read.All, Directory.Read.All, Application.ReadWrite.All, Directory.ReadWrite.All |
37-
|Delegated (personal Microsoft account) | Not supported. |
38-
|Application | Application.Read.All, Directory.Read.All, Application.ReadWrite.OwnedBy, Application.ReadWrite.All, Directory.ReadWrite.All |
39-
40-
### For groups
41-
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
42-
<!--
43-
|Permission type | Permissions (from least to most privileged) |
44-
|:--------------------|:---------------------------------------------------------|
45-
|Delegated (work or school account) | Group.Read.All, Directory.Read.All, AppRoleAssignment.ReadWrite.All, Directory.ReadWrite.All |
46-
|Delegated (personal Microsoft account) | Not supported. |
47-
|Application | Group.Read.All, Directory.Read.All, AppRoleAssignment.ReadWrite.All, Directory.ReadWrite.All |
48-
49-
### For users
50-
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
51-
<!--
52-
|Permission type | Permissions (from least to most privileged) |
53-
|:--------------------|:---------------------------------------------------------|
54-
|Delegated (work or school account) | User.Read, User.ReadBasic.All, Directory.Read.All, AppRoleAssignment.ReadWrite.All |
55-
|Delegated (personal Microsoft account) | Not supported. |
56-
|Application | Directory.Read.All, AppRoleAssignment.ReadWrite.All |
57-
58-
-->
59-
6021
The following table shows the least privileged permission or permissions required to call this API on each supported resource type. Follow [best practices](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions) to request least privileged permissions. For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
6122

6223
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
@@ -69,6 +30,18 @@ The following table shows the least privileged permission or permissions require
6930

7031
[!INCLUDE [rbac-approleassignments-apis-read](../includes/rbac-for-apis/rbac-approleassignments-apis-read.md)]
7132

33+
### Other supported permissions:
34+
35+
The following higher privileged permissions are supported by each resource:
36+
- Groups:
37+
- Delegated and application permissions: Directory.Read.All, AppRoleAssignment.ReadWrite.All, Directory.ReadWrite.All
38+
- Users:
39+
- Delegated permissions: User.ReadBasic.All, Directory.Read.All, AppRoleAssignment.ReadWrite.All
40+
- Application permissions: Directory.Read.All, AppRoleAssignment.ReadWrite.All
41+
- Service principals:
42+
- Delegated permissions: Directory.Read.All, Application.ReadWrite.All, Directory.ReadWrite.All
43+
- Application permissions: Application.ReadWrite.OwnedBy, Application.ReadWrite.All, Directory.ReadWrite.All
44+
7245
## HTTP request
7346

7447
To get details of an appRole granted to a service principal:

‎api-reference/beta/api/group-delete-approleassignments.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "group_delete_approleassignments" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/group-delete-approleassignments-permissions.md)]
2626

27+
[!INCLUDE [rbac-approleassignments-apis-write](../includes/rbac-for-apis/rbac-approleassignments-apis-write.md)]
28+
2729
## HTTP request
2830

2931
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/group-list-approleassignments.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "group_list_approleassignments" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/group-list-approleassignments-permissions.md)]
2626

27+
[!INCLUDE [rbac-approleassignments-apis-read](../includes/rbac-for-apis/rbac-approleassignments-apis-read.md)]
28+
2729
## HTTP request
2830

2931
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/group-post-approleassignments.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
3030
<!-- { "blockType": "permissions", "name": "group_post_approleassignments" } -->
3131
[!INCLUDE [permissions-table](../includes/permissions/group-post-approleassignments-permissions.md)]
3232

33+
[!INCLUDE [rbac-approleassignments-apis-write](../includes/rbac-for-apis/rbac-approleassignments-apis-write.md)]
34+
3335
## HTTP request
3436

3537
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/serviceprincipal-list-approleassignedto.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
3030
<!-- { "blockType": "permissions", "name": "serviceprincipal_list_approleassignedto" } -->
3131
[!INCLUDE [permissions-table](../includes/permissions/serviceprincipal-list-approleassignedto-permissions.md)]
3232

33-
[!INCLUDE [rbac-approleassignments-apis-write](../includes/rbac-for-apis/rbac-approleassignments-apis-write.md)]
33+
[!INCLUDE [rbac-approleassignments-apis-read](../includes/rbac-for-apis/rbac-approleassignments-apis-read.md)]
3434

3535

3636
## HTTP request

‎api-reference/beta/api/serviceprincipal-list-approleassignments.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
3131

3232

3333

34-
[!INCLUDE [rbac-approleassignments-apis-write](../includes/rbac-for-apis/rbac-approleassignments-apis-write.md)]
34+
[!INCLUDE [rbac-approleassignments-apis-read](../includes/rbac-for-apis/rbac-approleassignments-apis-read.md)]
3535

3636

3737
## HTTP request

‎api-reference/beta/api/user-delete-approleassignments.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "user_delete_approleassignments" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/user-delete-approleassignments-permissions.md)]
2626

27+
[!INCLUDE [rbac-approleassignments-apis-write](../includes/rbac-for-apis/rbac-approleassignments-apis-write.md)]
28+
2729
## HTTP request
2830

2931
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/user-list-approleassignments.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2727
<!-- { "blockType": "permissions", "name": "user_list_approleassignments" } -->
2828
[!INCLUDE [permissions-table](../includes/permissions/user-list-approleassignments-permissions.md)]
2929

30+
[!INCLUDE [rbac-approleassignments-apis-read](../includes/rbac-for-apis/rbac-approleassignments-apis-read.md)]
31+
3032
## HTTP request
3133

3234
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/user-post-approleassignments.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2828
<!-- { "blockType": "permissions", "name": "user_post_approleassignments" } -->
2929
[!INCLUDE [permissions-table](../includes/permissions/user-post-approleassignments-permissions.md)]
3030

31+
[!INCLUDE [rbac-approleassignments-apis-write](../includes/rbac-for-apis/rbac-approleassignments-apis-write.md)]
32+
3133
## HTTP request
3234

3335
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/includes/rbac-for-apis/rbac-approleassignments-apis-read.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ ms.topic: include
77
>
88
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation:
99
>
10-
> - Directory Readers
1110
> - Guest Inviter - Read app role assignments for users only
11+
> - Directory Readers
1212
> - Directory Synchronization Accounts - for Microsoft Entra Connect and Microsoft Entra Cloud Sync services
1313
> - Directory Writer
1414
> - Hybrid Identity Administrator

0 commit comments

Comments
 (0)