Skip to content

Commit 8c832ae

Browse files
LauragraLauragra
authored
Merge pull request #25508 from microsoftgraph/rbac-customsecurityattributes
Entra admin roles - CSAs
2 parents 4f9b384 + f0df768 commit 8c832ae

7 files changed

+44
-40
lines changed

‎api-reference/beta/api/allowedvalue-get.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,12 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "allowedvalue_get" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/allowedvalue-get-permissions.md)]
2626

27-
The signed-in user must also be assigned one of the following [directory roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json):
28-
29-
+ Attribute Definition Reader
30-
+ Attribute Definition Administrator
31-
32-
By default, Global Administrator and other administrator roles do not have permissions to read, define, or assign custom security attributes.
27+
> [!IMPORTANT]
28+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following privileged roles are supported for this operation.
29+
> - Attribute Definition Reader
30+
> - Attribute Definition Administrator
31+
>
32+
> - By default, Global Administrator and other administrator roles do not have permissions to read, define, or assign custom security attributes.
3333
3434
## HTTP request
3535

‎api-reference/beta/api/directory-list-customsecurityattributedefinitions.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,13 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "directory_list_customsecurityattributedefinitions" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/directory-list-customsecurityattributedefinitions-permissions.md)]
2626

27-
The signed-in user must also be assigned one of the following [directory roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json):
28-
29-
+ Attribute Definition Reader
30-
+ Attribute Assignment Administrator
31-
+ Attribute Definition Administrator
32-
33-
By default, Global Administrator and other administrator roles do not have permissions to read, define, or assign custom security attributes.
27+
> [!IMPORTANT]
28+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following privileged roles are supported for this operation.
29+
> - Attribute Definition Reader
30+
> - Attribute Assignment Administrator
31+
> - Attribute Definition Administrator
32+
>
33+
> By default, Global Administrator and other administrator roles do not have permissions to read, define, or assign custom security attributes.
3434
3535
## HTTP request
3636

‎api-reference/beta/includes/rbac-for-apis/rbac-customsecurityattibutes-apis-definition-assignment-read.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@ author: CecilyK
33
ms.topic: include
44
---
55

6-
In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following privileged roles are supported for this operation.
7-
8-
+ Attribute Assignment Reader
9-
+ Attribute Definition Reader
10-
+ Attribute Assignment Administrator
11-
+ Attribute Definition Administrator
12-
13-
By default, *Global Administrator* and other administrator roles don't have permissions to read, define, or assign custom security attributes.
6+
> [!IMPORTANT]
7+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following privileged roles are supported for this operation.
8+
> - Attribute Assignment Reader
9+
> - Attribute Definition Reader
10+
> - Attribute Assignment Administrator
11+
> - Attribute Definition Administrator
12+
>
13+
> By default, *Global Administrator* and other administrator roles don't have permissions to read, define, or assign custom security attributes.

‎api-reference/beta/includes/rbac-for-apis/rbac-customsecurityattibutes-apis-write.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ author: CecilyK
33
ms.topic: include
44
---
55

6-
In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. *Attribute Definition Administrator* is the only privileged role supported for this operation.
7-
8-
By default, *Global Administrator* and other administrator roles don't have permissions to read, define, or assign custom security attributes.
6+
> [!IMPORTANT]
7+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. *Attribute Definition Administrator* is the only privileged role supported for this operation.
8+
>
9+
> By default, *Global Administrator* and other administrator roles don't have permissions to read, define, or assign custom security attributes.

‎api-reference/beta/includes/rbac-for-apis/rbac-customsecurityattibutes-audit-apis-read.md

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,10 @@
22
author: rolyon
33
ms.topic: include
44
---
5-
In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following privileged roles are supported for this operation.
65

7-
- Attribute Log Reader
8-
- Attribute Log Administrator
9-
10-
By default, Global Administrator and other administrator roles do not have permissions to read custom security attribute audit logs.
6+
> [!IMPORTANT]
7+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following privileged roles are supported for this operation.
8+
> - Attribute Log Reader
9+
> - Attribute Log Administrator
10+
>
11+
> By default, Global Administrator and other administrator roles do not have permissions to read custom security attribute audit logs.

‎api-reference/v1.0/includes/rbac-for-apis/rbac-customsecurityattibutes-apis-definition-assignment-read.md

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,12 @@ author: CecilyK
33
ms.topic: include
44
---
55

6-
In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following privileged roles are supported for this operation.
7-
8-
+ Attribute Assignment Reader
9-
+ Attribute Definition Reader
10-
+ Attribute Assignment Administrator
11-
+ Attribute Definition Administrator
12-
13-
By default, *Global Administrator* and other administrator roles don't have permissions to read, define, or assign custom security attributes.
6+
> [!IMPORTANT]
7+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following privileged roles are supported for this operation.
8+
>
9+
> - Attribute Assignment Reader
10+
> - Attribute Definition Reader
11+
> - Attribute Assignment Administrator
12+
> - Attribute Definition Administrator
13+
>
14+
> By default, *Global Administrator* and other administrator roles don't have permissions to read, define, or assign custom security attributes.

‎api-reference/v1.0/includes/rbac-for-apis/rbac-customsecurityattibutes-apis-write.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ author: CecilyK
33
ms.topic: include
44
---
55

6-
In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. *Attribute Definition Administrator* is the only privileged role supported for this operation.
7-
8-
By default, *Global Administrator* and other administrator roles don't have permissions to read, define, or assign custom security attributes.
6+
> [!IMPORTANT]
7+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. *Attribute Definition Administrator* is the only privileged role supported for this operation.
8+
>
9+
> By default, *Global Administrator* and other administrator roles don't have permissions to read, define, or assign custom security attributes.

0 commit comments

Comments
 (0)