Skip to content

Commit 9415a5d

Browse files
FaithOmbongiFaithOmbongi
committed
Entra admin roles - domains
1 parent 73b8146 commit 9415a5d

28 files changed

+152
-186
lines changed

‎api-reference/beta/api/domain-delete.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
2828
<!-- { "blockType": "permissions", "name": "domain_delete" } -->
2929
[!INCLUDE [permissions-table](../includes/permissions/domain-delete-permissions.md)]
3030

31-
The work or school account needs to belong to at least the *Domain Name Administrator* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
31+
[!INCLUDE [rbac-domain-apis-write](../includes/rbac-for-apis/rbac-domain-apis-write.md)]
3232

3333
## HTTP request
3434
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/domain-forcedelete.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
4141
<!-- { "blockType": "permissions", "name": "domain_forcedelete" } -->
4242
[!INCLUDE [permissions-table](../includes/permissions/domain-forcedelete-permissions.md)]
4343

44-
The work or school account needs to belong to at least the *Domain Name Administrator* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
44+
[!INCLUDE [rbac-domain-apis-write](../includes/rbac-for-apis/rbac-domain-apis-write.md)]
4545

4646
## HTTP request
4747

‎api-reference/beta/api/domain-get.md

Lines changed: 1 addition & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -25,44 +25,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
2525
<!-- { "blockType": "permissions", "name": "domain_get" } -->
2626
[!INCLUDE [permissions-table](../includes/permissions/domain-get-permissions.md)]
2727

28-
The work or school account needs to belong to at least one of the following [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
29-
30-
* User Administrator
31-
* Helpdesk Administrator
32-
* Service Support Administrator
33-
* Billing Administrator
34-
* Mailbox Administrator
35-
* Directory Readers
36-
* Directory Writers
37-
* AdHoc License Administrator
38-
* Application Administrator
39-
* Security Reader
40-
* Security Administrator
41-
* Privileged Role Administrator
42-
* Cloud Application Administrator
43-
* Customer LockBox Access Approver
44-
* Dynamics 365 Administrator
45-
* Power BI Administrator
46-
* Azure Information Protection Administrator
47-
* Desktop Analytics Administrator
48-
* License Administrator
49-
* Microsoft Managed Desktop Administrator
50-
* Authentication Administrator
51-
* Privileged Authentication Administrator
52-
* Teams Communications Administrator
53-
* Teams Communications Support Engineer
54-
* Teams Communications Support Specialist
55-
* Teams Administrator
56-
* Insights Administrator
57-
* Compliance Data Administrator
58-
* Security Operator
59-
* Kaizala Administrator
60-
* Global Reader
61-
* Volume Licensing Business Center User
62-
* Volume Licensing Service Center User
63-
* Modern Commerce Administrator
64-
* Microsoft Store for Business User
65-
* Directory Reviewer
28+
[!INCLUDE [rbac-domain-apis-read](../includes/rbac-for-apis/rbac-domain-apis-read.md)]
6629

6730
## HTTP request
6831

‎api-reference/beta/api/domain-list-domainnamereferences.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2727

2828
[!INCLUDE [limited-info](../../includes/limited-info.md)]
2929

30-
The work or school account needs to belong to at least the *Domain Name Administrator* or*Global Reader* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
30+
> [!IMPORTANT]
31+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation: *Domain Name Administrator* or *Global Reader*.
3132
3233
## HTTP request
3334
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/domain-list-rootdomain.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2323
<!-- { "blockType": "permissions", "name": "domain_list_rootdomain" } -->
2424
[!INCLUDE [permissions-table](../includes/permissions/domain-list-rootdomain-permissions.md)]
2525

26+
[!INCLUDE [rbac-domain-apis-read](../includes/rbac-for-apis/rbac-domain-apis-read.md)]
27+
2628
## HTTP request
2729

2830
<!-- {

‎api-reference/beta/api/domain-list-serviceconfigurationrecords.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ Choose the permission or permissions marked as least privileged for this API. Us
2727
<!-- { "blockType": "permissions", "name": "domain_list_serviceconfigurationrecords" } -->
2828
[!INCLUDE [permissions-table](../includes/permissions/domain-list-serviceconfigurationrecords-permissions.md)]
2929

30+
> [!IMPORTANT]
31+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation: *Domain Name Administrator* or *Global Reader*.
32+
3033
## HTTP request
3134
<!-- { "blockType": "ignored" } -->
3235
```http

‎api-reference/beta/api/domain-list-verificationdnsrecords.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2929
<!-- { "blockType": "permissions", "name": "domain_list_verificationdnsrecords" } -->
3030
[!INCLUDE [permissions-table](../includes/permissions/domain-list-verificationdnsrecords-permissions.md)]
3131

32-
The work or school account needs to belong to at least the *Domain Name Administrator* or *Global Reader* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
32+
> [!IMPORTANT]
33+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation: *Domain Name Administrator* or *Global Reader*.
3334
3435
## HTTP request
3536
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/domain-list.md

Lines changed: 1 addition & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -24,48 +24,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "domain_list" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/domain-list-permissions.md)]
2626

27-
The work or school account needs to belong to at least one of the following [Microsoft Entra roles](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json):
28-
29-
* User Administrator
30-
* Helpdesk Administrator
31-
* Service Support Administrator
32-
* Billing Administrator
33-
* Mailbox Administrator
34-
* Directory Readers
35-
* Directory Writers
36-
* AdHoc License Administrator
37-
* Application Administrator
38-
* Security Reader
39-
* Security Administrator
40-
* Privileged Role Administrator
41-
* Cloud Application Administrator
42-
* Customer LockBox Access Approver
43-
* Dynamics 365 Administrator
44-
* Power BI Administrator
45-
* Azure Information Protection Administrator
46-
* Desktop Analytics Administrator
47-
* License Administrator
48-
* Microsoft Managed Desktop Administrator
49-
* Privileged Authentication Administrator
50-
* Teams Communications Administrator
51-
* Teams Communications Support Engineer
52-
* Authentication Administrator
53-
* Teams Communications Support Specialist
54-
* Teams Administrator
55-
* Insights Administrator
56-
* Compliance Data Administrator
57-
* Security Operator
58-
* Kaizala Administrator
59-
* Global Reader
60-
* Volume Licensing Business Center User
61-
* Volume Licensing Service Center User
62-
* Modern Commerce Administrator
63-
* Microsoft Store for Business User
64-
* Directory Reviewer
65-
* Domain Name Administrator
66-
* Users
67-
* Guest User
68-
* Restricted Guest User
27+
[!INCLUDE [rbac-domain-apis-read](../includes/rbac-for-apis/rbac-domain-apis-read.md)]
6928

7029
## HTTP request
7130
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/domain-post-domains.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
2727
<!-- { "blockType": "permissions", "name": "domain_post_domains" } -->
2828
[!INCLUDE [permissions-table](../includes/permissions/domain-post-domains-permissions.md)]
2929

30-
The work or school account needs to belong to at least the *Domain Name Administrator* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
30+
[!INCLUDE [rbac-domain-apis-write](../includes/rbac-for-apis/rbac-domain-apis-write.md)]
3131

3232
## HTTP request
3333

‎api-reference/beta/api/domain-promote.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "domain_promote" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/domain-promote-permissions.md)]
2626

27-
The work or school account needs to belong to at least the *Domain Name Administrator* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
27+
[!INCLUDE [rbac-domain-apis-write](../includes/rbac-for-apis/rbac-domain-apis-write.md)]
2828

2929
## HTTP request
3030

0 commit comments

Comments
 (0)