Skip to content

Commit a0ca9c2

Browse files
FaithOmbongiFaithOmbongi
committed
Entra admin roles - sign ins + CA
1 parent 92eaafa commit a0ca9c2

File tree

7 files changed

+28
-37
lines changed

7 files changed

+28
-37
lines changed

‎api-reference/beta/api/signin-get.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,6 @@ Choose the permission or permissions marked as least privileged for this API. Us
2828

2929
[!INCLUDE [rbac-signin-apis-read](../includes/rbac-for-apis/rbac-signin-apis-read.md)]
3030

31-
[!INCLUDE [signins-roles-for-ca-data](../../includes/signins-roles-for-ca-data.md)]
32-
3331
## HTTP request
3432

3533
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/signin-list.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,6 @@ Choose the permission or permissions marked as least privileged for this API. Us
3131

3232
[!INCLUDE [rbac-signin-apis-read](../includes/rbac-for-apis/rbac-signin-apis-read.md)]
3333

34-
### Viewing applied conditional access (CA) policies in sign-ins
35-
36-
[!INCLUDE [signins-roles-for-ca-data](../../includes/signins-roles-for-ca-data.md)]
37-
3834
## HTTP request
3935
<!-- { "blockType": "ignored" } -->
4036
```http

‎api-reference/beta/includes/rbac-for-apis/rbac-signin-apis-read.md

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,17 @@ ms.topic: include
99
> - Reports Reader
1010
> - Security Administrator
1111
> - Security Operator
12-
> - Security Reader
12+
> - Security Reader
13+
>
14+
> The applied Conditional Access (CA) policies listed in **appliedConditionalAccessPolicies** property are only available to users and apps with roles that allow them to read [conditional access data](/graph/api/resources/appliedconditionalaccesspolicy). If a user or app has permissions to read sign-in logs but not permission to read conditional access data, the **appliedConditionalAccessPolicies** property in the response will be omitted. The signed-in user must be assigned supported Microsoft Entra roles and the app granted supported Microsoft Graph permissions.
15+
> - The following least-privileged roles grant users permissions to view conditional access data:
16+
> - Global Reader
17+
> - Security Administrator
18+
> - Security Reader
19+
> - Conditional Access Administrator
20+
> - Applications must have at least one of the following permissions to see [appliedConditionalAccessPolicy](/graph/api/resources/appliedconditionalaccesspolicy) objects in the sign-in logs:
21+
> - Policy.Read.All
22+
> - Policy.Read.ConditionalAccess
23+
> - Policy.ReadWrite.ConditionalAccess
24+
>
25+
> Signed-in users with any permissions can read their own sign-in logs. This feature helps users spot unexpected activity in their accounts. However, the users can't read CA data from their own logs unless they have one of the supporting permissions identified above.

‎api-reference/includes/signins-roles-for-ca-data.md

Lines changed: 0 additions & 23 deletions
This file was deleted.

‎api-reference/v1.0/api/signin-get.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,6 @@ Choose the permission or permissions marked as least privileged for this API. Us
2727

2828
[!INCLUDE [rbac-signin-apis-read](../includes/rbac-for-apis/rbac-signin-apis-read.md)]
2929

30-
[!INCLUDE [signins-roles-for-ca-data](../../includes/signins-roles-for-ca-data.md)]
31-
3230
## HTTP request
3331

3432
<!-- { "blockType": "ignored" } -->

‎api-reference/v1.0/api/signin-list.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,6 @@ Choose the permission or permissions marked as least privileged for this API. Us
2929

3030
[!INCLUDE [rbac-signin-apis-read](../includes/rbac-for-apis/rbac-signin-apis-read.md)]
3131

32-
### Viewing applied conditional access (CA) policies in sign-ins
33-
34-
[!INCLUDE [signins-roles-for-ca-data](../../includes/signins-roles-for-ca-data.md)]
35-
3632
## HTTP request
3733

3834
<!-- { "blockType": "ignored" } -->

‎api-reference/v1.0/includes/rbac-for-apis/rbac-signin-apis-read.md

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,17 @@ ms.topic: include
99
> - Reports Reader
1010
> - Security Administrator
1111
> - Security Operator
12-
> - Security Reader
12+
> - Security Reader
13+
>
14+
> The applied Conditional Access (CA) policies listed in **appliedConditionalAccessPolicies** property are only available to users and apps with roles that allow them to read [conditional access data](/graph/api/resources/appliedconditionalaccesspolicy). If a user or app has permissions to read sign-in logs but not permission to read conditional access data, the **appliedConditionalAccessPolicies** property in the response will be omitted. The signed-in user must be assigned supported Microsoft Entra roles and the app granted supported Microsoft Graph permissions.
15+
> - The following least-privileged roles grant users permissions to view conditional access data:
16+
> - Global Reader
17+
> - Security Administrator
18+
> - Security Reader
19+
> - Conditional Access Administrator
20+
> - Applications must have at least one of the following permissions to see [appliedConditionalAccessPolicy](/graph/api/resources/appliedconditionalaccesspolicy) objects in the sign-in logs:
21+
> - Policy.Read.All
22+
> - Policy.Read.ConditionalAccess
23+
> - Policy.ReadWrite.ConditionalAccess
24+
>
25+
> Signed-in users with any permissions can read their own sign-in logs. This feature helps users spot unexpected activity in their accounts. However, the users can't read CA data from their own logs unless they have one of the supporting permissions identified above.

0 commit comments

Comments
 (0)