Skip to content

Commit c612d39

Browse files
LauragraLauragra
authored
Merge pull request #25418 from microsoftgraph/rbac-sps-approleassignments
Entra admin roles - groups/users/SPs - app role assignments/to
2 parents 718193a + e8b560b commit c612d39

22 files changed

+104
-126
lines changed

‎api-reference/beta/api/approleassignment-get.md

Lines changed: 12 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -18,45 +18,6 @@ Read the properties and relationships of an [appRoleAssignment](../resources/app
1818

1919
## Permissions
2020

21-
<!--
22-
### For client service principals
23-
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
24-
<!--
25-
|Permission type | Permissions (from least to most privileged) |
26-
|:--------------------|:---------------------------------------------------------|
27-
|Delegated (work or school account) | Application.Read.All, Directory.Read.All, Application.ReadWrite.All, Directory.ReadWrite.All |
28-
|Delegated (personal Microsoft account) | Not supported. |
29-
|Application | Application.Read.All, Directory.Read.All, Application.ReadWrite.OwnedBy, Application.ReadWrite.All, Directory.ReadWrite.All |
30-
31-
### For resource service principals
32-
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
33-
<!--
34-
|Permission type | Permissions (from least to most privileged) |
35-
|:--------------------|:---------------------------------------------------------|
36-
|Delegated (work or school account) | Application.Read.All, Directory.Read.All, Application.ReadWrite.All, Directory.ReadWrite.All |
37-
|Delegated (personal Microsoft account) | Not supported. |
38-
|Application | Application.Read.All, Directory.Read.All, Application.ReadWrite.OwnedBy, Application.ReadWrite.All, Directory.ReadWrite.All |
39-
40-
### For groups
41-
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
42-
<!--
43-
|Permission type | Permissions (from least to most privileged) |
44-
|:--------------------|:---------------------------------------------------------|
45-
|Delegated (work or school account) | Group.Read.All, Directory.Read.All, AppRoleAssignment.ReadWrite.All, Directory.ReadWrite.All |
46-
|Delegated (personal Microsoft account) | Not supported. |
47-
|Application | Group.Read.All, Directory.Read.All, AppRoleAssignment.ReadWrite.All, Directory.ReadWrite.All |
48-
49-
### For users
50-
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
51-
<!--
52-
|Permission type | Permissions (from least to most privileged) |
53-
|:--------------------|:---------------------------------------------------------|
54-
|Delegated (work or school account) | User.Read, User.ReadBasic.All, Directory.Read.All, AppRoleAssignment.ReadWrite.All |
55-
|Delegated (personal Microsoft account) | Not supported. |
56-
|Application | Directory.Read.All, AppRoleAssignment.ReadWrite.All |
57-
58-
-->
59-
6021
The following table shows the least privileged permission or permissions required to call this API on each supported resource type. Follow [best practices](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions) to request least privileged permissions. For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
6122

6223
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
@@ -69,6 +30,18 @@ The following table shows the least privileged permission or permissions require
6930

7031
[!INCLUDE [rbac-approleassignments-apis-read](../includes/rbac-for-apis/rbac-approleassignments-apis-read.md)]
7132

33+
### Other supported permissions
34+
35+
The following higher privileged permissions are supported by each resource:
36+
- Groups:
37+
- Delegated and application permissions: Directory.Read.All, AppRoleAssignment.ReadWrite.All, Directory.ReadWrite.All
38+
- Users:
39+
- Delegated permissions: User.ReadBasic.All, Directory.Read.All, AppRoleAssignment.ReadWrite.All
40+
- Application permissions: Directory.Read.All, AppRoleAssignment.ReadWrite.All
41+
- Service principals:
42+
- Delegated permissions: Directory.Read.All, Application.ReadWrite.All, Directory.ReadWrite.All
43+
- Application permissions: Application.ReadWrite.OwnedBy, Application.ReadWrite.All, Directory.ReadWrite.All
44+
7245
## HTTP request
7346

7447
To get details of an appRole granted to a service principal:

‎api-reference/beta/api/group-delete-approleassignments.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "group_delete_approleassignments" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/group-delete-approleassignments-permissions.md)]
2626

27+
[!INCLUDE [rbac-approleassignments-apis-write](../includes/rbac-for-apis/rbac-approleassignments-apis-write.md)]
28+
2729
## HTTP request
2830

2931
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/group-list-approleassignments.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "group_list_approleassignments" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/group-list-approleassignments-permissions.md)]
2626

27+
[!INCLUDE [rbac-approleassignments-apis-read](../includes/rbac-for-apis/rbac-approleassignments-apis-read.md)]
28+
2729
## HTTP request
2830

2931
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/group-post-approleassignments.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
3030
<!-- { "blockType": "permissions", "name": "group_post_approleassignments" } -->
3131
[!INCLUDE [permissions-table](../includes/permissions/group-post-approleassignments-permissions.md)]
3232

33+
[!INCLUDE [rbac-approleassignments-apis-write](../includes/rbac-for-apis/rbac-approleassignments-apis-write.md)]
34+
3335
## HTTP request
3436

3537
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/serviceprincipal-list-approleassignedto.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
3030
<!-- { "blockType": "permissions", "name": "serviceprincipal_list_approleassignedto" } -->
3131
[!INCLUDE [permissions-table](../includes/permissions/serviceprincipal-list-approleassignedto-permissions.md)]
3232

33-
[!INCLUDE [rbac-approleassignments-apis-write](../includes/rbac-for-apis/rbac-approleassignments-apis-write.md)]
33+
[!INCLUDE [rbac-approleassignments-apis-read](../includes/rbac-for-apis/rbac-approleassignments-apis-read.md)]
3434

3535

3636
## HTTP request

‎api-reference/beta/api/serviceprincipal-list-approleassignments.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ Choose the permission or permissions marked as least privileged for this API. Us
3131

3232

3333

34-
[!INCLUDE [rbac-approleassignments-apis-write](../includes/rbac-for-apis/rbac-approleassignments-apis-write.md)]
34+
[!INCLUDE [rbac-approleassignments-apis-read](../includes/rbac-for-apis/rbac-approleassignments-apis-read.md)]
3535

3636

3737
## HTTP request

‎api-reference/beta/api/user-delete-approleassignments.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424
<!-- { "blockType": "permissions", "name": "user_delete_approleassignments" } -->
2525
[!INCLUDE [permissions-table](../includes/permissions/user-delete-approleassignments-permissions.md)]
2626

27+
[!INCLUDE [rbac-approleassignments-apis-write](../includes/rbac-for-apis/rbac-approleassignments-apis-write.md)]
28+
2729
## HTTP request
2830

2931
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/user-list-approleassignments.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2727
<!-- { "blockType": "permissions", "name": "user_list_approleassignments" } -->
2828
[!INCLUDE [permissions-table](../includes/permissions/user-list-approleassignments-permissions.md)]
2929

30+
[!INCLUDE [rbac-approleassignments-apis-read](../includes/rbac-for-apis/rbac-approleassignments-apis-read.md)]
31+
3032
## HTTP request
3133

3234
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/api/user-post-approleassignments.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
2828
<!-- { "blockType": "permissions", "name": "user_post_approleassignments" } -->
2929
[!INCLUDE [permissions-table](../includes/permissions/user-post-approleassignments-permissions.md)]
3030

31+
[!INCLUDE [rbac-approleassignments-apis-write](../includes/rbac-for-apis/rbac-approleassignments-apis-write.md)]
32+
3133
## HTTP request
3234

3335
<!-- { "blockType": "ignored" } -->

‎api-reference/beta/includes/rbac-for-apis/rbac-approleassignments-apis-read.md

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,17 @@ author: psignoret
33
ms.topic: include
44
---
55

6-
In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
7-
8-
- Directory Readers
9-
- Guest Inviter - Read app role assignments for users only
10-
- Directory Synchronization Accounts - for Microsoft Entra Connect and Microsoft Entra Cloud Sync services
11-
- Directory Writer
12-
- Hybrid Identity Administrator
13-
- Identity Governance Administrator
14-
- Privileged Role Administrator
15-
- User Administrator
16-
- Application Administrator
17-
- Cloud Application Administrator
6+
> [!IMPORTANT]
7+
>
8+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation:
9+
>
10+
> - Guest Inviter - Read app role assignments for users only
11+
> - Directory Readers
12+
> - Directory Synchronization Accounts - for Microsoft Entra Connect and Microsoft Entra Cloud Sync services
13+
> - Directory Writer
14+
> - Hybrid Identity Administrator
15+
> - Identity Governance Administrator
16+
> - Privileged Role Administrator
17+
> - User Administrator
18+
> - Application Administrator
19+
> - Cloud Application Administrator

0 commit comments

Comments
 (0)