Skip to content

Commit ca73453

Browse files
FaithOmbongiFaithOmbongi
committed
Entra admin roles - group/directory settings
1 parent 73b8146 commit ca73453

File tree

6 files changed

+40
-17
lines changed

6 files changed

+40
-17
lines changed

‎api-reference/beta/api/directorysettingtemplate-get.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,12 @@ Choose the permission or permissions marked as least privileged for this API. Us
2626
<!-- { "blockType": "permissions", "name": "directorysettingtemplate_get" } -->
2727
[!INCLUDE [permissions-table](../includes/permissions/directorysettingtemplate-get-permissions.md)]
2828

29+
> [!IMPORTANT]
30+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
31+
> - Microsoft Entra Joined Device Local Administrator - basic properties only
32+
> - Directory Readers
33+
> - Global Reader
34+
2935
## HTTP request
3036
<!-- { "blockType": "ignored" } -->
3137
```http

‎api-reference/beta/api/directorysettingtemplate-list.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,12 @@ Choose the permission or permissions marked as least privileged for this API. Us
2626
<!-- { "blockType": "permissions", "name": "directorysettingtemplate_list" } -->
2727
[!INCLUDE [permissions-table](../includes/permissions/directorysettingtemplate-list-permissions.md)]
2828

29+
> [!IMPORTANT]
30+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
31+
> - Microsoft Entra Joined Device Local Administrator - basic properties only
32+
> - Directory Readers
33+
> - Global Reader
34+
2935
## HTTP request
3036
<!-- { "blockType": "ignored" } -->
3137
```http

‎api-reference/beta/includes/rbac-for-apis/rbac-group-directorysettings-all.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@ author: yuhko-msft
33
ms.topic: include
44
---
55

6-
In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
7-
8-
| Microsoft Entra role | Allowed privileges |
9-
|-----------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------|
10-
| Microsoft Entra Joined Device Local Administrator <br/> Directory Readers <br/> Global Reader | Read basic properties on setting templates and settings |
11-
| Groups Administrator <br/> Directory Writers | Manage all group settings |
12-
| Authentication Policy Administrator | Update `Password Rule Settings` |
13-
| User Administrator | Read basic properties on setting templates and settings <br/> Update settings |
6+
> [!IMPORTANT]
7+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
8+
>
9+
> - Read basic properties on setting templates and settings - Microsoft Entra Joined Device Local Administrator, Directory Readers, Global Reader
10+
> - Manage all group/directory settings - Directory Writers
11+
> - Manage global and local settings for groups; manage `Group.Unified.Guest` and `Group.Unified` settings - Groups Administrator
12+
> - Update `Password Rule Settings` - Authentication Policy Administrator
13+
> - Update settings, Read basic properties on setting templates and settings - User Administrator
1414

‎api-reference/v1.0/api/groupsettingtemplate-get.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,12 @@ Choose the permission or permissions marked as least privileged for this API. Us
2323
<!-- { "blockType": "permissions", "name": "groupsettingtemplate_get" } -->
2424
[!INCLUDE [permissions-table](../includes/permissions/groupsettingtemplate-get-permissions.md)]
2525

26+
> [!IMPORTANT]
27+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
28+
> - Microsoft Entra Joined Device Local Administrator - basic properties only
29+
> - Directory Readers
30+
> - Global Reader
31+
2632
## HTTP request
2733

2834
<!-- { "blockType": "ignored" } -->

‎api-reference/v1.0/api/groupsettingtemplate-list.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,12 @@ Choose the permission or permissions marked as least privileged for this API. Us
2323
<!-- { "blockType": "permissions", "name": "groupsettingtemplate_list" } -->
2424
[!INCLUDE [permissions-table](../includes/permissions/groupsettingtemplate-list-permissions.md)]
2525

26+
> [!IMPORTANT]
27+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
28+
> - Microsoft Entra Joined Device Local Administrator - basic properties only
29+
> - Directory Readers
30+
> - Global Reader
31+
2632
## HTTP request
2733

2834
<!-- { "blockType": "ignored" } -->

‎api-reference/v1.0/includes/rbac-for-apis/rbac-group-directorysettings-all.md

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,11 @@ author: yuhko-msft
33
ms.topic: include
44
---
55

6-
In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
7-
8-
| Microsoft Entra role | Allowed privileges |
9-
|-----------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------|
10-
| Microsoft Entra Joined Device Local Administrator <br/> Directory Readers <br/> Global Reader | Read basic properties on setting templates and settings |
11-
| Groups Administrator <br/> Directory Writers | Manage all group settings |
12-
| Authentication Policy Administrator | Update `Password Rule Settings` |
13-
| User Administrator | Read basic properties on setting templates and settings <br/> Update settings |
14-
6+
> [!IMPORTANT]
7+
> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
8+
>
9+
> - Read basic properties on setting templates and settings - Microsoft Entra Joined Device Local Administrator, Directory Readers, Global Reader
10+
> - Manage all group/directory settings - Directory Writers
11+
> - Manage global and local settings for groups; manage `Group.Unified.Guest` and `Group.Unified` settings - Groups Administrator
12+
> - Update `Password Rule Settings` - Authentication Policy Administrator
13+
> - Update settings, Read basic properties on setting templates and settings - User Administrator

0 commit comments

Comments
 (0)