Skip to content

Commit fa788f1

Browse files
marabooymarabooy
authored
Weekly Permissions sync 2026-09-25 (#1641)
1 parent 274c9b9 commit fa788f1

2 files changed

Lines changed: 322 additions & 23 deletions

File tree

‎permissions/new/permissions.json‎

Lines changed: 303 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1392,6 +1392,18 @@
13921392
"paths": {
13931393
"/servicePrincipals/microsoft.graph.agentIdentity": ""
13941394
}
1395+
},
1396+
{
1397+
"schemeKeys": [
1398+
"DelegatedWork",
1399+
"Application"
1400+
],
1401+
"methods": [
1402+
"POST"
1403+
],
1404+
"paths": {
1405+
"/servicePrincipals/microsoft.graph.agentIdentity/{id}/microsoft.graph.identityGovernance.extend": "least=Application,DelegatedWork"
1406+
}
13951407
}
13961408
],
13971409
"ownerInfo": {
@@ -1953,6 +1965,18 @@
19531965
"paths": {
19541966
"/servicePrincipals/microsoft.graph.agentIdentityBlueprintPrincipal": ""
19551967
}
1968+
},
1969+
{
1970+
"schemeKeys": [
1971+
"DelegatedWork",
1972+
"Application"
1973+
],
1974+
"methods": [
1975+
"POST"
1976+
],
1977+
"paths": {
1978+
"/servicePrincipals/microsoft.graph.agentIdentityBlueprintPrincipal/{id}/microsoft.graph.identityGovernance.extend": "least=Application,DelegatedWork"
1979+
}
19561980
}
19571981
],
19581982
"ownerInfo": {
@@ -12673,6 +12697,7 @@
1267312697
"/admin/configurationManagement/configurationSnapshots/{id}": "least=DelegatedWork,Application",
1267412698
"/admin/configurationManagement/configurationTemplates": "least=DelegatedWork,Application",
1267512699
"/admin/configurationManagement/configurationTemplates/{id}": "least=DelegatedWork,Application",
12700+
"/admin/configurationManagement/configurationTemplates/{id}/versions/{version}/referencedExternalMonitors/{tenantId}": "least=DelegatedWork,Application",
1267612701
"/admin/configurationManagement/externalTenants/configurationDriftFetchJobs": "least=DelegatedWork,Application",
1267712702
"/admin/configurationManagement/externalTenants/configurationDriftFetchJobs/{id}": "least=DelegatedWork,Application",
1267812703
"/admin/configurationManagement/externalTenants/configurationDriftFetchJobs/{id}/results": "least=DelegatedWork,Application",
@@ -12761,6 +12786,7 @@
1276112786
"/admin/configurationManagement/configurationSnapshots/{id}": "",
1276212787
"/admin/configurationManagement/configurationTemplates": "",
1276312788
"/admin/configurationManagement/configurationTemplates/{id}": "",
12789+
"/admin/configurationManagement/configurationTemplates/{id}/versions/{version}/referencedExternalMonitors/{tenantId}": "",
1276412790
"/admin/configurationManagement/externalTenants/configurationDriftFetchJobs": "",
1276512791
"/admin/configurationManagement/externalTenants/configurationDriftFetchJobs/{id}": "",
1276612792
"/admin/configurationManagement/externalTenants/configurationDriftFetchJobs/{id}/results": "",
@@ -12804,6 +12830,7 @@
1280412830
"/admin/configurationManagement/configurationMonitors/{id}/validate": "least=DelegatedWork,Application",
1280512831
"/admin/configurationManagement/configurationSnapshots/createSnapshot": "least=DelegatedWork,Application",
1280612832
"/admin/configurationManagement/configurationTemplates": "least=DelegatedWork,Application",
12833+
"/admin/configurationManagement/configurationTemplates/{id}/versions/{version}/referencedExternalMonitors/{tenantId}/monitors/$ref": "least=DelegatedWork,Application",
1280712834
"/admin/configurationManagement/externalTenants/configurationDriftFetchJobs": "least=DelegatedWork,Application",
1280812835
"/admin/configurationManagement/externalTenants/configurationMonitorFetchJobs": "least=DelegatedWork,Application",
1280912836
"/admin/configurationManagement/externalTenants/configurationMonitoringResultFetchJobs": "least=DelegatedWork,Application",
@@ -12857,6 +12884,7 @@
1285712884
"paths": {
1285812885
"/admin/configurationManagement/configurationMonitors/{id}": "least=DelegatedWork,Application",
1285912886
"/admin/configurationManagement/configurationTemplates/{id}": "least=DelegatedWork,Application",
12887+
"/admin/configurationManagement/configurationTemplates/{id}/versions/{version}/referencedExternalMonitors/{tenantId}/monitors/{monitorId}/$ref": "least=DelegatedWork,Application",
1286012888
"/admin/configurationManagement/externalTenants/configurationMonitors/{id}": "least=DelegatedWork,Application"
1286112889
}
1286212890
},
@@ -31157,6 +31185,7 @@
3115731185
"/identityprotection/riskdetections/{id}": "least=DelegatedWork,Application",
3115831186
"/identityprotection/serviceprincipalriskdetections": "least=DelegatedWork,Application",
3115931187
"/identityprotection/serviceprincipalriskdetections/{id}": "least=DelegatedWork,Application",
31188+
"/identityProtection/settings/agentNotifications": "least=DelegatedWork,Application",
3116031189
"/riskdetections": "least=DelegatedWork,Application",
3116131190
"/riskdetections/{id}": "least=DelegatedWork,Application"
3116231191
}
@@ -31169,6 +31198,14 @@
3116931198
"IdentityRiskEvent.ReadWrite.All": {
3117031199
"authorizationType": "oAuth2",
3117131200
"schemes": {
31201+
"DelegatedWork": {
31202+
"adminDisplayName": "Read and write identity risk event information",
31203+
"adminDescription": "Allows the app to read and update identity risk event information for all users in your organization on behalf of the signed-in user. Update operations include confirming risk event detections.",
31204+
"userDisplayName": "Read and write identity risk event information",
31205+
"userDescription": "Allows the app to read and update identity risk event information for all users in your organization on your behalf. Update operations include confirming risk event detections.",
31206+
"requiresAdminConsent": true,
31207+
"privilegeLevel": 3
31208+
},
3117231209
"Application": {
3117331210
"adminDisplayName": "Read and write all risk detection information",
3117431211
"adminDescription": "Allows the app to read and update identity risk detection information for your organization without a signed-in user. Update operations include confirming risk event detections. ",
@@ -31177,6 +31214,30 @@
3117731214
}
3117831215
},
3117931216
"pathSets": [
31217+
{
31218+
"schemeKeys": [
31219+
"DelegatedWork",
31220+
"Application"
31221+
],
31222+
"methods": [
31223+
"GET"
31224+
],
31225+
"paths": {
31226+
"/identityProtection/settings/agentNotifications": ""
31227+
}
31228+
},
31229+
{
31230+
"schemeKeys": [
31231+
"DelegatedWork",
31232+
"Application"
31233+
],
31234+
"methods": [
31235+
"PATCH"
31236+
],
31237+
"paths": {
31238+
"/identityProtection/settings/agentNotifications": "least=DelegatedWork,Application"
31239+
}
31240+
},
3118031241
{
3118131242
"schemeKeys": [
3118231243
"Application"
@@ -33248,6 +33309,248 @@
3324833309
"pathSets": [],
3324933310
"ownerInfo": {}
3325033311
},
33312+
"LifecyclePolicies-AgentId.Read.All": {
33313+
"authorizationType": "oAuth2",
33314+
"schemes": {
33315+
"DelegatedWork": {
33316+
"adminDisplayName": "Read identity lifecycle policies for agent identities",
33317+
"adminDescription": "Allows the app to read identity lifecycle policies for agent identities that the signed-in user has access to in the organization.",
33318+
"userDisplayName": "Read identity lifecycle policies for agent identities",
33319+
"userDescription": "Allows the app to read identity lifecycle policies for agent identities that you have access to.",
33320+
"requiresAdminConsent": true,
33321+
"privilegeLevel": 3
33322+
},
33323+
"Application": {
33324+
"adminDisplayName": "Read identity lifecycle policies for agent identities",
33325+
"adminDescription": "Allows the app to read identity lifecycle policies for agent identities in the organization, without a signed-in user.",
33326+
"requiresAdminConsent": true,
33327+
"privilegeLevel": 3
33328+
}
33329+
},
33330+
"pathSets": [
33331+
{
33332+
"schemeKeys": [
33333+
"DelegatedWork",
33334+
"Application"
33335+
],
33336+
"methods": [
33337+
"GET"
33338+
],
33339+
"paths": {
33340+
"/identitygovernance/lifecycleworkflows/deletedItems/lifecyclePolicies": "least=DelegatedWork,Application",
33341+
"/identitygovernance/lifecycleworkflows/deletedItems/lifecyclePolicies/{id}": "",
33342+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies": "least=DelegatedWork,Application",
33343+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}": "least=DelegatedWork,Application",
33344+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/impact(startDateTime={startDateTime},endDateTime={endDateTime})": "",
33345+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/report": "least=DelegatedWork,Application",
33346+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/report/subjects": "least=DelegatedWork,Application",
33347+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/rules": "least=DelegatedWork,Application",
33348+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/rules/{id}": "least=DelegatedWork,Application",
33349+
"/identitygovernance/lifecycleworkflows/lifecyclePolicyPriorityConfigurations": "least=DelegatedWork,Application",
33350+
"/identitygovernance/lifecycleworkflows/lifecyclePolicyPriorityConfigurations/{subjectType}": "least=DelegatedWork,Application"
33351+
}
33352+
}
33353+
],
33354+
"ownerInfo": {
33355+
"ownerSecurityGroup": "aadlcm"
33356+
}
33357+
},
33358+
"LifecyclePolicies-AgentId.ReadWrite.All": {
33359+
"authorizationType": "oAuth2",
33360+
"schemes": {
33361+
"DelegatedWork": {
33362+
"adminDisplayName": "Read and write identity lifecycle policies for agent identities",
33363+
"adminDescription": "Allows the app to read, create, update and delete identity lifecycle policies for agent identities that the signed-in user has access to in the organization.",
33364+
"userDisplayName": "Read and write identity lifecycle policies for agent identities",
33365+
"userDescription": "Allows the app to read, create, update and delete identity lifecycle policies for agent identities that you have access to.",
33366+
"requiresAdminConsent": true,
33367+
"privilegeLevel": 3
33368+
},
33369+
"Application": {
33370+
"adminDisplayName": "Read and write identity lifecycle policies for agent identities",
33371+
"adminDescription": "Allows the app to read, create, update and delete identity lifecycle policies for agent identities in the organization, without a signed-in user.",
33372+
"requiresAdminConsent": true,
33373+
"privilegeLevel": 3
33374+
}
33375+
},
33376+
"pathSets": [
33377+
{
33378+
"schemeKeys": [
33379+
"DelegatedWork",
33380+
"Application"
33381+
],
33382+
"methods": [
33383+
"GET"
33384+
],
33385+
"paths": {
33386+
"/identitygovernance/lifecycleworkflows/deletedItems/lifecyclePolicies": "",
33387+
"/identitygovernance/lifecycleworkflows/deletedItems/lifecyclePolicies/{id}": "",
33388+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies": "",
33389+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}": "",
33390+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/impact(startDateTime={startDateTime},endDateTime={endDateTime})": "",
33391+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/report": "",
33392+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/report/subjects": "",
33393+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/rules": "",
33394+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/rules/{id}": "",
33395+
"/identitygovernance/lifecycleworkflows/lifecyclePolicyPriorityConfigurations": "",
33396+
"/identitygovernance/lifecycleworkflows/lifecyclePolicyPriorityConfigurations/{subjectType}": ""
33397+
}
33398+
},
33399+
{
33400+
"schemeKeys": [
33401+
"DelegatedWork",
33402+
"Application"
33403+
],
33404+
"methods": [
33405+
"POST"
33406+
],
33407+
"paths": {
33408+
"/identitygovernance/lifecycleworkflows/deletedItems/lifecyclePolicies/{id}/restore": "least=DelegatedWork,Application",
33409+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies": "least=DelegatedWork,Application"
33410+
}
33411+
},
33412+
{
33413+
"schemeKeys": [
33414+
"DelegatedWork",
33415+
"Application"
33416+
],
33417+
"methods": [
33418+
"PATCH"
33419+
],
33420+
"paths": {
33421+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}": "least=DelegatedWork,Application",
33422+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/rules/{id}": "least=DelegatedWork,Application",
33423+
"/identitygovernance/lifecycleworkflows/lifecyclePolicyPriorityConfigurations/{subjectType}": "least=DelegatedWork,Application"
33424+
}
33425+
},
33426+
{
33427+
"schemeKeys": [
33428+
"DelegatedWork",
33429+
"Application"
33430+
],
33431+
"methods": [
33432+
"DELETE"
33433+
],
33434+
"paths": {
33435+
"/identitygovernance/lifecycleworkflows/deletedItems/lifecyclePolicies/{id}": "least=DelegatedWork,Application",
33436+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}": "least=DelegatedWork,Application"
33437+
}
33438+
}
33439+
],
33440+
"ownerInfo": {
33441+
"ownerSecurityGroup": "aadlcm"
33442+
}
33443+
},
33444+
"LifecyclePolicies-Guests.Read.All": {
33445+
"authorizationType": "oAuth2",
33446+
"schemes": {
33447+
"DelegatedWork": {
33448+
"adminDisplayName": "Read identity lifecycle policies for external guests",
33449+
"adminDescription": "Allows the app to read identity lifecycle policies for external guests on behalf of the signed-in user.",
33450+
"userDisplayName": "Read identity lifecycle policies for external guests",
33451+
"userDescription": "Allows the app to read identity lifecycle policies for external guests on your behalf.",
33452+
"requiresAdminConsent": true,
33453+
"privilegeLevel": 3
33454+
},
33455+
"Application": {
33456+
"adminDisplayName": "Read identity lifecycle policies for external guests",
33457+
"adminDescription": "Allows the app to read identity lifecycle policies for external guests in the organization, without a signed-in user.",
33458+
"requiresAdminConsent": true,
33459+
"privilegeLevel": 3
33460+
}
33461+
},
33462+
"pathSets": [
33463+
{
33464+
"schemeKeys": [
33465+
"DelegatedWork",
33466+
"Application"
33467+
],
33468+
"methods": [
33469+
"GET"
33470+
],
33471+
"paths": {
33472+
"/identitygovernance/lifecycleworkflows/deletedItems/lifecyclePolicies/{id}": "least=DelegatedWork,Application",
33473+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies": "",
33474+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}": "",
33475+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/attestationRequirements": "least=DelegatedWork,Application",
33476+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/attestationRequirements/{id}": "least=DelegatedWork,Application",
33477+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/impact(startDateTime={startDateTime},endDateTime={endDateTime})": "least=DelegatedWork,Application",
33478+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/report": "",
33479+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/report/subjects": "",
33480+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/rules": "",
33481+
"/users/{id}/lifecycle": "least=DelegatedWork,Application"
33482+
}
33483+
}
33484+
],
33485+
"ownerInfo": {
33486+
"ownerSecurityGroup": "aadlcm"
33487+
}
33488+
},
33489+
"LifecyclePolicies-Guests.ReadWrite.All": {
33490+
"authorizationType": "oAuth2",
33491+
"schemes": {
33492+
"DelegatedWork": {
33493+
"adminDisplayName": "Read and write identity lifecycle policies for external guests",
33494+
"adminDescription": "Allows the app to create, update, and delete identity lifecycle policies for external guests on behalf of the signed-in user.",
33495+
"userDisplayName": "Read and write identity lifecycle policies for external guests",
33496+
"userDescription": "Allows the app to create, update, and delete identity lifecycle policies for external guests on your behalf.",
33497+
"requiresAdminConsent": true,
33498+
"privilegeLevel": 3
33499+
},
33500+
"Application": {
33501+
"adminDisplayName": "Read and write identity lifecycle policies for external guests",
33502+
"adminDescription": "Allows the app to create, update, and delete identity lifecycle policies for external guests in the organization, without a signed-in user.",
33503+
"requiresAdminConsent": true,
33504+
"privilegeLevel": 3
33505+
}
33506+
},
33507+
"pathSets": [
33508+
{
33509+
"schemeKeys": [
33510+
"DelegatedWork",
33511+
"Application"
33512+
],
33513+
"methods": [
33514+
"GET"
33515+
],
33516+
"paths": {
33517+
"/identitygovernance/lifecycleworkflows/deletedItems/lifecyclePolicies/{id}": "",
33518+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies": "",
33519+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}": "",
33520+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/attestationRequirements": "",
33521+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/attestationRequirements/{id}": "",
33522+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/impact(startDateTime={startDateTime},endDateTime={endDateTime})": "",
33523+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/report": "",
33524+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/report/subjects": "",
33525+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/rules": "",
33526+
"/users/{id}/lifecycle": ""
33527+
}
33528+
},
33529+
{
33530+
"schemeKeys": [
33531+
"DelegatedWork",
33532+
"Application"
33533+
],
33534+
"methods": [
33535+
"DELETE",
33536+
"PATCH",
33537+
"POST"
33538+
],
33539+
"paths": {
33540+
"/identitygovernance/lifecycleworkflows/deletedItems/lifecyclePolicies/{id}": "least=DelegatedWork,Application",
33541+
"/identitygovernance/lifecycleworkflows/deletedItems/lifecyclePolicies/{id}/restore": "least=DelegatedWork,Application",
33542+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies": "least=DelegatedWork,Application",
33543+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}": "least=DelegatedWork,Application",
33544+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/attestationRequirements/{id}": "least=DelegatedWork,Application",
33545+
"/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/rules": "least=DelegatedWork,Application",
33546+
"/users/{id}/microsoft.graph.identityGovernance.attest": "least=DelegatedWork,Application"
33547+
}
33548+
}
33549+
],
33550+
"ownerInfo": {
33551+
"ownerSecurityGroup": "aadlcm"
33552+
}
33553+
},
3325133554
"LifecycleWorkflows-CustomExt.Read.All": {
3325233555
"authorizationType": "oAuth2",
3325333556
"schemes": {

0 commit comments

Comments
 (0)