Skip to content

Commit 456a406

Browse files
PMEds28PMEds28
authored
Merge pull request #215968 from MicrosoftDocs/main
Publish to Live, Wednesday 4AM PST, 10/26
2 parents c6a2274 + 0ccc857 commit 456a406

File tree

161 files changed

+2113
-1000
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

161 files changed

+2113
-1000
lines changed

‎.openpublishing.redirection.json

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11118,6 +11118,11 @@
1111811118
"redirect_url": "/azure/databox-online/azure-stack-edge-mini-r-overview",
1111911119
"redirect_document_id": false
1112011120
},
11121+
{
11122+
"source_path_from_root": "/articles/databox-online/azure-stack-edge-gpu-deploy-arc-data-controller.md",
11123+
"redirect_url": "/azure/azure-arc/data/create-data-controller-direct-azure-portal",
11124+
"redirect_document_id": false
11125+
},
1112111126
{
1112211127
"source_path_from_root": "/articles/databox-online/data-box-edge-manage-access-power-connectivity-mode.md",
1112311128
"redirect_url": "/azure/databox-online/azure-stack-edge-manage-access-power-connectivity-mode",
@@ -29259,7 +29264,5 @@
2925929264
"redirect_url": "/azure/application-gateway/configuration-frontend-ip",
2926029265
"redirect_document_id": false
2926129266
}
29262-
2926329267
]
2926429268
}
29265-

‎articles/active-directory/governance/create-access-review.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ If you are reviewing access to an application, then before creating the review,
139139

140140
1. In the **Enable review decision helpers** section choose whether you want your reviewer to receive recommendations during the review process:
141141
1. If you select **No sign-in within 30 days**, users who have signed in during the previous 30-day period are recommended for approval. Users who haven't signed in during the past 30 days are recommended for denial. This 30-day interval is irrespective of whether the sign-ins were interactive or not. The last sign-in date for the specified user will also display along with the recommendation.
142-
1. If you select User-to-Group Affiliation, reviewers will get the recommendation to Approve or Deny access for the users based on user’s average distance in the organization’s reporting-structure. Users who are very distant from all the other users within the group are considered to have "low affiliation" and will get a deny recommendation in the group access reviews.
142+
1. If you select **(Preview) User-to-Group Affiliation**, reviewers will get the recommendation to Approve or Deny access for the users based on user’s average distance in the organization’s reporting-structure. Users who are very distant from all the other users within the group are considered to have "low affiliation" and will get a deny recommendation in the group access reviews.
143143

144144
> [!NOTE]
145145
> If you create an access review based on applications, your recommendations are based on the 30-day interval period depending on when the user last signed in to the application rather than the tenant.

‎articles/active-directory/governance/media/review-recommendations-group-access-reviews/org-chart-example.png

189 KB
Loading

‎articles/active-directory/governance/review-recommendations-access-reviews.md

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ ms.workload: identity
1010
ms.tgt_pltfrm: na
1111
ms.topic: how-to
1212
ms.subservice: compliance
13-
ms.date: 8/5/2022
13+
ms.date: 10/25/2022
1414
ms.author: amsliu
1515
ms.reviewer: mwahl
1616
ms.collection: M365-identity-device-management
@@ -29,7 +29,26 @@ For more information, see [License requirements](access-reviews-overview.md#lice
2929
## Inactive user recommendations
3030
A user is considered 'inactive' if they have not signed into the tenant within the last 30 days. This behavior is adjusted for reviews of application assignments, which checks each user's last activity in the app as opposed to the entire tenant. When inactive user recommendations are enabled for an access review, the last sign-in date for each user will be evaluated once the review starts, and any user that has not signed-in within 30 days will be given a recommended action of Deny. Additionally, when these decision helpers are enabled, reviewers will be able to see the last sign-in date for all users being reviewed. This sign-in date (as well as the resulting recommendation) is determined when the review begins and will not get updated while the review is in-progress.
3131

32+
## User-to-Group Affiliation (preview)
33+
Making the review experience easier and more accurate empowers IT admins and reviewers to make more informed decisions. This Machine Learning based recommendation opens the journey to automate access reviews, thereby enabling intelligent automation and reducing access rights attestation fatigue.
34+
35+
User-to-Group Affiliation in an organization’s chart is defined as two or more users who share similar characteristics in an organization's reporting structure.
36+
37+
This recommendation detects user affiliation with other users within the group, based on organization's reporting-structure similarity. The recommendation relies on a scoring mechanism which is calculated by computing the user’s average distance with the remaining users in the group. Users who are very distant from all the other group members based on their organization's chart, are considered to have "low affiliation" within the group.
38+
39+
If this decision helper is enabled by the creator of the access review, reviewers can receive User-to-Group Affiliation recommendations for group access reviews.
40+
41+
> [!NOTE]
42+
> This feature is only available for users in your directory. A user should have a manager attribute and should be a part of an organizational hierarchy for the User-to-group Affiliation to work.
43+
44+
The following image has an example of an organization's reporting structure in a cosmetics company:
45+
46+
![Screenshot that shows a fictitious hierarchial organization chart for a cosmetics company.](./media/review-recommendations-group-access-reviews/org-chart-example.png)
47+
48+
Based on the reporting structure in the example image, users who are statistically significant amount of distance away from other users within the group, would get a "Deny" recommendation by the system if the User-to-Group Affiliation recommendation was selected by the reviewer for group access reviews.
49+
50+
For example, Phil who works within the Personal care division is in a group with Debby, Irwin, and Emily who all work within the Cosmetics division. The group is called *Fresh Skin*. If an Access Review for the group Fresh Skin is performed, based on the reporting structure and distance away from the other group members, Phil would be considered to have low affiliation. The system will create a **Deny** recommendation in the group access review.
51+
3252
## Next Steps
3353
- [Create an access review](create-access-review.md)
34-
- [Review access to groups or applications](perform-access-review.md)
35-
54+
- [Review access to groups or applications](perform-access-review.md)

‎articles/active-directory/roles/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,8 @@
118118
href: custom-consent-permissions.md
119119
- name: Device management permissions
120120
href: custom-device-permissions.md
121+
- name: User management permissions
122+
href: custom-user-permissions.md
121123
- name: Group management permissions
122124
href: custom-group-permissions.md
123125
- name: Azure AD service limits

‎articles/active-directory/roles/custom-user-permissions.md

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
---
2+
title: User management permissions for Azure AD custom roles (preview) - Azure Active Directory
3+
description: User management permissions for Azure AD custom roles in the Azure portal, PowerShell, or Microsoft Graph API.
4+
services: active-directory
5+
author: rolyon
6+
manager: amycolannino
7+
ms.service: active-directory
8+
ms.workload: identity
9+
ms.subservice: roles
10+
ms.topic: reference
11+
ms.date: 10/26/2022
12+
ms.author: rolyon
13+
ms.reviewer:
14+
ms.custom: it-pro
15+
---
16+
17+
# User management permissions for Azure AD custom roles (preview)
18+
19+
> [!IMPORTANT]
20+
> User management permissions for Azure AD custom roles is currently in PREVIEW.
21+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
22+
23+
User management permissions can be used in custom role definitions in Azure Active Directory (Azure AD) to grant fine-grained access such as the following:
24+
25+
- Read or update basic properties of users
26+
- Read or update identity of users
27+
- Read or update job information of users
28+
- Update contact information of users
29+
- Update parental controls of users
30+
- Update settings of users
31+
- Read direct reports of users
32+
- Update extension properties of users
33+
- Read device information of users
34+
- Read or manage licenses of users
35+
- Update password policies of users
36+
- Read assignments and memberships of users
37+
38+
This article lists the permissions you can use in your custom roles for different user management scenarios. For information about how to create custom roles, see [Create and assign a custom role](custom-create.md).
39+
40+
## License requirements
41+
42+
[!INCLUDE [License requirement for using custom roles in Azure AD](../../../includes/active-directory-p1-license.md)]
43+
44+
## Read or update basic properties of users
45+
46+
The following permissions are available to read or update basic properties of users.
47+
48+
> [!div class="mx-tableFixed"]
49+
> | Permission | Description |
50+
> | ---------- | ----------- |
51+
> | microsoft.directory/users/standard/read | Read basic properties on users. |
52+
> | microsoft.directory/users/basic/update | Update basic properties on users. |
53+
54+
## Read or update identity of users
55+
56+
The following permissions are available to read or update identity of users.
57+
58+
> [!div class="mx-tableFixed"]
59+
> | Permission | Description |
60+
> | ---------- | ----------- |
61+
> | microsoft.directory/users/identities/read | Read identities of users. |
62+
> | microsoft.directory/users/identities/update | Update the identity properties of users, such as name and user principal name. |
63+
64+
## Read or update job information of users
65+
66+
The following permissions are available to read or update job information of users.
67+
68+
> [!div class="mx-tableFixed"]
69+
> | Permission | Description |
70+
> | ---------- | ----------- |
71+
> | microsoft.directory/users/manager/read | Read manager of users. |
72+
> | microsoft.directory/users/manager/update | Update manager for users. |
73+
> | microsoft.directory/users/jobInfo/update | Update the job info properties of users, such as job title, department, and company name. |
74+
75+
## Update contact information of users
76+
77+
The following permissions are available to update contact information of users.
78+
79+
> [!div class="mx-tableFixed"]
80+
> | Permission | Description |
81+
> | ---------- | ----------- |
82+
> | microsoft.directory/users/contactInfo/update | Update the contact info properties of users, such as address, phone, and email. |
83+
84+
## Update parental controls of users
85+
86+
The following permissions are available to update parental controls of users.
87+
88+
> [!div class="mx-tableFixed"]
89+
> | Permission | Description |
90+
> | ---------- | ----------- |
91+
> | microsoft.directory/users/parentalControls/update | Update parental controls of users. |
92+
93+
## Update settings of users
94+
95+
The following permissions are available to update settings of users.
96+
97+
> [!div class="mx-tableFixed"]
98+
> | Permission | Description |
99+
> | ---------- | ----------- |
100+
> | microsoft.directory/users/usageLocation/update | Update usage location of users. |
101+
102+
## Read direct reports of users
103+
104+
The following permissions are available to read direct reports of users.
105+
106+
> [!div class="mx-tableFixed"]
107+
> | Permission | Description |
108+
> | ---------- | ----------- |
109+
> | microsoft.directory/users/directReports/read | Read the direct reports for users. |
110+
111+
## Update extension properties of users
112+
113+
The following permissions are available to update extension properties of users.
114+
115+
> [!div class="mx-tableFixed"]
116+
> | Permission | Description |
117+
> | ---------- | ----------- |
118+
> | microsoft.directory/users/extensionProperties/update | Update extension properties of users. |
119+
120+
## Read device information of users
121+
122+
The following permissions are available to read device information of users.
123+
124+
> [!div class="mx-tableFixed"]
125+
> | Permission | Description |
126+
> | ---------- | ----------- |
127+
> | microsoft.directory/users/ownedDevices/read | Read owned devices of users |
128+
> | microsoft.directory/users/registeredDevices/read | Read registered devices of users |
129+
> | microsoft.directory/users/deviceForResourceAccount/read | Read deviceForResourceAccount of users. |
130+
131+
## Read or manage licenses of users
132+
133+
The following permissions are available to read or manage licenses of users.
134+
135+
> [!div class="mx-tableFixed"]
136+
> | Permission | Description |
137+
> | ---------- | ----------- |
138+
> | microsoft.directory/users/licenseDetails/read | Read license details of users. |
139+
> | microsoft.directory/users/assignLicense | Manage user licenses. |
140+
> | microsoft.directory/users/reprocessLicenseAssignment | Reprocess license assignments for users. |
141+
142+
## Update password policies of users
143+
144+
The following permissions are available to update password policies of users.
145+
146+
> [!div class="mx-tableFixed"]
147+
> | Permission | Description |
148+
> | ---------- | ----------- |
149+
> | microsoft.directory/users/passwordPolicies/update | Update password policies properties of users. |
150+
151+
## Read assignments and memberships of users
152+
153+
The following permissions are available to read assignments and memberships of users.
154+
155+
> [!div class="mx-tableFixed"]
156+
> | Permission | Description |
157+
> | ---------- | ----------- |
158+
> | microsoft.directory/users/appRoleAssignments/read | Read application role assignments for users |
159+
> | microsoft.directory/users/scopedRoleMemberOf/read | Read user's membership of an Azure AD role, that is scoped to an administrative unit |
160+
> | microsoft.directory/users/memberOf/read | Read the group memberships of users |
161+
162+
## Full list of permissions
163+
164+
> [!div class="mx-tableFixed"]
165+
> | Permission | Description |
166+
> | ---------- | ----------- |
167+
> | microsoft.directory/users/appRoleAssignments/read | Read application role assignments for users. |
168+
> | microsoft.directory/users/assignLicense | Manage user licenses. |
169+
> | microsoft.directory/users/basic/update | Update basic properties on users. |
170+
> | microsoft.directory/users/contactInfo/update | Update the contact info properties of users, such as address, phone, and email. |
171+
> | microsoft.directory/users/deviceForResourceAccount/read | Read deviceForResourceAccount of users. |
172+
> | microsoft.directory/users/directReports/read | Read the direct reports for users. |
173+
> | microsoft.directory/users/extensionProperties/update | Update extension properties of users. |
174+
> | microsoft.directory/users/identities/read | Read identities of users. |
175+
> | microsoft.directory/users/identities/update | Update the identity properties of users, such as name and user principal name. |
176+
> | microsoft.directory/users/jobInfo/update | Update the job info properties of users, such as job title, department, and company name. |
177+
> | microsoft.directory/users/licenseDetails/read | Read license details of users. |
178+
> | microsoft.directory/users/manager/read | Read manager of users. |
179+
> | microsoft.directory/users/manager/update | Update manager for users. |
180+
> | microsoft.directory/users/memberOf/read | Read the group memberships of users. |
181+
> | microsoft.directory/users/ownedDevices/read | Read owned devices of users. |
182+
> | microsoft.directory/users/parentalControls/update | Update parental controls of users. |
183+
> | microsoft.directory/users/passwordPolicies/update | Update password policies properties of users. |
184+
> | microsoft.directory/users/registeredDevices/read | Read registered devices of users. |
185+
> | microsoft.directory/users/reprocessLicenseAssignment | Reprocess license assignments for users. |
186+
> | microsoft.directory/users/scopedRoleMemberOf/read | Read user's membership of an Azure AD role, that is scoped to an administrative unit. |
187+
> | microsoft.directory/users/standard/read | Read basic properties on users. |
188+
> | microsoft.directory/users/usageLocation/update | Update usage location of users. |
189+
190+
## Next steps
191+
192+
- [Create and assign a custom role in Azure Active Directory](custom-create.md)
193+
- [List Azure AD role assignments](view-assignments.md)

‎articles/active-directory/saas-apps/media/uber-provisioning-tutorial/authorize.png

24.1 KB
Loading

‎articles/active-directory/saas-apps/media/uber-provisioning-tutorial/organization-id.png

18.9 KB
Loading

‎articles/active-directory/saas-apps/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3154,6 +3154,8 @@
31543154
href: tribeloo-provisioning-tutorial.md
31553155
- name: Twingate
31563156
href: twingate-provisioning-tutorial.md
3157+
- name: Uber
3158+
href: uber-provisioning-tutorial.md
31573159
- name: UNIFI
31583160
href: unifi-provisioning-tutorial.md
31593161
- name: Velpic

0 commit comments

Comments
 (0)