Skip to content

Commit e19f107

Browse files
jborsecnikjborsecnik
authored
Merge pull request #203971 from rolyon/rolyon-aadroles-custom-roles-users
[Azure AD roles] User management permissions for custom roles
2 parents 4c60d9f + f8d028e commit e19f107

File tree

2 files changed

+195
-0
lines changed

2 files changed

+195
-0
lines changed

‎articles/active-directory/roles/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,8 @@
118118
href: custom-consent-permissions.md
119119
- name: Device management permissions
120120
href: custom-device-permissions.md
121+
- name: User management permissions
122+
href: custom-user-permissions.md
121123
- name: Group management permissions
122124
href: custom-group-permissions.md
123125
- name: Azure AD service limits

‎articles/active-directory/roles/custom-user-permissions.md

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
---
2+
title: User management permissions for Azure AD custom roles (preview) - Azure Active Directory
3+
description: User management permissions for Azure AD custom roles in the Azure portal, PowerShell, or Microsoft Graph API.
4+
services: active-directory
5+
author: rolyon
6+
manager: amycolannino
7+
ms.service: active-directory
8+
ms.workload: identity
9+
ms.subservice: roles
10+
ms.topic: reference
11+
ms.date: 10/26/2022
12+
ms.author: rolyon
13+
ms.reviewer:
14+
ms.custom: it-pro
15+
---
16+
17+
# User management permissions for Azure AD custom roles (preview)
18+
19+
> [!IMPORTANT]
20+
> User management permissions for Azure AD custom roles is currently in PREVIEW.
21+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
22+
23+
User management permissions can be used in custom role definitions in Azure Active Directory (Azure AD) to grant fine-grained access such as the following:
24+
25+
- Read or update basic properties of users
26+
- Read or update identity of users
27+
- Read or update job information of users
28+
- Update contact information of users
29+
- Update parental controls of users
30+
- Update settings of users
31+
- Read direct reports of users
32+
- Update extension properties of users
33+
- Read device information of users
34+
- Read or manage licenses of users
35+
- Update password policies of users
36+
- Read assignments and memberships of users
37+
38+
This article lists the permissions you can use in your custom roles for different user management scenarios. For information about how to create custom roles, see [Create and assign a custom role](custom-create.md).
39+
40+
## License requirements
41+
42+
[!INCLUDE [License requirement for using custom roles in Azure AD](../../../includes/active-directory-p1-license.md)]
43+
44+
## Read or update basic properties of users
45+
46+
The following permissions are available to read or update basic properties of users.
47+
48+
> [!div class="mx-tableFixed"]
49+
> | Permission | Description |
50+
> | ---------- | ----------- |
51+
> | microsoft.directory/users/standard/read | Read basic properties on users. |
52+
> | microsoft.directory/users/basic/update | Update basic properties on users. |
53+
54+
## Read or update identity of users
55+
56+
The following permissions are available to read or update identity of users.
57+
58+
> [!div class="mx-tableFixed"]
59+
> | Permission | Description |
60+
> | ---------- | ----------- |
61+
> | microsoft.directory/users/identities/read | Read identities of users. |
62+
> | microsoft.directory/users/identities/update | Update the identity properties of users, such as name and user principal name. |
63+
64+
## Read or update job information of users
65+
66+
The following permissions are available to read or update job information of users.
67+
68+
> [!div class="mx-tableFixed"]
69+
> | Permission | Description |
70+
> | ---------- | ----------- |
71+
> | microsoft.directory/users/manager/read | Read manager of users. |
72+
> | microsoft.directory/users/manager/update | Update manager for users. |
73+
> | microsoft.directory/users/jobInfo/update | Update the job info properties of users, such as job title, department, and company name. |
74+
75+
## Update contact information of users
76+
77+
The following permissions are available to update contact information of users.
78+
79+
> [!div class="mx-tableFixed"]
80+
> | Permission | Description |
81+
> | ---------- | ----------- |
82+
> | microsoft.directory/users/contactInfo/update | Update the contact info properties of users, such as address, phone, and email. |
83+
84+
## Update parental controls of users
85+
86+
The following permissions are available to update parental controls of users.
87+
88+
> [!div class="mx-tableFixed"]
89+
> | Permission | Description |
90+
> | ---------- | ----------- |
91+
> | microsoft.directory/users/parentalControls/update | Update parental controls of users. |
92+
93+
## Update settings of users
94+
95+
The following permissions are available to update settings of users.
96+
97+
> [!div class="mx-tableFixed"]
98+
> | Permission | Description |
99+
> | ---------- | ----------- |
100+
> | microsoft.directory/users/usageLocation/update | Update usage location of users. |
101+
102+
## Read direct reports of users
103+
104+
The following permissions are available to read direct reports of users.
105+
106+
> [!div class="mx-tableFixed"]
107+
> | Permission | Description |
108+
> | ---------- | ----------- |
109+
> | microsoft.directory/users/directReports/read | Read the direct reports for users. |
110+
111+
## Update extension properties of users
112+
113+
The following permissions are available to update extension properties of users.
114+
115+
> [!div class="mx-tableFixed"]
116+
> | Permission | Description |
117+
> | ---------- | ----------- |
118+
> | microsoft.directory/users/extensionProperties/update | Update extension properties of users. |
119+
120+
## Read device information of users
121+
122+
The following permissions are available to read device information of users.
123+
124+
> [!div class="mx-tableFixed"]
125+
> | Permission | Description |
126+
> | ---------- | ----------- |
127+
> | microsoft.directory/users/ownedDevices/read | Read owned devices of users |
128+
> | microsoft.directory/users/registeredDevices/read | Read registered devices of users |
129+
> | microsoft.directory/users/deviceForResourceAccount/read | Read deviceForResourceAccount of users. |
130+
131+
## Read or manage licenses of users
132+
133+
The following permissions are available to read or manage licenses of users.
134+
135+
> [!div class="mx-tableFixed"]
136+
> | Permission | Description |
137+
> | ---------- | ----------- |
138+
> | microsoft.directory/users/licenseDetails/read | Read license details of users. |
139+
> | microsoft.directory/users/assignLicense | Manage user licenses. |
140+
> | microsoft.directory/users/reprocessLicenseAssignment | Reprocess license assignments for users. |
141+
142+
## Update password policies of users
143+
144+
The following permissions are available to update password policies of users.
145+
146+
> [!div class="mx-tableFixed"]
147+
> | Permission | Description |
148+
> | ---------- | ----------- |
149+
> | microsoft.directory/users/passwordPolicies/update | Update password policies properties of users. |
150+
151+
## Read assignments and memberships of users
152+
153+
The following permissions are available to read assignments and memberships of users.
154+
155+
> [!div class="mx-tableFixed"]
156+
> | Permission | Description |
157+
> | ---------- | ----------- |
158+
> | microsoft.directory/users/appRoleAssignments/read | Read application role assignments for users |
159+
> | microsoft.directory/users/scopedRoleMemberOf/read | Read user's membership of an Azure AD role, that is scoped to an administrative unit |
160+
> | microsoft.directory/users/memberOf/read | Read the group memberships of users |
161+
162+
## Full list of permissions
163+
164+
> [!div class="mx-tableFixed"]
165+
> | Permission | Description |
166+
> | ---------- | ----------- |
167+
> | microsoft.directory/users/appRoleAssignments/read | Read application role assignments for users. |
168+
> | microsoft.directory/users/assignLicense | Manage user licenses. |
169+
> | microsoft.directory/users/basic/update | Update basic properties on users. |
170+
> | microsoft.directory/users/contactInfo/update | Update the contact info properties of users, such as address, phone, and email. |
171+
> | microsoft.directory/users/deviceForResourceAccount/read | Read deviceForResourceAccount of users. |
172+
> | microsoft.directory/users/directReports/read | Read the direct reports for users. |
173+
> | microsoft.directory/users/extensionProperties/update | Update extension properties of users. |
174+
> | microsoft.directory/users/identities/read | Read identities of users. |
175+
> | microsoft.directory/users/identities/update | Update the identity properties of users, such as name and user principal name. |
176+
> | microsoft.directory/users/jobInfo/update | Update the job info properties of users, such as job title, department, and company name. |
177+
> | microsoft.directory/users/licenseDetails/read | Read license details of users. |
178+
> | microsoft.directory/users/manager/read | Read manager of users. |
179+
> | microsoft.directory/users/manager/update | Update manager for users. |
180+
> | microsoft.directory/users/memberOf/read | Read the group memberships of users. |
181+
> | microsoft.directory/users/ownedDevices/read | Read owned devices of users. |
182+
> | microsoft.directory/users/parentalControls/update | Update parental controls of users. |
183+
> | microsoft.directory/users/passwordPolicies/update | Update password policies properties of users. |
184+
> | microsoft.directory/users/registeredDevices/read | Read registered devices of users. |
185+
> | microsoft.directory/users/reprocessLicenseAssignment | Reprocess license assignments for users. |
186+
> | microsoft.directory/users/scopedRoleMemberOf/read | Read user's membership of an Azure AD role, that is scoped to an administrative unit. |
187+
> | microsoft.directory/users/standard/read | Read basic properties on users. |
188+
> | microsoft.directory/users/usageLocation/update | Update usage location of users. |
189+
190+
## Next steps
191+
192+
- [Create and assign a custom role in Azure Active Directory](custom-create.md)
193+
- [List Azure AD role assignments](view-assignments.md)

0 commit comments

Comments
 (0)