Skip to content

Commit ea3a7c0

Browse files
v-andreacov-andreaco
authored
Merge pull request #163506 from rolyon/rolyon-aadroles-custom-roles-groups
[Azure AD roles] Group management permissions for custom roles
2 parents 419e961 + 9d42acb commit ea3a7c0

File tree

2 files changed

+150
-0
lines changed

2 files changed

+150
-0
lines changed

‎articles/active-directory/roles/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,8 @@
112112
href: custom-enterprise-app-permissions.md
113113
- name: App consent permissions
114114
href: custom-consent-permissions.md
115+
- name: Group management permissions
116+
href: custom-group-permissions.md
115117
- name: Azure AD service limits
116118
href: ../enterprise-users/directory-service-limits-restrictions.md?context=%2fazure%2factive-directory%2froles%2fcontext%2fugr-context
117119
- name: Azure AD PowerShell

‎articles/active-directory/roles/custom-group-permissions.md

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
---
2+
title: Group management permissions for Azure AD custom roles (Preview) - Azure Active Directory
3+
description: Group management permissions for Azure AD custom roles (Preview) in the Azure portal, PowerShell, or Microsoft Graph API.
4+
services: active-directory
5+
author: rolyon
6+
manager: daveba
7+
ms.service: active-directory
8+
ms.workload: identity
9+
ms.subservice: roles
10+
ms.topic: reference
11+
ms.date: 10/18/2021
12+
ms.author: rolyon
13+
ms.reviewer:
14+
ms.custom: it-pro
15+
---
16+
17+
# Group management permissions for Azure AD custom roles (Preview)
18+
19+
> [!IMPORTANT]
20+
> Group management permissions for Azure AD custom roles are currently in PREVIEW.
21+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
22+
23+
Group management permissions can be used in custom role definitions in Azure Active Directory (Azure AD) to grant fine-grained access such as the following:
24+
25+
- Manage group properties like name and description
26+
- Manage members and owners
27+
- Create or delete groups
28+
- Read audit logs
29+
- Manage a specific type of group
30+
31+
This article lists the permissions you can use in your custom roles for different group management scenarios. For information about how to create custom roles, see [Create and assign a custom role](custom-create.md).
32+
33+
## How to interpret group management permissions
34+
35+
To interpret the group management permissions, it helps to understand what the different permission subtypes mean.
36+
37+
> [!div class="mx-tableFixed"]
38+
> | Permission subtype | Permission subtype description |
39+
> | --- | --- |
40+
> | groups | Manage security groups and Microsoft 365 groups, excluding role-assignable groups |
41+
> | groups.unified | Manage Microsoft 365 groups of both dynamic and assigned membership type, excluding role-assignable groups |
42+
> | groups.unified.assignedMembership | Manage Microsoft 365 groups of only assigned membership type, excluding role-assignable groups |
43+
> | groups.security | Manage security groups of both dynamic and assigned membership type, excluding role-assignable groups |
44+
> | groups.security.assignedMembership | Manage security groups of only assigned membership type, excluding role-assignable groups |
45+
46+
The following table has example permissions for updating group members of different subtypes.
47+
48+
> [!div class="mx-tableFixed"]
49+
> | Permission example | Permission description |
50+
> | --- | --- |
51+
> | microsoft.directory/**groups**/members/update | Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups |
52+
> | microsoft.directory/**groups.unified**/members/update | Update members of Microsoft 365 groups, excluding role-assignable groups |
53+
> | microsoft.directory/**groups.unified.assignedMembership**/members/update | Update members of Microsoft 365 groups of assigned membership type, excluding role-assignable groups |
54+
> | microsoft.directory/**groups.security**/members/update | Update members of Security groups, excluding role-assignable groups |
55+
> | microsoft.directory/**groups.security.assignedMembership**/members/update | Update members of Security groups of assigned membership type, excluding role-assignable groups |
56+
57+
## Read group information
58+
59+
The following permissions are available to read properties, members, and owners of groups.
60+
61+
> [!div class="mx-tableFixed"]
62+
> | Permission | Description |
63+
> | ---------- | ----------- |
64+
> | microsoft.directory/groups/allProperties/read | Read all properties (including privileged properties) on Security groups and Microsoft 365 groups, including role-assignable groups |
65+
> | microsoft.directory/groups/standard/read | Read standard properties of Security groups and Microsoft 365 groups, including role-assignable groups |
66+
> | microsoft.directory/groups/members/read | Read members of Security groups and Microsoft 365 groups, including role-assignable groups |
67+
> | microsoft.directory/groups/memberOf/read | Read the memberOf property on Security groups and Microsoft 365 groups, including role-assignable groups |
68+
> | microsoft.directory/groups/owners/read | Read owners of Security groups and Microsoft 365 groups, including role-assignable groups |
69+
70+
## Create groups
71+
72+
The following permissions are available to create groups of different types.
73+
74+
> [!div class="mx-tableFixed"]
75+
> | Permission | Description |
76+
> | ---------- | ----------- |
77+
> | microsoft.directory/groups/create | Create Security groups and Microsoft 365 groups, excluding role-assignable groups |
78+
> | microsoft.directory/groups.unified/create | Create Microsoft 365 groups, excluding role-assignable groups |
79+
> | microsoft.directory/groups.unified.assignedMembership/create | Create Microsoft 365 groups of assigned membership type, excluding role-assignable groups |
80+
> | microsoft.directory/groups.security/create | Create Security groups, excluding role-assignable groups |
81+
> | microsoft.directory/groups.security.assignedMembership/create | Create Security groups of assigned membership type, excluding role-assignable groups |
82+
> | microsoft.directory/groups/createAsOwner | Create Security groups and Microsoft 365 groups, excluding role-assignable groups. Creator is added as the first owner. |
83+
> | microsoft.directory/groups.unified/createAsOwner | Create Microsoft 365 groups, excluding role-assignable groups. Creator is added as the first owner. |
84+
> | microsoft.directory/groups.unified.assignedMembership/createAsOwner | Create Microsoft 365 groups of assigned membership type, excluding role-assignable groups. Creator is added as the first owner. |
85+
> | microsoft.directory/groups.security/createAsOwner | Create Security groups, excluding role-assignable groups. Creator is added as the first owner. |
86+
> | microsoft.directory/groups.security.assignedMembership/createAsOwner | Create Security groups of assigned membership type, excluding role-assignable groups. Creator is added as the first owner. |
87+
88+
## Update group information
89+
90+
The following permissions are available to update properties and members of groups.
91+
92+
> [!div class="mx-tableFixed"]
93+
> | Permission | Description |
94+
> | ---------- | ----------- |
95+
> | microsoft.directory/groups/allProperties/update | Update all properties (including privileged properties) on Security groups and Microsoft 365 groups, excluding role-assignable groups |
96+
> | microsoft.directory/groups.unified/allProperties/update | Update all properties (including privileged properties) on Microsoft 365 groups, excluding role-assignable groups |
97+
> | microsoft.directory/groups.unified.assignedMembership/allProperties/update | Update all properties (including privileged properties) on Microsoft 365 groups of assigned membership type, excluding role-assignable groups |
98+
> | microsoft.directory/groups.security/allProperties/update | Update all properties (including privileged properties) on Security groups, excluding role-assignable groups |
99+
> | microsoft.directory/groups.security.assignedMembership/allProperties/update | Update all properties (including privileged properties) on Security groups of assigned membership type, excluding role-assignable groups |
100+
> | microsoft.directory/groups/basic/update | Update basic properties on Security groups and Microsoft 365 groups, excluding role-assignable groups |
101+
> | microsoft.directory/groups.unified/basic/update | Update basic properties on Microsoft 365 groups, excluding role-assignable groups |
102+
> | microsoft.directory/groups.unified.assignedMembership/basic/update | Update basic properties on Microsoft 365 groups of assigned membership type, excluding role-assignable groups |
103+
> | microsoft.directory/groups.security/basic/update | Update basic properties on Security groups, excluding role-assignable groups |
104+
> | microsoft.directory/groups.security.assignedMembership/basic/update | Update basic properties on Security groups of assigned membership type, excluding role-assignable groups |
105+
> | microsoft.directory/groups/classification/update | Update the classification property on Security groups and Microsoft 365 groups, excluding role-assignable groups |
106+
> | microsoft.directory/groups.unified/classification/update | Update the classification property on Microsoft 365 groups, excluding role-assignable groups |
107+
> | microsoft.directory/groups.unified.assignedMembership/classification/update | Update the classification property on Microsoft 365 groups of assigned membership type, excluding role-assignable groups |
108+
> | microsoft.directory/groups.security/classification/update | Update the classification property on Security groups, excluding role-assignable groups |
109+
> | microsoft.directory/groups.security.assignedMembership/classification/update | Update the classification property on Security groups of assigned membership type, excluding role-assignable groups |
110+
> | microsoft.directory/groups/dynamicMembershipRule/update | Update the dynamic membership rule on Security groups and Microsoft 365 groups, excluding role-assignable groups |
111+
> | microsoft.directory/groups.unified/dynamicMembershipRule/update | Update the dynamic membership rule on Microsoft 365 groups, excluding role-assignable groups |
112+
> | microsoft.directory/groups.security/dynamicMembershipRule/update | Update the dynamic membership rule on Security groups, excluding role-assignable groups |
113+
> | microsoft.directory/groups/members/update | Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups |
114+
> | microsoft.directory/groups.unified/members/update | Update members of Microsoft 365 groups, excluding role-assignable groups |
115+
> | microsoft.directory/groups.unified.assignedMembership/members/update | Update members of Microsoft 365 groups of assigned membership type, excluding role-assignable groups |
116+
> | microsoft.directory/groups.security/members/update | Update members of Security groups, excluding role-assignable groups |
117+
> | microsoft.directory/groups.security.assignedMembership/members/update | Update members of Security groups of assigned membership type, excluding role-assignable groups |
118+
119+
## Update members of different group types
120+
121+
The following permissions are available to update members of different group types.
122+
123+
> [!div class="mx-tableFixed"]
124+
> | Permission | Description |
125+
> | ---------- | ----------- |
126+
> | microsoft.directory/groups/members/update | Update members of Security groups and Microsoft 365 groups, excluding role-assignable groups |
127+
> | microsoft.directory/groups.unified/members/update | Update members of Microsoft 365 groups, excluding role-assignable groups |
128+
> | microsoft.directory/groups.unified.assignedMembership/members/update | Update members of Microsoft 365 groups of assigned membership type, excluding role-assignable groups |
129+
> | microsoft.directory/groups.security/members/update | Update members of Security groups, excluding role-assignable groups |
130+
> | microsoft.directory/groups.security.assignedMembership/members/update | Update members of Security groups of assigned membership type, excluding role-assignable groups |
131+
132+
## Delete groups
133+
134+
The following permissions are available to delete groups.
135+
136+
> [!div class="mx-tableFixed"]
137+
> | Permission | Description |
138+
> | ---------- | ----------- |
139+
> | microsoft.directory/groups/delete | Delete Security groups and Microsoft 365 groups, excluding role-assignable groups |
140+
> | microsoft.directory/groups.unified/members/update | Update members of Microsoft 365 groups, excluding role-assignable groups |
141+
> | microsoft.directory/groups.unified.assignedMembership/members/update | Update members of Microsoft 365 groups of assigned membership type, excluding role-assignable groups |
142+
> | microsoft.directory/groups.security/members/update | Update members of Security groups, excluding role-assignable groups |
143+
> | microsoft.directory/groups.security.assignedMembership/members/update | Update members of Security groups of assigned membership type, excluding role-assignable groups |
144+
145+
## Next steps
146+
147+
- [Create and assign a custom role in Azure Active Directory](custom-create.md)
148+
- [List Azure AD role assignments](view-assignments.md)

0 commit comments

Comments
 (0)