Merge pull request #2213 from DebLanger/US356227_CAP

update identities

Author: DebLanger

exposure-management/predefined-classification-rules-and-levels.md

@@ -52,12 +52,16 @@ Current asset types are:
 | Application Administrator                     | Identity   | Very High                 | Identities in this role can create and manage all aspects of enterprise applications, application registrations, and application proxy settings. |
 | Application Developer                         | Identity   | High                      | Identities in this role can create application registrations independent of the 'Users can register applications' setting. |
 | Authentication Administrator                  | Identity   | Very High                 | Identities in this role can set and reset authentication method (including passwords) for non-admin users. |
+| Backup Operators                  | Identity   | Very High                      | Identities in this role can backup and restore all files on a computer, regardless of the permissions that protect those files. Backup operators also can log on to and shut down the computer and can perform backup and restore operations on domain controllers. |
+| Server Operators                  | Identity   | Very High                      | Identities in this role can administer domain controllers. Members of the Server operators group can take the following actions: sign in to a server interactively, create and delete network shared resources, start and stop services, backup and restore files, format the hard disk drive of the computer, and shut down the computer. |
 | B2C IEF Keyset Administrator                  | Identity   | High                      | Identities in this role can manage secrets for federation and encryption in the Identity Experience Framework (IEF). |
 | Cloud Application Administrator               | Identity   | Very High                 | Identities in this role can create and manage all aspects of app registrations and enterprise apps except App Proxy. |
 | Cloud Device Administrator                    | Identity   | High                      | Identities in this role have limited access to manage devices in Microsoft Entra ID. They can enable, disable, and delete devices in Microsoft Entra ID and read Windows 10 BitLocker keys (if present) in the Azure portal. |
 | Conditional Access Administrator              | Identity   | High                      | Identities in this role have the ability to manage Microsoft Entra Conditional Access settings. |
 | Directory Synchronization Accounts            | Identity   | Very High                 | Identities in this role have the ability to manage all directory synchronization settings. Should Only be used by Microsoft Entra Connect service. |
 | Directory Writers                             | Identity   | High                      | Identities in this role can read and write basic directory information. For granting access to applications, not intended for users. |
+| Domain Administrator                          | Identity   | Very High                 | Identities in this role are authorized to administer the domain. By default, the Domain Admins group is a member of the Administrators group on all computers that have joined a domain, including the domain controllers. |
+| Enterprise Administrator                          | Identity   | Very High                 | Identities in this role have complete access to configuring all domain controllers. Members in this group can modify the membership of all administrative groups. |
 | Global Administrator                          | Identity   | Very High                 | Identities in this role can manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities. |
 | Global Reader                                 | Identity   | High                      | Identities in this role can read everything that a Global Administrator can, but not update anything. |
 | Helpdesk Administrator                        | Identity   | Very High                 | Identities in this role can reset passwords for nonadministrators and Helpdesk Administrators. |