Merge pull request #28046 from microsoftgraph/main

Merge to publish.

Author: Danipocket

.github/prompts/author-api-docs.prompt.md

@@ -16,14 +16,16 @@ Before beginning the documentation process, first ask the author which documenta
 1. Author fresh APIs / fresh API changes to beta
 2. Promote APIs from beta to v1.0
 3. Document deprecated APIs
-4. Other documentation tasks (cleanup, backfilling, maintenance, etc.)
+4. Other documentation tasks (cleanup, backfilling, maintenance, manual changelog authoring, etc.)
 
 **Please respond with 1, 2, 3, or 4 to proceed.**
 
 Once the author responds, follow the appropriate workflow below.
 
 **Note:** Scenario 3 (deprecation) can be combined with Scenario 1 or 2. If the Summary of API changes includes both deprecation and other changes (new APIs, promotions, updates), the workflow will handle mixed scenarios by processing non-deprecation tasks first, then applying deprecation documentation.
 
+**Note:** For Scenario 4, if the author needs to manually create a changelog entry for non-schema changes (throttling, query capabilities, permissions), refer to [Common Process: Manually Authoring Changelog Entries](#common-process-manually-authoring-changelog-entries).
+
 ---
 
 ## Common Setup and Processes
@@ -72,7 +74,7 @@ After authoring documentation, update the appropriate changelog file in the `cha
         "Id": "{unique-guid}",
         "Cloud": "Prod",
         "Version": "beta",
-        "CreatedDateTime": "{ISO-8601-DateTime}",
+        "CreatedDateTime": "{YYYY-MM-DDTHH:mm:ss.fffffffZ}",
         "WorkloadArea": "{WorkloadArea}",
         "SubArea": "{SubArea}"
       }
@@ -86,7 +88,7 @@ After authoring documentation, update the appropriate changelog file in the `cha
   - `Id` (unique GUID for this set of changes)
   - `Cloud` (e.g., "Prod")
   - `Version` (e.g., "beta" or "v1.0")
-  - `CreatedDateTime` (ISO-8601 DateTime)
+  - `CreatedDateTime` (ISO 8601/RFC 3339 DateTime with fractional seconds and Z suffix)
   - `WorkloadArea` (e.g., "Security")
   - `SubArea` (may be empty string)
 
@@ -118,19 +120,76 @@ After authoring documentation, update the appropriate changelog file in the `cha
     "Id": "1e2218aa-5dbc-4c74-a0fe-1d06e90b451c",
     "Cloud": "Prod",
     "Version": "beta",
-    "CreatedDateTime": "2026-01-07T08:37:50.5865153Z",
+    "CreatedDateTime": "2025-11-17T17:38:10.4694969Z",
     "WorkloadArea": "Security",
     "SubArea": ""
   }
   ```
 
 - **DO NOT:**
   - Copy only the ChangeList items and insert them into an existing record
-  - Modify the Id, CreatedDateTime, or other metadata from the autogenerated file
+  - Modify the Id, CreatedDateTime (ISO 8601/RFC 3339 format), or other metadata from the autogenerated file
   - Create a new record structure manually
 
 - **Result:** The changelog file should have the new record added at the beginning of the changelog array, with all subsequent records following it
 
+### Common Process: Manually Authoring Changelog Entries
+
+In some cases, API changes don't trigger automatic changelog generation because they don't involve schema changes. These typically include:
+- Throttling metric updates
+- Query capability changes (e.g., $filter support, $expand support, $top max/default page size)
+- Custom query option support
+- Permission support changes
+- Other behavioral changes that don't modify the API schema
+
+For these scenarios, you must manually author the changelog entry.
+
+**When to use manual changelog authoring:**
+- The author indicates there are API changes but no autogenerated changelog file exists in temp-docstubs
+- The author explicitly requests manual changelog creation
+- Changes involve throttling, query capabilities, permissions, or other non-schema modifications
+
+**Manual changelog authoring workflow:**
+
+**Step 1: Determine if manual authoring is needed**
+- Ask if an autogenerated changelog exists in `temp-docstubs/`
+- If no autogenerated changelog exists and there are API changes to document, manual authoring is required
+
+**Step 2: Gather required information from the author**
+
+Collect the following details for each API change (refer to **templates/changelog-patterns.md** for complete property definitions):
+
+**Required ChangeList properties:** ChangedApiName, ApiChange, ChangeType, Target, Description
+
+**Required record-level properties:** Version, WorkloadArea, SubArea
+
+**Note:** Cloud is always "prd" - no need to ask the author.
+
+**Step 3: Generate GUID and timestamp**
+
+Refer to **templates/changelog-patterns.md** "GUID Generation" and "CreatedDateTime" sections for generation commands and requirements.
+
+**Step 4: Construct the changelog JSON**
+
+Use the JSON template and examples from **templates/changelog-patterns.md**.
+
+**Step 5: Determine target changelog file**
+- If the change affects a specific workload, add to the appropriate workload changelog file (e.g., `changelog/Microsoft.AAD.LCM.json`)
+- For general non-schema changes, add to `changelog/Manual.NonWorkloadChanges.json`
+- Ask the author which changelog file to use if uncertain
+
+**Step 6: Add the manually created record**
+- Follow the same process as [Common Process: Updating the Changelog](#common-process-updating-the-changelog) Step 3
+- Insert the manually created changelog record as the FIRST item in the `"changelog"` array
+- Ensure proper JSON formatting
+
+**Step 7: Validate the entry**
+
+Follow the complete validation checklist in **templates/changelog-patterns.md** and run:
+```powershell
+.\validate-changelog-json.ps1
+```
+
 ### Common Process: Updating What's New
 
 After updating the changelog, update the What's new section in `concepts/whats-new-overview.md`:

.github/prompts/review-api-docs.prompt.md

@@ -71,12 +71,12 @@ All content must align with the [Microsoft Style Guide](https://docs.microsoft.c
 
 ### 2. API Docs Authoring Guidelines
 
-Reference the [author-api-docs.prompt.md](.github/prompts/author-api-docs.prompt.md) file for:
-- Namespace qualification rules
-- General formatting rules (alphabetical ordering, file naming conventions, beta disclaimer)
-- TOC structure requirements
-- Changelog format and structure
-- What's new formatting
+Reference [author-api-docs.prompt.md](.github/prompts/author-api-docs.prompt.md) for:
+- **Reference Standards: Namespace Qualification** - Namespace qualification rules for subnamespace types
+- **Reference Standards: General Formatting Rules** - Alphabetical ordering, file naming conventions, beta disclaimer
+- **Common Process: Updating the Changelog** - Changelog format and structure
+- **Common Process: Updating What's New** - What's new formatting and link rules
+- **Common Process: Updating the Table of Contents (TOC)** - TOC structure requirements
 
 ### 3. API Docs Review Guidelines
 
@@ -145,22 +145,22 @@ For files in `api-reference/v1.0/resources/` and `api-reference/beta/resources/`
 
 ### Changelog Files Review
 
-For files in `changelog/`:
+For files in `changelog/`, verify structure matches [templates/changelog-patterns.md](templates/changelog-patterns.md).
 
 **Required Elements:**
-- [ ] Complete changelog record structure (ChangeList, Id, Cloud, Version, CreatedDateTime, WorkloadArea, SubArea)
-- [ ] Same Id value across the complete changelog record (record-level Id matches all ChangeList item Ids within that record)
-- [ ] Cloud value is `Prod`
-- [ ] Version value is `v1.0` or `beta`
-- [ ] Proper UTC DateTime format for CreatedDateTime
-- [ ] Links use full HTTP URLs with en-us locale
-- [ ] Links include version parameter without preserve-view=true
-
-**Common Issues to Flag:**
-- [ ] Multiple API elements in single record
-- [ ] Missing or incorrect descriptions
-- [ ] Malformed links
-- [ ] Incomplete record structure (missing metadata properties)
+- [ ] Complete changelog record structure (ChangeList array + Id, Cloud, Version, CreatedDateTime, WorkloadArea, SubArea)
+- [ ] Same GUID in all ChangeList items and record-level Id
+- [ ] Cloud value is "prd"
+- [ ] Version value is "v1.0" or "beta"
+- [ ] CreatedDateTime in ISO 8601/RFC 3339 format with fractional seconds and Z suffix (e.g., "2025-11-17T17:38:10.4694969Z")
+- [ ] Description links use full URLs with en-us locale
+- [ ] WorkloadArea and SubArea match CDK taxonomy (https://aka.ms/msgraphcdk)
+
+**Common Issues:**
+- [ ] Multiple unrelated API elements in single ChangeList item
+- [ ] Missing or vague descriptions
+- [ ] Malformed links or missing en-us locale
+- [ ] Incomplete record structure (missing metadata)
 
 ### Version-Specific Validation
 
@@ -178,46 +178,26 @@ For files in `changelog/`:
 
 ## Namespace Qualification Review
 
-Verify proper namespace qualification following these rules:
-
-**Fully qualify types in these contexts ONLY:**
-- Resource topic: Type column in Properties tables
-- Resource topic: Type column in Relationships tables
-- Resource topic: Return type column in Methods tables
-- Method topic: Type column in Path parameters tables
-- Method topic: Type column in Function parameters tables
-- Method topic: Type column in Query parameters tables
-- Method topic: Type column in Request body tables
-- Method topic: Method return type in Response section
-
-**File naming for subnamespaces:**
-- [ ] Files for subnamespace resources prepend subnamespace name
-- [ ] Examples: `callrecords-callrecord.md`, `security-alert.md`
-- [ ] Lowercase with `microsoft.graph.` prefix removed
+Verify proper namespace qualification following the rules detailed in [author-api-docs.prompt.md - Reference Standards: Namespace Qualification](.github/prompts/author-api-docs.prompt.md#reference-standards-namespace-qualification).
 
-**HTTP requests for actions/functions in subnamespaces:**
-- [ ] Namespace of binding parameter type specified in HTTP request
-- [ ] Example: `POST /me/microsoft.graph.callRecords.getDirectRoutingCalls`
+**Quick checklist:**
+- [ ] Files for subnamespace resources prepend subnamespace name (e.g., `callrecords-callrecord.md`, `security-alert.md`)
+- [ ] Lowercase with `microsoft.graph.` prefix removed
+- [ ] Namespace of binding parameter type specified in HTTP request for actions/functions
+- [ ] Types in subnamespaces are fully qualified in table Type columns and Response sections
 
 ---
 
 ## Formatting and Style Review
 
-**File naming:**
-- [ ] All filenames are lowercase
-- [ ] Hyphens separate words
-- [ ] Resource files: `{resourcename}.md`
-- [ ] API method files: `{resourcename}-{operation}.md`
-- [ ] Subnamespace files: `{subnamespace}-{resourcename}.md`
-
-**Alphabetical ordering:**
-- [ ] Properties in Properties tables
-- [ ] Relationships in Relationships tables
-- [ ] H3 sections in What's new (within each month)
+Verify compliance with formatting rules detailed in [author-api-docs.prompt.md - Reference Standards: General Formatting Rules](.github/prompts/author-api-docs.prompt.md#reference-standards-general-formatting-rules).
 
-**Markdown formatting:**
+**Quick checklist:**
+- [ ] All filenames are lowercase with hyphens separating words
+- [ ] Properties and Relationships tables in alphabetical order
+- [ ] H3 sections in What's new in alphabetical order (within each month)
 - [ ] Symbol names wrapped in backticks: `MyClass`, `handleClick()`
-- [ ] File references formatted as links (not backticks): [path/file.ts](path/file.ts)
+- [ ] File references formatted as links: [path/file.ts](path/file.ts)
 - [ ] Enum values styled with inline code (backticks)
 - [ ] Resource/property references styled with **bold** or links
 

api-reference/beta/api/intune-androidforwork-androiddeviceownerenrollmentprofile-setenrollmenttimedevicemembershiptarget.md

@@ -25,9 +25,9 @@ One of the following permissions is required to call this API. To learn more, in
 
 |Permission type|Permissions (from least to most privileged)|
 |:---|:---|
-|Delegated (work or school account)|DeviceManagementConfiguration.Read.All|
+|Delegated (work or school account)|DeviceManagementConfiguration.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|
-|Application|DeviceManagementConfiguration.Read.All|
+|Application|DeviceManagementConfiguration.ReadWrite.All|
 
 ## HTTP Request
 <!-- {

api-reference/beta/api/intune-androidforwork-androidmanagedstoreaccountenterprisesettings-addapps.md

@@ -25,9 +25,9 @@ One of the following permissions is required to call this API. To learn more, in
 
 |Permission type|Permissions (from least to most privileged)|
 |:---|:---|
-|Delegated (work or school account)|DeviceManagementConfiguration.Read.All|
+|Delegated (work or school account)|DeviceManagementConfiguration.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|
-|Application|DeviceManagementConfiguration.Read.All|
+|Application|DeviceManagementConfiguration.ReadWrite.All|
 
 ## HTTP Request
 <!-- {

api-reference/beta/api/intune-androidforwork-androidmanagedstoreaccountenterprisesettings-requestenterpriseupgradeurl.md

@@ -25,9 +25,9 @@ One of the following permissions is required to call this API. To learn more, in
 
 |Permission type|Permissions (from least to most privileged)|
 |:---|:---|
-|Delegated (work or school account)|DeviceManagementConfiguration.Read.All|
+|Delegated (work or school account)|DeviceManagementConfiguration.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|
-|Application|DeviceManagementConfiguration.Read.All|
+|Application|DeviceManagementConfiguration.ReadWrite.All|
 
 ## HTTP Request
 <!-- {

api-reference/beta/api/intune-androidforwork-androidmanagedstoreaccountenterprisesettings-retrievestorelayout.md

@@ -25,9 +25,9 @@ One of the following permissions is required to call this API. To learn more, in
 
 |Permission type|Permissions (from least to most privileged)|
 |:---|:---|
-|Delegated (work or school account)|DeviceManagementConfiguration.Read.All|
+|Delegated (work or school account)|DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|
-|Application|DeviceManagementConfiguration.Read.All|
+|Application|DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All|
 
 ## HTTP Request
 <!-- {

api-reference/beta/api/intune-androidforwork-androidmanagedstoreaccountenterprisesettings-setstorelayout.md

@@ -25,9 +25,9 @@ One of the following permissions is required to call this API. To learn more, in
 
 |Permission type|Permissions (from least to most privileged)|
 |:---|:---|
-|Delegated (work or school account)|DeviceManagementConfiguration.Read.All|
+|Delegated (work or school account)|DeviceManagementConfiguration.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|
-|Application|DeviceManagementConfiguration.Read.All|
+|Application|DeviceManagementConfiguration.ReadWrite.All|
 
 ## HTTP Request
 <!-- {

api-reference/beta/api/intune-androidfotaservice-zebrafotaconnector-approvefotaapps.md

@@ -25,9 +25,9 @@ One of the following permissions is required to call this API. To learn more, in
 
 |Permission type|Permissions (from least to most privileged)|
 |:---|:---|
-|Delegated (work or school account)|DeviceManagementConfiguration.Read.All|
+|Delegated (work or school account)|DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|
-|Application|DeviceManagementConfiguration.Read.All|
+|Application|DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All|
 
 ## HTTP Request
 <!-- {

api-reference/beta/api/intune-androidfotaservice-zebrafotaconnector-connect.md

@@ -25,9 +25,9 @@ One of the following permissions is required to call this API. To learn more, in
 
 |Permission type|Permissions (from least to most privileged)|
 |:---|:---|
-|Delegated (work or school account)|DeviceManagementConfiguration.Read.All|
+|Delegated (work or school account)|DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|
-|Application|DeviceManagementConfiguration.Read.All|
+|Application|DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All|
 
 ## HTTP Request
 <!-- {

api-reference/beta/api/intune-androidfotaservice-zebrafotaconnector-disconnect.md

@@ -25,9 +25,9 @@ One of the following permissions is required to call this API. To learn more, in
 
 |Permission type|Permissions (from least to most privileged)|
 |:---|:---|
-|Delegated (work or school account)|DeviceManagementConfiguration.ReadWrite.All|
+|Delegated (work or school account)|DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|
-|Application|DeviceManagementConfiguration.ReadWrite.All|
+|Application|DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All|
 
 ## HTTP Request
 <!-- {