Skip to content

Commit d229c83

Browse files
fix: make RBAC include generic (shared across 6 MTO endpoints)
The rbac-multitenantorganization-apis-read.md include is consumed by 6 different endpoints returning different resource types. Remove member-specific property names (displayName, tenantId, role, state, etc.) that are incorrect for the non-member endpoints (MTO object, join request, sync policy template, partner config template). Property-specific details remain in the individual API docs where they are correct and scoped to the right resource type. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 1e326a9 commit d229c83

2 files changed

Lines changed: 6 additions & 6 deletions

File tree

api-reference/beta/includes/rbac-for-apis/rbac-multitenantorganization-apis-read.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ ms.topic: include
55

66
> [!IMPORTANT]
77
> For delegated access using work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role that grants the permissions required for this operation. This operation supports the following built-in roles, which provide only the least privilege necessary:
8-
> - **Security Reader** — Can read basic tenant information (**displayName** and **tenantId** only).
9-
> - **Global Reader** — Can read basic tenant information (**displayName** and **tenantId** only).
8+
> - Security Reader
9+
> - Global Reader
1010
>
11-
> To read all properties (including **role**, **state**, **addedByTenantId**, **addedDateTime**, **joinedDateTime**, and **transitionDetails**), the signed-in user must be assigned a role that grants the `MultiTenantOrganization.Read.All` or `MultiTenantOrganization.ReadWrite.All` permission, such as the **Global Administrator** role.
11+
> These roles grant limited read access. To read all properties, the signed-in user must be assigned a role with the `MultiTenantOrganization.Read.All` or `MultiTenantOrganization.ReadWrite.All` permission.

api-reference/v1.0/includes/rbac-for-apis/rbac-multitenantorganization-apis-read.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ ms.topic: include
55

66
> [!IMPORTANT]
77
> For delegated access using work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role that grants the permissions required for this operation. This operation supports the following built-in roles, which provide only the least privilege necessary:
8-
> - **Security Reader** — Can read basic tenant information (**displayName** and **tenantId** only).
9-
> - **Global Reader** — Can read basic tenant information (**displayName** and **tenantId** only).
8+
> - Security Reader
9+
> - Global Reader
1010
>
11-
> To read all properties (including **role**, **state**, **addedByTenantId**, **addedDateTime**, **joinedDateTime**, and **transitionDetails**), the signed-in user must be assigned a role that grants the `MultiTenantOrganization.Read.All` or `MultiTenantOrganization.ReadWrite.All` permission, such as the **Global Administrator** role.
11+
> These roles grant limited read access. To read all properties, the signed-in user must be assigned a role with the `MultiTenantOrganization.Read.All` or `MultiTenantOrganization.ReadWrite.All` permission.

0 commit comments

Comments
 (0)