docs: Clarify MTO tenant API permission-to-property mapping and role access#9902
Closed
srinivaspadala-msft wants to merge 3 commits into
Closed
Conversation
…access - Add detailed permission-to-property mapping showing which properties are returned for each permission level - Document that Directory.Read.All also grants full read access to multitenant organization tenant resources (delegated or application) - Clarify that ReadBasic.All only returns displayName and tenantId, and only active tenants - Expand RBAC role documentation to specify that Security Reader and Global Reader can only read basic tenant info - Add guidance on which role is needed for full property access - Updated for both v1.0 and beta API references Addresses IcM 31000000597799 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
Learn Build status updates of commit 86e66f7: ✅ Validation status: passed
For more details, please refer to the build report. |
Apply the same permission-to-property mapping to the multitenantorganizationmember-get API (v1.0 and beta). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
srinivaspadala-msft
added
the
ready for content review
Contributor
|
Learn Build status updates of commit 1e326a9: ✅ Validation status: passed
For more details, please refer to the build report. |
The rbac-multitenantorganization-apis-read.md include is consumed by 6 different endpoints returning different resource types. Remove member-specific property names (displayName, tenantId, role, state, etc.) that are incorrect for the non-member endpoints (MTO object, join request, sync policy template, partner config template). Property-specific details remain in the individual API docs where they are correct and scoped to the right resource type. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
Learn Build status updates of commit d229c83: ✅ Validation status: passed
For more details, please refer to the build report. |
Contributor
|
@srinivaspadala-msft, please follow our guidelines and use the private repo. Thanks! |
Danipocket
added
blocked
Contributor
Author
|
Closing moving to private repo per reviewer guidance (security-related IcM). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important
Required for API changes:
Summary
Clarifies which permissions and Entra roles grant access to multitenant organization tenant data, and documents the properties returned at each permission level.
Addresses IcM 31000000597799 MSRC reported
Directory.Read.Allgranting access to/tenantRelationships/multiTenantOrganization/tenantsas an authorization bypass. Investigation confirmed this is by design; the documentation simply failed to listDirectory.Read.Allas a valid permission.Changes
List tenants API (
multitenantorganization-list-tenants.md, v1.0 + beta):ReadBasic.All,Read.All,Directory.Read.All, andReadWrite.AllGet tenant API (
multitenantorganizationmember-get.md, v1.0 + beta):RBAC include (
rbac-multitenantorganization-apis-read.md, v1.0 + beta):displayNameandtenantIdNotes
DO NOT MODIFY) were not modified