diff --git a/permissions/new/permissions.json b/permissions/new/permissions.json index a66cae20..bb1b16f2 100644 --- a/permissions/new/permissions.json +++ b/permissions/new/permissions.json @@ -4142,7 +4142,7 @@ "adminDisplayName": "Read and write all applications", "adminDescription": "Allows the app to create, read, update and delete applications and service principals without a signed-in user. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -4558,7 +4558,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "idappcore" + "ownerSecurityGroup": "IdentityReq" } }, "Application.ReadWrite.OwnedBy": { @@ -4833,7 +4833,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "idappcore" + "ownerSecurityGroup": "IdentityReq" } }, "AppRegistration.Create": { @@ -4887,7 +4887,7 @@ "adminDisplayName": "Manage app permission grants and app role assignments", "adminDescription": "Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -4964,7 +4964,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "idappcore" + "ownerSecurityGroup": "IdentityReq" } }, "ApprovalSolution.Read": { @@ -8008,7 +8008,7 @@ "adminDisplayName": "Read calendars in all mailboxes", "adminDescription": "Allows the app to read events of all calendars without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9352,7 +9352,6 @@ "/app/calls": "", "/app/calls/{id}/addlargegalleryview": "", "/app/calls/{id}/answer": "least=Application", - "/app/calls/{id}/lowerHand": "", "/app/calls/{id}/participants/{id}/admitFromLobby": "", "/app/calls/{id}/participants/{id}/lowerHand": "", "/app/calls/{id}/participants/{id}/mute": "least=Application", @@ -9361,7 +9360,6 @@ "/app/calls/{id}/participants/configuremixer": "", "/app/calls/{id}/participants/lowerAllHands": "", "/app/calls/{id}/participants/muteall": "least=Application", - "/app/calls/{id}/raiseHand": "", "/app/calls/{id}/startRecording": "least=Application", "/app/calls/{id}/startTranscription": "least=Application", "/app/calls/{id}/stopRecording": "least=Application", @@ -9370,7 +9368,6 @@ "/communications/calls": "", "/communications/calls/{id}/addlargegalleryview": "", "/communications/calls/{id}/answer": "least=Application", - "/communications/calls/{id}/lowerHand": "", "/communications/calls/{id}/participants/{id}/admitFromLobby": "", "/communications/calls/{id}/participants/{id}/lowerHand": "", "/communications/calls/{id}/participants/{id}/mute": "least=Application", @@ -9381,7 +9378,6 @@ "/communications/calls/{id}/participants/configuremixer": "", "/communications/calls/{id}/participants/lowerAllHands": "", "/communications/calls/{id}/participants/muteall": "least=Application", - "/communications/calls/{id}/raiseHand": "", "/communications/calls/{id}/startRecording": "least=Application", "/communications/calls/{id}/startTranscription": "least=Application", "/communications/calls/{id}/stopRecording": "least=Application", @@ -9478,7 +9474,6 @@ "POST" ], "paths": { - "/app/calls/{id}/lowerHand": "least=Application", "/app/calls/{id}/participants/{id}/admitFromLobby": "least=Application", "/app/calls/{id}/participants/{id}/lowerHand": "least=Application", "/app/calls/{id}/participants/{id}/mute": "", @@ -9487,8 +9482,6 @@ "/app/calls/{id}/participants/configuremixer": "", "/app/calls/{id}/participants/lowerAllHands": "least=Application", "/app/calls/{id}/participants/muteall": "", - "/app/calls/{id}/raiseHand": "least=Application", - "/communications/calls/{id}/lowerHand": "least=Application", "/communications/calls/{id}/participants/{id}/admitFromLobby": "least=Application", "/communications/calls/{id}/participants/{id}/lowerHand": "least=Application", "/communications/calls/{id}/participants/{id}/mute": "", @@ -9498,8 +9491,7 @@ "/communications/calls/{id}/participants/admitAllFromLobby": "least=Application", "/communications/calls/{id}/participants/configuremixer": "", "/communications/calls/{id}/participants/lowerAllHands": "least=Application", - "/communications/calls/{id}/participants/muteall": "", - "/communications/calls/{id}/raiseHand": "least=Application" + "/communications/calls/{id}/participants/muteall": "" } } ], @@ -9578,34 +9570,6 @@ "ownerSecurityGroup": "TeamsPermissions" } }, - "Calls.ReportSyntheticMedia.All": { - "authorizationType": "oAuth2", - "schemes": { - "Application": { - "adminDisplayName": "Report synthetic media detections in calls", - "adminDescription": "Allows the app to report synthetic media detections for participants in calls, without a signed-in user.", - "requiresAdminConsent": true, - "privilegeLevel": 3 - } - }, - "pathSets": [ - { - "schemeKeys": [ - "Application" - ], - "methods": [ - "POST" - ], - "paths": { - "/app/calls/{id}/participants/{id}/reportsyntheticmedia": "least=Application", - "/communications/calls/{id}/participants/{id}/reportsyntheticmedia": "least=Application" - } - } - ], - "ownerInfo": { - "ownerSecurityGroup": "RtsAvengersSG" - } - }, "CallTranscripts.Read.All": { "authorizationType": "oAuth2", "schemes": { @@ -9663,171 +9627,6 @@ "ownerSecurityGroup": "TeamsPermissions" } }, - "CaseManagement.Read.All": { - "authorizationType": "oAuth2", - "schemes": { - "DelegatedWork": { - "adminDisplayName": "Read cases, relations, tasks, attachments and activities", - "adminDescription": "Allows the app to read all cases, relations, tasks, attachments and activities, on behalf of the signed-in user.", - "userDisplayName": "Read all cases, relations, tasks, attachments and activities", - "userDescription": "Allows the app to read all cases, relations, tasks, attachments and activities that you have access to.", - "requiresAdminConsent": true, - "privilegeLevel": 3 - }, - "Application": { - "adminDisplayName": "Read all cases, relations, tasks, attachments and activities", - "adminDescription": "Allows the app to read all cases, relations, tasks, attachments and activities, without a signed-in user.", - "requiresAdminConsent": true, - "privilegeLevel": 3 - } - }, - "pathSets": [ - { - "schemeKeys": [ - "DelegatedWork", - "Application" - ], - "methods": [ - "GET" - ], - "paths": { - "/security/caseManagement/cases": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/activities": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/activities/{id}": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/activities/microsoft.graph.security.caseManagement.auditLog": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/activities/microsoft.graph.security.caseManagement.comment": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/attachments": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/attachments/{id}": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/attachments/{id}/content": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/relations": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/relations/{id}": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/relations/microsoft.graph.security.caseManagement.incidentRelation": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/relations/microsoft.graph.security.caseManagement.recommendationRelation": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/relations/microsoft.graph.security.caseManagement.workspaceIndicatorRelation": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/tasks": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/tasks/{id}": "least=DelegatedWork,Application", - "/security/caseManagement/cases/microsoft.graph.security.caseManagement.exposureCase": "least=DelegatedWork,Application", - "/security/caseManagement/cases/microsoft.graph.security.caseManagement.genericCase": "least=DelegatedWork,Application", - "/security/caseManagement/cases/microsoft.graph.security.caseManagement.incidentCase": "least=DelegatedWork,Application", - "/security/caseManagement/caseTypeConfigurations": "least=DelegatedWork,Application", - "/security/caseManagement/caseTypeConfigurations/{id}": "least=DelegatedWork,Application", - "/security/caseManagement/caseTypeConfigurations/{id}/customFields": "least=DelegatedWork,Application", - "/security/caseManagement/caseTypeConfigurations/{id}/customFields/{id}": "least=DelegatedWork,Application", - "/security/caseManagement/caseTypeConfigurations/{id}/statuses": "least=DelegatedWork,Application", - "/security/caseManagement/caseTypeConfigurations/{id}/statuses/{id}": "least=DelegatedWork,Application" - } - } - ], - "ownerInfo": { - "ownerSecurityGroup": "CaseManagement-SG" - } - }, - "CaseManagement.ReadWrite.All": { - "authorizationType": "oAuth2", - "schemes": { - "DelegatedWork": { - "adminDisplayName": "Read and write to cases, relations, tasks, attachments and activities", - "adminDescription": "Allows the app to read and write to all cases, relations, tasks, attachments and activities, on behalf of the signed-in user.", - "userDisplayName": "Read and write to all cases, relations, tasks, attachments and activities", - "userDescription": "Allows the app to read and write to all cases, relations, tasks, attachments and activities that you have access to.", - "requiresAdminConsent": true, - "privilegeLevel": 3 - }, - "Application": { - "adminDisplayName": "Read and write to all cases, relations, tasks, attachments and activities", - "adminDescription": "Allows the app to read and write to all cases, relations, tasks, attachments and activities, without a signed-in user.", - "requiresAdminConsent": true, - "privilegeLevel": 3 - } - }, - "pathSets": [ - { - "schemeKeys": [ - "DelegatedWork", - "Application" - ], - "methods": [ - "GET" - ], - "paths": { - "/security/caseManagement/cases": "", - "/security/caseManagement/cases/{id}": "", - "/security/caseManagement/cases/{id}/activities": "", - "/security/caseManagement/cases/{id}/activities/{id}": "", - "/security/caseManagement/cases/{id}/activities/microsoft.graph.security.caseManagement.auditLog": "", - "/security/caseManagement/cases/{id}/activities/microsoft.graph.security.caseManagement.comment": "", - "/security/caseManagement/cases/{id}/attachments": "", - "/security/caseManagement/cases/{id}/attachments/{id}": "", - "/security/caseManagement/cases/{id}/attachments/{id}/content": "", - "/security/caseManagement/cases/{id}/relations": "", - "/security/caseManagement/cases/{id}/relations/{id}": "", - "/security/caseManagement/cases/{id}/relations/microsoft.graph.security.caseManagement.incidentRelation": "", - "/security/caseManagement/cases/{id}/relations/microsoft.graph.security.caseManagement.recommendationRelation": "", - "/security/caseManagement/cases/{id}/relations/microsoft.graph.security.caseManagement.workspaceIndicatorRelation": "", - "/security/caseManagement/cases/{id}/tasks": "", - "/security/caseManagement/cases/{id}/tasks/{id}": "", - "/security/caseManagement/cases/microsoft.graph.security.caseManagement.exposureCase": "", - "/security/caseManagement/cases/microsoft.graph.security.caseManagement.genericCase": "", - "/security/caseManagement/cases/microsoft.graph.security.caseManagement.incidentCase": "", - "/security/caseManagement/caseTypeConfigurations": "", - "/security/caseManagement/caseTypeConfigurations/{id}": "", - "/security/caseManagement/caseTypeConfigurations/{id}/customFields": "", - "/security/caseManagement/caseTypeConfigurations/{id}/customFields/{id}": "", - "/security/caseManagement/caseTypeConfigurations/{id}/statuses": "", - "/security/caseManagement/caseTypeConfigurations/{id}/statuses/{id}": "" - } - }, - { - "schemeKeys": [ - "DelegatedWork", - "Application" - ], - "methods": [ - "POST" - ], - "paths": { - "/security/caseManagement/cases": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/activities": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/attachments": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/relations": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/tasks": "least=DelegatedWork,Application" - } - }, - { - "schemeKeys": [ - "DelegatedWork", - "Application" - ], - "methods": [ - "DELETE", - "PATCH" - ], - "paths": { - "/security/caseManagement/cases/{id}": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/activities/{id}": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/attachments/{id}": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/relations/{id}": "least=DelegatedWork,Application", - "/security/caseManagement/cases/{id}/tasks/{id}": "least=DelegatedWork,Application" - } - }, - { - "schemeKeys": [ - "DelegatedWork", - "Application" - ], - "methods": [ - "PUT" - ], - "paths": { - "/security/caseManagement/cases/{id}/attachments/{id}/content": "least=DelegatedWork,Application" - } - } - ], - "ownerInfo": { - "ownerSecurityGroup": "CaseManagement-SG" - } - }, "ChangeManagement.Read.All": { "authorizationType": "oAuth2", "schemes": { @@ -10380,7 +10179,7 @@ "adminDisplayName": "Read all channel messages", "adminDescription": "Allows the app to read all channel messages in Microsoft Teams", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -10429,7 +10228,7 @@ "adminDisplayName": "", "adminDescription": "", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 2 } }, "pathSets": [ @@ -11036,7 +10835,7 @@ "adminDisplayName": "Read all chat messages", "adminDescription": "Allows the app to read all 1-to-1 or group chat messages in Microsoft Teams.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -11315,7 +11114,7 @@ "adminDisplayName": "Read and write all chat messages", "adminDescription": "Allows an app to read and write all chat messages in Microsoft Teams, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -12764,7 +12563,7 @@ "adminDisplayName": "Read and write all consent requests", "adminDescription": "Allows the app to read app consent requests and approvals, and deny or approve those requests without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -14017,13 +13816,13 @@ "userDisplayName": "Read and write custom security attribute assignments", "userDescription": "Allows the app to read and write custom security attribute assignments for all principals in the tenant on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write custom security attribute assignments", "adminDescription": "Allows the app to read and write custom security attribute assignments for all principals in the tenant without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -14118,13 +13917,13 @@ "userDisplayName": "Read and write custom security attribute definitions", "userDescription": "Allows the app to read and write custom security attribute definitions for the tenant on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write custom security attribute definitions", "adminDescription": "Allows the app to read and write custom security attribute definitions for the tenant without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -14462,7 +14261,7 @@ "userDisplayName": "Manage all delegated permission grants", "userDescription": "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), on your behalf. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Manage all delegated permission grants", @@ -14540,7 +14339,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "ssp" + "ownerSecurityGroup": "IdentityReq" } }, "Device.Command": { @@ -14775,7 +14574,7 @@ "adminDisplayName": "Read and write devices", "adminDescription": "Allows the app to read and write all device properties without a signed in user. Does not allow device creation, device deletion or update of device alternative security identifiers.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -15681,7 +15480,7 @@ "adminDisplayName": "Read Microsoft Intune device configuration and policies", "adminDescription": "Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -20030,7 +19829,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "DirectoryPreAuthZReq" + "ownerSecurityGroup": "IdentityReq" } }, "Directory.Read.All": { @@ -20406,13 +20205,13 @@ "userDisplayName": "Read and write directory data", "userDescription": "Allows the app to read and write data in your organization's directory, such as other users, groups. It does not allow the app to delete users or groups, or reset user passwords but it does allow modification of recovery properties that may lead to account takeover.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write directory data", "adminDescription": "Allows the app to read and write data in your organization's directory, such as users, and groups, without a signed-in user. It does not allow user or group deletion.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -21031,7 +20830,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "DirectoryPreAuthZReq" + "ownerSecurityGroup": "IdentityReq" } }, "DirectoryRecommendations.Read.All": { @@ -21296,13 +21095,13 @@ "userDisplayName": "Read and write domains", "userDescription": "Allows the app to read and write all domain properties on your behalf. Also allows the app to add, verify and remove domains.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write domains", "adminDescription": "Allows the app to read and write all domain properties without a signed in user. Also allows the app to add, verify and remove domains.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -21379,7 +21178,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "iamut-dev" + "ownerSecurityGroup": "IdentityReq" } }, "eDiscovery.Read.All": { @@ -23114,7 +22913,7 @@ "adminDisplayName": "Read and write the organization's roster", "adminDescription": "Allows the app to read and write the structure of schools and classes in the organization's roster and education-specific information about all users to be read and written.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -23632,7 +23431,7 @@ "adminDisplayName": "Read and write all entitlement management resources", "adminDescription": "Allows the app to read and write access packages and related entitlement management resources without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -25255,7 +25054,7 @@ "adminDisplayName": "Read files in all site collections", "adminDescription": "Allows the app to read all files in all site collections without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -27174,7 +26973,7 @@ "adminDisplayName": "Read and write files in all site collections", "adminDescription": "Allows the app to read, create, update and delete all files in all site collections without a signed in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -29199,13 +28998,13 @@ "userDisplayName": "Read and write all groups", "userDescription": "Allows the app to create groups and read all group properties and memberships on your behalf. Additionally allows the app to manage your groups and to update group content for groups you are a member of.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all groups", "adminDescription": "Allows the app to create groups, read all group properties and memberships, update group properties and memberships, and delete groups. Also allows the app to read and write conversations. All of these operations can be performed by the app without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -29649,7 +29448,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "AADGroupsPreAuth" + "ownerSecurityGroup": "IdentityReq" } }, "GroupMember.Read.All": { @@ -29768,13 +29567,13 @@ "userDisplayName": "Read and write group memberships", "userDescription": "Allows the app to list groups, read basic properties, read and update the membership of your groups. Group properties and owners cannot be updated and groups cannot be deleted.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all group memberships", "adminDescription": "Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -29807,7 +29606,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "AADGroupsPreAuth" + "ownerSecurityGroup": "IdentityReq" } }, "GroupSettings.Read.All": { @@ -30287,7 +30086,7 @@ "adminDisplayName": "Read and write identity providers", "adminDescription": "Allows the app to read and write your organization's identity (authentication) providers' properties without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30674,7 +30473,7 @@ "adminDisplayName": "Read and write all risky user information", "adminDescription": "Allows the app to read and update identity risky user information for your organization without a signed-in user. Update operations include dismissing risky users.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32443,7 +32242,7 @@ "adminDisplayName": "Manage all license assignments.", "adminDescription": "Allows an app to manage license assignments for users and groups, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -35040,7 +34839,7 @@ "/networkAccess/connectivity/branches/{id}/deviceLinks": "least=DelegatedWork,Application", "/networkAccess/connectivity/branches/{id}/deviceLinks/{id}": "least=DelegatedWork,Application", "/networkAccess/connectivity/getWebCategoryByUrl(url={value})": "least=DelegatedWork,Application", - "/networkAccess/connectivity/remoteNetworks/{id}/microsoft.graph.networkaccess.getRemoteNetworkLinkHealth": "least=DelegatedWork,Application", + "/networkAccess/connectivity/remoteNetworks/{id}/microsoft.graph.networkaccess.getBranchLinkHealth": "least=DelegatedWork,Application", "/networkAccess/connectivity/webCategories": "least=DelegatedWork,Application", "/networkAccess/contentPolicies": "least=DelegatedWork,Application", "/networkAccess/contentPolicies/{id}/policyRules": "least=DelegatedWork,Application", @@ -35128,7 +34927,7 @@ ], "paths": { "/networkAccess/classifyMcpTools": "least=DelegatedWork,Application", - "/networkAccess/connectivity/remoteNetworks/microsoft.graph.networkaccess.getRemoteNetworksHealth": "least=DelegatedWork,Application", + "/networkAccess/connectivity/remoteNetworks/microsoft.graph.networkaccess.getBatchHealth": "least=DelegatedWork,Application", "/networkAccess/discoverMcpTools": "least=DelegatedWork,Application" } } @@ -35181,7 +34980,7 @@ "/networkAccess/connectivity/branches/{id}/connectivityConfiguration": "", "/networkAccess/connectivity/branches/{id}/deviceLinks": "", "/networkAccess/connectivity/branches/{id}/deviceLinks/{id}": "", - "/networkAccess/connectivity/remoteNetworks/{id}/microsoft.graph.networkaccess.getRemoteNetworkLinkHealth": "", + "/networkAccess/connectivity/remoteNetworks/{id}/microsoft.graph.networkaccess.getBranchLinkHealth": "", "/networkAccess/connectivity/webCategories": "", "/networkAccess/contentPolicies": "", "/networkAccess/contentPolicies/{id}/policyRules": "", @@ -35289,7 +35088,7 @@ "/networkAccess/cloudFirewallPolicies/{id}/policyRules": "least=DelegatedWork,Application", "/networkAccess/connectivity/branches": "least=DelegatedWork,Application", "/networkAccess/connectivity/branches/{id}/deviceLinks": "least=DelegatedWork,Application", - "/networkAccess/connectivity/remoteNetworks/microsoft.graph.networkaccess.getRemoteNetworksHealth": "", + "/networkAccess/connectivity/remoteNetworks/microsoft.graph.networkaccess.getBatchHealth": "", "/networkAccess/contentPolicies": "least=DelegatedWork,Application", "/networkAccess/contentPolicies/{id}/policyRules": "least=DelegatedWork,Application", "/networkAccess/contentTypePolicies": "least=DelegatedWork,Application", @@ -36240,8 +36039,7 @@ "Application": { "adminDisplayName": "", "adminDescription": "", - "requiresAdminConsent": true, - "privilegeLevel": 3 + "requiresAdminConsent": true } }, "pathSets": [], @@ -37224,7 +37022,7 @@ "adminDisplayName": "Read and write organization information", "adminDescription": "Allows the app to read and write the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38517,7 +38315,6 @@ "paths": { "/places": "least=DelegatedWork,Application", "/places/{id}": "least=DelegatedWork,Application", - "/places/{id}/customProperties": "least=DelegatedWork,Application", "/places/{id}/microsoft.graph.building/map": "least=DelegatedWork,Application", "/places/{id}/microsoft.graph.building/map/footprints/{id}": "least=DelegatedWork,Application", "/places/{id}/microsoft.graph.building/map/levels/{id}": "least=DelegatedWork,Application", @@ -39687,7 +39484,7 @@ "adminDisplayName": "Read and write all authentication method policies ", "adminDescription": "Allows the app to read and write all authentication method policies for the tenant, without a signed-in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40005,7 +39802,7 @@ "adminDisplayName": "Read and write your organization's conditional access policies", "adminDescription": "Allows the app to read and write your organization's conditional access policies, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40211,7 +40008,7 @@ "adminDisplayName": "Read and write your organization's consent request policy", "adminDescription": "Allows the app to read and write your organization's consent requests policy without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40248,7 +40045,7 @@ "adminDisplayName": "Read and write your organization's cross tenant access policies", "adminDescription": "Allows the app to read and write your organization's cross tenant access policies without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40823,7 +40620,7 @@ "adminDisplayName": "Manage consent and permission grant policies", "adminDescription": "Allows the app to manage policies related to consent and permission grants for applications, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42128,7 +41925,7 @@ "adminDisplayName": "Read and write print jobs", "adminDescription": "Allows the application to read and update the metadata and document content of print jobs without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -43880,7 +43677,6 @@ "/reports/dailyprintusagebyprinter/{id}": "least=DelegatedWork", "/reports/dailyprintusagebyuser": "least=DelegatedWork", "/reports/dailyprintusagebyuser/{id}": "least=DelegatedWork", - "/reports/enforcementNotices": "least=DelegatedWork", "/reports/getapiquota(period={value},servicearea={value},appid={value})": "least=DelegatedWork", "/reports/getgrouparchivedprintjobs": "least=DelegatedWork", "/reports/getgrouparchivedprintjobs(groupid={value},startdatetime={value},enddatetime={value})": "least=DelegatedWork", @@ -44905,8 +44701,6 @@ "/rolemanagement/cloudpc/roledefinitions/{id}": "", "/rolemanagement/devicemanagement/roledefinitions": "", "/rolemanagement/devicemanagement/roledefinitions/{id}": "", - "/rolemanagement/directory/deleteditems/roledefinitions": "least=DelegatedWork,Application", - "/rolemanagement/directory/deleteditems/roledefinitions/{id}": "least=DelegatedWork,Application", "/rolemanagement/directory/resourcenamespaces": "least=DelegatedWork,Application", "/rolemanagement/directory/resourcenamespaces/{id}": "least=DelegatedWork,Application", "/rolemanagement/directory/resourcenamespaces/{id}/resourceactions": "least=DelegatedWork,Application", @@ -45108,13 +44902,13 @@ "userDisplayName": "Read and write directory RBAC settings", "userDescription": "Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, on your behalf. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all directory RBAC settings", "adminDescription": "Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, without a signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45153,7 +44947,6 @@ "paths": { "/administrativeunits/{id}/scopedrolemembers/{id}": "least=DelegatedWork,Application", "/directory/administrativeunits/{id}/scopedrolemembers/{id}": "least=DelegatedWork,Application", - "/rolemanagement/directory/deleteditems/roledefinitions/{id}": "least=DelegatedWork,Application", "/rolemanagement/directory/roleassignments/{id}": "least=DelegatedWork,Application", "/rolemanagement/entitlementmanagement/roleassignments/{id}": "" } @@ -45182,7 +44975,6 @@ "/policies/rolemanagementpolicies/{id}/rules/{id}": "", "/policies/rolemanagementpolicyassignments": "", "/policies/rolemanagementpolicyassignments/{id}": "", - "/rolemanagement/directory/deleteditems/roledefinitions": "", "/rolemanagement/directory/resourcenamespaces": "", "/rolemanagement/directory/resourcenamespaces/{id}": "", "/rolemanagement/directory/resourcenamespaces/{id}/resourceactions": "", @@ -45230,7 +45022,6 @@ ], "paths": { "/directoryroles/roletemplateid={roletemplateid}/members": "least=DelegatedWork,Application", - "/rolemanagement/directory/deleteditems/roledefinitions/{id}/restore": "least=DelegatedWork,Application", "/rolemanagement/directory/roleassignmentschedulerequests/{id}/cancel": "", "/roleManagement/directory/roleEligibilityScheduleRequests/{unifiedRoleEligibilityScheduleRequestId}/cancel": "" } @@ -45264,7 +45055,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "DirectoryPreAuthZReq" + "ownerSecurityGroup": "IdentityReq" } }, "RoleManagement.ReadWrite.Exchange": { @@ -48168,7 +47959,7 @@ "adminDisplayName": "Have full control of all site collections", "adminDescription": "Allows the app to have full control of all site collections without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -48487,7 +48278,7 @@ "adminDisplayName": "Create, edit, and delete items and lists in all site collections", "adminDescription": "Allows the app to create or delete document libraries and lists in all site collections without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -48739,7 +48530,7 @@ "adminDisplayName": "Read items in all site collections ", "adminDescription": "Allows the app to read documents and list items in all site collections without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -49193,7 +48984,7 @@ "adminDisplayName": "Read and write items in all site collections", "adminDescription": "Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -50342,7 +50133,7 @@ "adminDisplayName": "Read and write all Azure AD synchronization data. ", "adminDescription": "Allows the application to configure the Azure AD synchronization service, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -50819,7 +50610,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "TodoOnGraph" + "ownerSecurityGroup": "IdentityReq" } }, "Tasks.Read.Shared": { @@ -51213,7 +51004,7 @@ "adminDisplayName": "Read and write all users' tasks and tasklists", "adminDescription": "Allows the app to create, read, update and delete all users' tasks and task lists in your organization, without a signed-in user", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51352,7 +51143,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "TodoOnGraph" + "ownerSecurityGroup": "IdentityReq" } }, "Tasks.ReadWrite.Shared": { @@ -53248,7 +53039,7 @@ "adminDisplayName": "Allow the Teams app to manage itself and its permission grants in all user accounts", "adminDescription": "Allows a Teams app to read, install, upgrade, and uninstall itself for any user account, without a signed-in user, and manage its permission grants for accessing those specific users' data.", "requiresAdminConsent": true, - "privilegeLevel": 3 + "privilegeLevel": 4 } }, "pathSets": [ @@ -55495,14 +55286,14 @@ ], "paths": { "/chats/{id}/completemigration": "least=Application", - "/chats/{id}/messages": "", + "/chats/{id}/messages": "least=Application", "/chats/{id}/startmigration": "least=Application", "/chats/{id}/unhideChatForAllUsers": "least=Application", "/teams": "", "/teams/{id}/channels": "", "/teams/{id}/channels/{id}/completemigration": "least=Application", - "/teams/{id}/channels/{id}/messages": "", - "/teams/{id}/channels/{id}/messages/{id}/replies": "", + "/teams/{id}/channels/{id}/messages": "least=Application", + "/teams/{id}/channels/{id}/messages/{id}/replies": "least=Application", "/teams/{id}/channels/{id}/startmigration": "least=Application", "/teams/{id}/completemigration": "least=Application", "/users/{id}/teamwork/sections": "", @@ -57695,7 +57486,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "azureaduserentity" + "ownerSecurityGroup": "IdentityReq" } }, "User-OnPremisesSyncBehavior.ReadWrite.All": { @@ -57745,13 +57536,13 @@ "userDisplayName": "Update password profile property and reset password for all users", "userDescription": "Allows the app to update password profile property and reset password for all users, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Update password profile property and reset password for all users", "adminDescription": "Allows the app to update password profile property and reset password for all users, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57780,7 +57571,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "azureaduserentity" + "ownerSecurityGroup": "IdentityReq" } }, "User-Phone.ReadWrite.All": { @@ -57816,7 +57607,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "azureaduserentity" + "ownerSecurityGroup": "IdentityReq" } }, "User.DeleteRestore.All": { @@ -57828,13 +57619,13 @@ "userDisplayName": "Delete and restore user accounts", "userDescription": "Allows the app to delete and restore users' accounts, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Delete and restore user accounts", "adminDescription": "Allows the app to delete and restore users' accounts, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57864,7 +57655,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "azureaduserentity" + "ownerSecurityGroup": "IdentityReq" } }, "User.EnableDisableAccount.All": { @@ -57876,13 +57667,13 @@ "userDisplayName": "Enable and disable user accounts", "userDescription": "Allows the app to enable and disable users' accounts, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Enable and disable user accounts", "adminDescription": "Allows the app to enable and disable users' accounts, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57900,7 +57691,7 @@ } ], "ownerInfo": { - "ownerSecurityGroup": "azureaduserentity" + "ownerSecurityGroup": "IdentityReq" } }, "User.Export.All": { @@ -59207,13 +58998,13 @@ "userDisplayName": "Read and write all users' full profiles", "userDescription": "Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, and read basic company properties, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' full profiles", "adminDescription": "Allows the app to read and update user profiles and read basic company properties without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ diff --git a/permissions/new/provisioningInfo.json b/permissions/new/provisioningInfo.json index 17433049..364f167d 100644 --- a/permissions/new/provisioningInfo.json +++ b/permissions/new/provisioningInfo.json @@ -2455,7 +2455,7 @@ "id": "7bdc421c-99cd-4b67-a749-aa8e92775f7e", "scheme": "DelegatedWork", "environment": "PPE;public", - "isHidden": false, + "isHidden": true, "isEnabled": true, "resourceAppId": "26ec3824-24e6-4a75-a3f1-d614f5121545" }, @@ -2463,7 +2463,7 @@ "id": "b328f35f-712c-40d6-b6b4-95449d77b352", "scheme": "Application", "environment": "PPE;public", - "isHidden": false, + "isHidden": true, "isEnabled": true, "resourceAppId": "26ec3824-24e6-4a75-a3f1-d614f5121545" } @@ -2473,7 +2473,7 @@ "id": "363a0763-d7eb-40bc-9457-6be55acd81e2", "scheme": "DelegatedWork", "environment": "PPE;public", - "isHidden": false, + "isHidden": true, "isEnabled": true, "resourceAppId": "26ec3824-24e6-4a75-a3f1-d614f5121545" }, @@ -2481,7 +2481,7 @@ "id": "57ac77a0-bb98-4ba8-bf9a-7af06dcdcc1f", "scheme": "Application", "environment": "PPE;public", - "isHidden": false, + "isHidden": true, "isEnabled": true, "resourceAppId": "26ec3824-24e6-4a75-a3f1-d614f5121545" } @@ -3070,16 +3070,6 @@ "resourceAppId": "" } ], - "ChannelMessage.Send.All": [ - { - "id": "", - "scheme": "Application", - "environment": "", - "isHidden": true, - "isEnabled": false, - "resourceAppId": "ab3be6b7-f5df-413d-ac2d-abf1e3fd9c0b" - } - ], "ChannelMessage.Send.Group": [ { "id": "3e38d437-815b-4368-9f19-e39dea9a6c7f", @@ -3440,16 +3430,6 @@ "resourceAppId": "" } ], - "ChatMessage.Send.All": [ - { - "id": "", - "scheme": "Application", - "environment": "", - "isHidden": true, - "isEnabled": false, - "resourceAppId": "ab3be6b7-f5df-413d-ac2d-abf1e3fd9c0b" - } - ], "ChatMessage.Send.Chat": [ { "id": "19cbeeb2-02a0-49d7-95cd-ab0841beed7f", @@ -4056,24 +4036,6 @@ "resourceAppId": "6b91db1b-f05b-405a-a0b2-e3f60b28d645" } ], - "CredentialProvenance.ReadWrite.All": [ - { - "id": "", - "scheme": "DelegatedWork", - "environment": "public", - "isHidden": true, - "isEnabled": true, - "resourceAppId": "ea890292-c8c8-4433-b5ea-b09d0668e1a6" - }, - { - "id": "", - "scheme": "Application", - "environment": "public", - "isHidden": true, - "isEnabled": true, - "resourceAppId": "ea890292-c8c8-4433-b5ea-b09d0668e1a6" - } - ], "CrossTenantContentMigration.Read.All": [ { "id": "b85f44c8-673a-4b31-a0c1-3070d0ae487e", @@ -7088,16 +7050,6 @@ "resourceAppId": "00000003-0000-0ff1-ce00-000000000000" } ], - "FileStorageContainerType.ReadPermissions.All": [ - { - "id": "", - "scheme": "Application", - "environment": "public", - "isHidden": true, - "isEnabled": true, - "resourceAppId": "00000003-0000-0ff1-ce00-000000000000" - } - ], "FileStorageContainerType.Manage.All": [ { "id": "8e6ec84c-5fcd-4cc7-ac8a-2296efc0ed9b", @@ -9878,15 +9830,6 @@ "resourceAppId": "" } ], - "MCP.Server.Access": [ - { - "scheme": "DelegatedWork", - "environment": "public", - "isHidden": true, - "isEnabled": false, - "resourceAppId": "e8c77dc2-69b3-43f4-bc51-3213c9d915b4" - } - ], "Member.Read.Group": [ { "id": "0a8ce3c7-89dd-46cf-b2c3-5ef0064437a8", @@ -13138,11 +13081,11 @@ ], "Calls.ReportSyntheticMedia.All": [ { - "id": "050b0d28-840a-4ff6-bdf9-cc6221acbc1f", + "id": "e4d4cb9c-a3d1-425d-90a2-8504eb334d6b", "scheme": "Application", "environment": "public", - "isHidden": false, - "isEnabled": true, + "isHidden": true, + "isEnabled": false, "resourceAppId": "26a18ebc-cdf7-4a6a-91cb-beb352805e81" } ], @@ -20388,14 +20331,6 @@ "isHidden": true, "isEnabled": true, "resourceAppId": "93625bc8-bfe2-437a-97e0-3d0060024faa" - }, - { - "id": "795fc94d-3deb-4632-b1eb-e6d1a5f44918", - "scheme": "Application", - "environment": "public", - "isHidden": true, - "isEnabled": true, - "resourceAppId": "93625bc8-bfe2-437a-97e0-3d0060024faa" } ], "PolicyFiles.Read.All": [