diff --git a/permissions/new/permissions.json b/permissions/new/permissions.json index b992bb1a..d952ad13 100644 --- a/permissions/new/permissions.json +++ b/permissions/new/permissions.json @@ -16,7 +16,7 @@ "adminDisplayName": "Read all access reviews", "adminDescription": "Allows the app to read access reviews, reviewers, decisions and settings in the organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -108,13 +108,13 @@ "userDisplayName": "Manage access reviews that you can access", "userDescription": "Allows the app to read, update and perform action on access reviews, reviewers, decisions and settings that you have access to.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Manage all access reviews", "adminDescription": "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -348,7 +348,7 @@ "adminDisplayName": "Manage access reviews for group and app memberships", "adminDescription": "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization for group and app memberships, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -479,7 +479,7 @@ "adminDisplayName": "Read all administrative units", "adminDescription": "Allows the app to read administrative units and administrative unit membership without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -517,13 +517,13 @@ "userDisplayName": "Read and write administrative units", "userDescription": "Allows the app to create, read, update, and delete administrative units and manage administrative unit membership on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all administrative units", "adminDescription": "Allows the app to create, read, update, and delete administrative units and manage administrative unit membership without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -616,7 +616,7 @@ "adminDisplayName": "Read all agent card manifests in Agent Registry", "adminDescription": "Allows the app to read all agent card manifests in your organization's Agent Registry without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -677,7 +677,7 @@ "adminDisplayName": "Read and write all agent card manifests in Agent Registry", "adminDescription": "Allows the app to read and write to all agent card manifests in your organization's Agent Registry without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -791,7 +791,7 @@ "adminDisplayName": "Read all collections in Agent Registry, except quarantined and global", "adminDescription": "Allows the app to read all collections and their membership in your organization's Agent Registry without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -889,7 +889,7 @@ "adminDisplayName": "Read and write all collections in Agent Registry, except quarantined and global", "adminDescription": "Allows the app to create, read, update, and delete all collections and manage their membership in your organization's Agent Registry without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1168,13 +1168,13 @@ "adminDisplayName": "Create agent identities without an agent blueprint parent", "adminDescription": "Allows the client to create agent identities on behalf of the signed-in user, even if the client is not the parent agent identity blueprint.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Create agent identities without an agent blueprint parent", "adminDescription": "Allows the client to create agent identities without a signed-in user, even if the client is not the parent agent identity blueprint.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -1202,7 +1202,7 @@ "adminDisplayName": "Create and manage agent identities as the parent agent identity blueprint", "adminDescription": "Allows the app to create agent identities as the parent agent identity blueprint and fully manage them, including reading, updating, and deleting, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -1229,13 +1229,13 @@ "adminDisplayName": "Delete and restore agent identities", "adminDescription": "Allows the client to delete and restore agent identities on behalf of the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Delete and restore agent identities", "adminDescription": "Allows the client to delete and restore agent identities without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1275,13 +1275,13 @@ "adminDisplayName": "Enable or disable agent identities", "adminDescription": "Allows the client to enable or disable agent identities on behalf of the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Enable or disable agent identities", "adminDescription": "Allows the client to enable or disable agent identities without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1315,7 +1315,7 @@ "adminDisplayName": "Read all agent identities", "adminDescription": "Allows the app to read all agent identities without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1350,7 +1350,7 @@ "adminDisplayName": "Read and write all agent identities", "adminDescription": "Allows the client to read, update, create, and delete agent identities without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1399,7 +1399,7 @@ "adminDisplayName": "Add or remove sponsors for agent identities", "adminDescription": "Allows the client to add or remove sponsors for agent identities without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1447,7 +1447,7 @@ "adminDisplayName": "Update agent identity blueprint credentials", "adminDescription": "Allows updating agent identity blueprint credentials without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1475,13 +1475,13 @@ "adminDisplayName": "Create agent identity blueprints", "adminDescription": "Allows creating new agent identity blueprints on behalf of the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Create agent identity blueprints", "adminDescription": "Allows creating new agent identity blueprints without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -1509,13 +1509,13 @@ "adminDisplayName": "Delete and restore agent identity blueprints", "adminDescription": "Allows deleting or restoring agent identity blueprints on behalf of the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Delete and restore agent identity blueprints", "adminDescription": "Allows deleting or restoring agent identity blueprints without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1561,7 +1561,7 @@ "adminDisplayName": "Read all agent identity blueprints", "adminDescription": "Allows the client to read all agent identity blueprints without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1596,7 +1596,7 @@ "adminDisplayName": "Read and write all agent identity blueprints", "adminDescription": "Allows the client to read, update, create, and delete agent identity blueprints without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1645,7 +1645,7 @@ "adminDisplayName": "Update agent identity blueprint authorization and authentication properties", "adminDescription": "Allows updating agent identity blueprint authorization and authentication properties without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1679,7 +1679,7 @@ "adminDisplayName": "Update agent identity blueprint branding", "adminDescription": "Allows updating agent identity blueprint branding without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1715,7 +1715,7 @@ "adminDisplayName": "Add or remove sponsors for agent identity blueprints", "adminDescription": "Allows the app to add or remove sponsors for agent identity blueprints without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1755,13 +1755,13 @@ "adminDisplayName": "Create agent identity blueprint principals", "adminDescription": "Allows creating new agent identity blueprint principals on behalf of the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Create agent identity blueprint principals", "adminDescription": "Allows creating new agent identity blueprint principals without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -1789,13 +1789,13 @@ "adminDisplayName": "Delete and restore agent identity blueprint principals", "adminDescription": "Allows deleting or restoring agent identity blueprint principals on behalf of the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Delete and restore agent identity blueprint principals", "adminDescription": "Allows deleting or restoring agent identity blueprint principals without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1835,13 +1835,13 @@ "adminDisplayName": "Enable or disable agent identity blueprint principals", "adminDescription": "Allows enabling or disabling agent identity blueprint principals on behalf of the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Enable or disable agent identity blueprint principals", "adminDescription": "Allows enabling or disabling agent identity blueprint principals without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1875,7 +1875,7 @@ "adminDisplayName": "Read agent identity blueprint principals", "adminDescription": "Allows reading agent identity blueprint principals without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1911,7 +1911,7 @@ "adminDisplayName": "Read and write all agent identity blueprint principals", "adminDescription": "Allows the app to read, update, create, and delete agent identity blueprint principals without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -1956,13 +1956,13 @@ "userDisplayName": "Read and write all agent ID users' full profiles", "userDescription": "Allows the app to create agent users, read and write the full set of profile properties, reports, and managers of agent ID users, delete and restore agent users in your organization, and read basic company properties, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all agent ID users' full profiles", "adminDescription": "Allows the app to create agent users, read and update agent ID user profiles and read basic company properties, delete and restore agent users without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -2444,13 +2444,13 @@ "userDisplayName": "Read and write full profiles of agent ID users under an agent blueprint", "userDescription": "Allows the app to create agent users, read and write the full set of profile properties, reports, and managers of agent ID users in your organization, delete and restore agent users under an agent blueprint, and read basic company properties, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write full profiles of agent ID users under an agent blueprint", "adminDescription": "Allows the app to create agent users, read and update agent ID user profiles, delete and restore agent users under an agent blueprint, and read basic company properties without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -2938,7 +2938,7 @@ "adminDisplayName": "Read all agent instances in Agent Registry", "adminDescription": "Allows the app to read all agent instances and their related collections in your organization's Agent Registry without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -3022,7 +3022,7 @@ "adminDisplayName": "Read and write all agent instances in Agent Registry", "adminDescription": "Allows the app to create, read, update, and delete all agent instances in your organization's Agent Registry without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -3186,7 +3186,7 @@ "adminDisplayName": "Read all agent registrations", "adminDescription": "Allows the app to read agent registration information without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -3222,7 +3222,7 @@ "adminDisplayName": "Read and write all agent registrations", "adminDescription": "Allows the app to read and write agent registration information without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -3450,7 +3450,7 @@ "adminDisplayName": "Read all AI enterprise interactions.", "adminDescription": "Allows the app to read all AI enterprise interactions.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -3522,13 +3522,13 @@ "userDisplayName": "Read and write API connectors for authentication flows", "userDescription": "Allows the app to read, create and manage the API connectors used in user authentication flows, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write API connectors for authentication flows", "adminDescription": "Allows the app to read, create and manage the API connectors used in user authentication flows, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -3591,7 +3591,7 @@ "adminDisplayName": "Read all app catalogs", "adminDescription": "Allows the app to read apps in the app catalogs without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -3632,7 +3632,7 @@ "adminDisplayName": "Read and write to all app catalogs", "adminDescription": "Allows the app to create, read, update, and delete apps in the app catalogs without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -3765,7 +3765,7 @@ "adminDisplayName": "Read the trusted certificate authority configuration for applications", "adminDescription": "Allows the app to read the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -3804,7 +3804,7 @@ "adminDisplayName": "Read and write the trusted certificate authority configuration for applications", "adminDescription": "Allows the app to create, read, update and delete the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -3870,7 +3870,7 @@ "adminDisplayName": "Read and write the remote desktop security configuration for all apps", "adminDescription": "Allows the app to read and write the remote desktop security configuration for all apps in your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -3921,7 +3921,7 @@ "adminDisplayName": "Read all applications", "adminDescription": "Allows the app to read all applications and service principals without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -4128,7 +4128,7 @@ "userDisplayName": "Read and write applications", "userDescription": "Allows the app to create, read, update and delete applications and service principals on your behalf. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "DelegatedPersonal": { "adminDisplayName": "Read and write all applications", @@ -4136,13 +4136,13 @@ "userDisplayName": "Read and write applications", "userDescription": "Allows the app to create, read, update and delete applications and service principals on your behalf. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all applications", "adminDescription": "Allows the app to create, read, update and delete applications and service principals without a signed-in user. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -4568,7 +4568,7 @@ "adminDisplayName": "Manage apps that this app creates or owns", "adminDescription": "Allows the app to create other applications, and fully manage those applications (read, update, update application secrets and delete), without a signed-in user. It cannot update any apps that it is not an owner of.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -4845,13 +4845,13 @@ "userDisplayName": "Register new applications", "userDescription": "Allows the app to create new registrations for applications on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Register new applications", "adminDescription": "Allows the app to create new registrations for applications without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -4881,13 +4881,13 @@ "userDisplayName": "Manage app permission grants and app role assignments", "userDescription": "Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Manage app permission grants and app role assignments", "adminDescription": "Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5021,7 +5021,7 @@ "adminDisplayName": "Read approvals data with a subscription.", "adminDescription": "Allows the app to read approvals event information for all users in your organization without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -5095,7 +5095,7 @@ "adminDisplayName": "Read approvals data and create, update, or remove approval item subscriptions.", "adminDescription": "Allows the app to read approvals event information for all users in your organization without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -5176,7 +5176,7 @@ "adminDisplayName": "Read attack simulation data of an organization", "adminDescription": "Allows the app to read attack simulation and training data for an organization without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5246,7 +5246,7 @@ "adminDisplayName": "Read, create, and update all attack simulation data of an organization", "adminDescription": "Allows the app to read, create, and update attack simulation and training data for an organization without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5371,7 +5371,7 @@ "adminDisplayName": "Read all audit log data", "adminDescription": "Allows the app to read and query your audit log activities, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5437,13 +5437,13 @@ "userDisplayName": "Read audit logs data from Dynamics CRM workload", "userDescription": "Allows the app to read and query audit logs from Dynamics CRM workload, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read audit logs data from Dynamics CRM service", "adminDescription": "Allows the app to read and query audit logs from Dynamics CRM service.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5487,13 +5487,13 @@ "userDisplayName": "Read audit logs data from Endpoint Data Loss Prevention workload", "userDescription": "Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, on your behalf", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read audit logs data from Endpoint Data Loss Prevention workload", "adminDescription": "Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5537,13 +5537,13 @@ "userDisplayName": "Read audit logs data from Entra service", "userDescription": "Allows the app to read and query audit logs from Entra service, on behalf of you.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read audit logs data from Entra service", "adminDescription": "Allows the app to read and query audit logs from Entra service.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5587,13 +5587,13 @@ "userDisplayName": "Read audit logs data from Exchange workload", "userDescription": "Allows the app to read and query audit logs from Exchange workload, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read audit logs data from Exchange service", "adminDescription": "Allows the app to read and query audit logs from Exchange service.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5637,13 +5637,13 @@ "userDisplayName": "Read audit logs data from OneDrive workload", "userDescription": "Allows the app to read and query audit logs from OneDrive workload, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read audit logs data from OneDrive service", "adminDescription": "Allows the app to read and query audit logs from OneDrive service.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5687,13 +5687,13 @@ "userDisplayName": "Read audit logs data from SharePoint workload", "userDescription": "Allows the app to read and query audit logs from SharePoint workload, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read audit logs data from SharePoint service", "adminDescription": "Allows the app to read and query audit logs from SharePoint service.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5737,13 +5737,13 @@ "userDisplayName": "Read audit logs data from all services", "userDescription": "Allows the app to read and query audit logs from all services, on your behalf", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read audit logs data from all services", "adminDescription": "Allows the app to read and query audit logs from all services.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5793,7 +5793,7 @@ "adminDisplayName": "Read all authentication context information", "adminDescription": "Allows the app to read the authentication context information in your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5824,13 +5824,13 @@ "userDisplayName": "Read and write all authentication context information", "userDescription": "Allows the app to read and update all authentication context information in your organization on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all authentication context information", "adminDescription": "Allows the app to read and update the authentication context information in your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -5892,7 +5892,7 @@ "adminDisplayName": "Read backup configuration policies", "adminDescription": "Allows the app to read all backup configurations, and lists of Microsoft 365 service resources to be backed up, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -6086,7 +6086,7 @@ "adminDisplayName": "Read and edit backup configuration policies", "adminDescription": "Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed up, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -6365,7 +6365,7 @@ "adminDisplayName": "Read the status of the M365 backup service", "adminDescription": "Allows the app to read the status of M365 backup service (enable/disable), without signed in user", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -6424,7 +6424,7 @@ "adminDisplayName": "Update or read the status of the M365 backup service", "adminDescription": "Allows the app to update or read the status of M365 backup service (enable/disable), without signed in user", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -6553,7 +6553,7 @@ "adminDisplayName": "Read all restore sessions", "adminDescription": "Allows the app to read all restore sessions, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -6632,7 +6632,7 @@ "adminDisplayName": "Read restore all sessions and start restore sessions from backups", "adminDescription": "Allows the app to restore Microsoft 365 resources from a backed up snapshot, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -6749,7 +6749,7 @@ "adminDisplayName": "Search for metadata properties in all backup snapshots", "adminDescription": "Allows the app to search all backup snapshots for Microsoft 365 resources, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -6827,13 +6827,13 @@ "userDisplayName": "Read your BitLocker keys", "userDescription": "Allows the app to read BitLocker keys for your owned devices. Allows read of the recovery key.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read all BitLocker keys", "adminDescription": "Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -6870,7 +6870,7 @@ "adminDisplayName": "Read all BitLocker keys basic information", "adminDescription": "Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -6907,7 +6907,7 @@ "adminDisplayName": "Manage bookings information", "adminDescription": "Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -7080,7 +7080,7 @@ "adminDisplayName": "Read all Bookings related resources.", "adminDescription": "Allows an app to read Bookings appointments, businesses, customers, services, and staff without a signed-in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -7184,7 +7184,7 @@ "adminDisplayName": "Read and write bookings information", "adminDescription": "Allows an app to read and write bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user. Does not allow create, delete and publish of booking businesses.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -7331,7 +7331,7 @@ "adminDisplayName": "Read and write all Bookings related resources.", "adminDescription": "Allows an app to read and write Bookings appointments and customers, and additionally allows reading businesses, services, and staff without a signed-in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -7520,7 +7520,7 @@ "adminDisplayName": "Read all browser site lists for your organization", "adminDescription": "Allows an app to read all browser site lists configured for your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -7561,7 +7561,7 @@ "adminDisplayName": "Read and write all browser site lists for your organization", "adminDescription": "Allows an app to read and write all browser site lists configured for your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -7666,7 +7666,7 @@ "adminDisplayName": "Read all business scenario configurations this app creates or owns", "adminDescription": "Allows the app to read the configurations of business scenarios it owns, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -7794,7 +7794,7 @@ "adminDisplayName": "Read and write all business scenario configurations this app creates or owns", "adminDescription": "Allows the app to create new business scenarios and fully manage the configurations of scenarios it owns, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -7888,7 +7888,7 @@ "adminDisplayName": "Read data for all business scenarios this app creates or owns", "adminDescription": "Allows the app to read the data associated with the business scenarios it owns, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -7937,7 +7937,7 @@ "adminDisplayName": "Read and write data for all business scenarios this app creates or owns", "adminDescription": "Allows the app to fully manage the data associated with the business scenarios it owns, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -8008,7 +8008,7 @@ "adminDisplayName": "Read calendars in all mailboxes", "adminDescription": "Allows the app to read events of all calendars without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -8352,7 +8352,7 @@ "adminDisplayName": "Read basic details of calendars in all mailboxes ", "adminDescription": "Allows the app to read events of all calendars, except for properties such as body, attachments, and extensions, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -8383,7 +8383,7 @@ "adminDisplayName": "Read and write calendars in all mailboxes", "adminDescription": "Allows the app to create, read, update, and delete events of all calendars without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -8779,7 +8779,7 @@ "adminDisplayName": "Read delegation settings", "adminDescription": "Allows the app to read delegation settings of you", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -8881,7 +8881,7 @@ "adminDisplayName": "Read and write delegation settings", "adminDescription": "Allows the app to read and write delegation settings of you", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -8944,7 +8944,7 @@ "adminDisplayName": "Read all emergency call events", "adminDescription": "Allows the app to read emergency call event information for all users in your organization without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -8976,7 +8976,7 @@ "adminDisplayName": "Read all call events", "adminDescription": "Allows the app to read call event information for all users in your organization without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -8991,7 +8991,7 @@ "adminDisplayName": "Read PSTN and direct routing call log data", "adminDescription": "Allows the app to read all PSTN and direct routing call log data without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9030,7 +9030,7 @@ "adminDisplayName": "Read all recordings of calls.", "adminDescription": "Allows the app to read all recordings of all calls, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9076,7 +9076,7 @@ "adminDisplayName": "Read all call records", "adminDescription": "Allows the app to read call records for all calls and online meetings without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9109,7 +9109,7 @@ "adminDisplayName": "Access media streams in a call as an app", "adminDescription": "Allows the app to get direct access to media streams in a call, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9196,7 +9196,7 @@ "adminDisplayName": "Initiate outgoing 1 to 1 calls from the app", "adminDescription": "Allows the app to place outbound calls to a single user and transfer calls to users in your organization's directory, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9264,7 +9264,7 @@ "adminDisplayName": "Initiate outgoing group calls from the app", "adminDescription": "Allows the app to place outbound calls to multiple users and add participants to meetings in your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9337,7 +9337,7 @@ "adminDisplayName": "Join group calls and meetings as an app", "adminDescription": "Allows the app to join group calls and scheduled meetings in your organization, without a signed-in user. The app will be joined with the privileges of a directory user to meetings in your organization.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9352,6 +9352,7 @@ "/app/calls": "", "/app/calls/{id}/addlargegalleryview": "", "/app/calls/{id}/answer": "least=Application", + "/app/calls/{id}/lowerHand": "", "/app/calls/{id}/participants/{id}/admitFromLobby": "", "/app/calls/{id}/participants/{id}/lowerHand": "", "/app/calls/{id}/participants/{id}/mute": "least=Application", @@ -9361,6 +9362,7 @@ "/app/calls/{id}/participants/configuremixer": "", "/app/calls/{id}/participants/lowerAllHands": "", "/app/calls/{id}/participants/muteall": "least=Application", + "/app/calls/{id}/raiseHand": "", "/app/calls/{id}/startRecording": "least=Application", "/app/calls/{id}/startTranscription": "least=Application", "/app/calls/{id}/stopRecording": "least=Application", @@ -9369,6 +9371,7 @@ "/communications/calls": "", "/communications/calls/{id}/addlargegalleryview": "", "/communications/calls/{id}/answer": "least=Application", + "/communications/calls/{id}/lowerHand": "", "/communications/calls/{id}/participants/{id}/admitFromLobby": "", "/communications/calls/{id}/participants/{id}/lowerHand": "", "/communications/calls/{id}/participants/{id}/mute": "least=Application", @@ -9380,6 +9383,7 @@ "/communications/calls/{id}/participants/configuremixer": "", "/communications/calls/{id}/participants/lowerAllHands": "", "/communications/calls/{id}/participants/muteall": "least=Application", + "/communications/calls/{id}/raiseHand": "", "/communications/calls/{id}/startRecording": "least=Application", "/communications/calls/{id}/startTranscription": "least=Application", "/communications/calls/{id}/stopRecording": "least=Application", @@ -9476,6 +9480,7 @@ "POST" ], "paths": { + "/app/calls/{id}/lowerHand": "least=Application", "/app/calls/{id}/participants/{id}/admitFromLobby": "least=Application", "/app/calls/{id}/participants/{id}/lowerHand": "least=Application", "/app/calls/{id}/participants/{id}/mute": "", @@ -9485,6 +9490,8 @@ "/app/calls/{id}/participants/configuremixer": "", "/app/calls/{id}/participants/lowerAllHands": "least=Application", "/app/calls/{id}/participants/muteall": "", + "/app/calls/{id}/raiseHand": "least=Application", + "/communications/calls/{id}/lowerHand": "least=Application", "/communications/calls/{id}/participants/{id}/admitFromLobby": "least=Application", "/communications/calls/{id}/participants/{id}/lowerHand": "least=Application", "/communications/calls/{id}/participants/{id}/mute": "", @@ -9495,7 +9502,8 @@ "/communications/calls/{id}/participants/admitAllFromLobby": "least=Application", "/communications/calls/{id}/participants/configuremixer": "", "/communications/calls/{id}/participants/lowerAllHands": "least=Application", - "/communications/calls/{id}/participants/muteall": "" + "/communications/calls/{id}/participants/muteall": "", + "/communications/calls/{id}/raiseHand": "least=Application" } } ], @@ -9508,7 +9516,7 @@ "adminDisplayName": "Join group calls and meetings as a guest", "adminDescription": "Allows the app to anonymously join group calls and scheduled meetings in your organization, without a signed-in user. The app will be joined as a guest to meetings in your organization.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9574,6 +9582,34 @@ "ownerSecurityGroup": "TeamsPermissions" } }, + "Calls.ReportSyntheticMedia.All": { + "authorizationType": "oAuth2", + "schemes": { + "Application": { + "adminDisplayName": "Report synthetic media detections in calls", + "adminDescription": "Allows the app to report synthetic media detections for participants in calls, without a signed-in user.", + "requiresAdminConsent": true, + "privilegeLevel": 3 + } + }, + "pathSets": [ + { + "schemeKeys": [ + "Application" + ], + "methods": [ + "POST" + ], + "paths": { + "/app/calls/{id}/participants/{id}/reportsyntheticmedia": "least=Application", + "/communications/calls/{id}/participants/{id}/reportsyntheticmedia": "least=Application" + } + } + ], + "ownerInfo": { + "ownerSecurityGroup": "RtsAvengersSG" + } + }, "CallTranscripts.Read.All": { "authorizationType": "oAuth2", "schemes": { @@ -9589,7 +9625,7 @@ "adminDisplayName": "Read all transcripts of calls.", "adminDescription": "Allows the app to read all transcripts of all calls, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9687,7 +9723,7 @@ "adminDisplayName": "Create channels", "adminDescription": "Create channels in any team, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9750,7 +9786,7 @@ "adminDisplayName": "Delete channels", "adminDescription": "Delete channels in any team, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9814,7 +9850,7 @@ "adminDisplayName": "Read the names and descriptions of all channels", "adminDescription": "Read all channel names and channel descriptions, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9833,6 +9869,17 @@ "/teams/{id}/incomingchannels": "least=DelegatedWork,Application", "/teams/{id}/primarychannel": "least=DelegatedWork" } + }, + { + "schemeKeys": [ + "Application" + ], + "methods": [ + "GET" + ], + "paths": { + "/teams/{id}/deletedchannels": "least=Application" + } } ], "ownerInfo": { @@ -9854,7 +9901,7 @@ "adminDisplayName": "Read the members of all channels", "adminDescription": "Read the members of all channels, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9913,7 +9960,7 @@ "adminDisplayName": "Read the members of channels of a team", "adminDescription": "Read the members of channels of a team, without a signed-in user", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -9975,13 +10022,13 @@ "userDisplayName": "Add and remove members from teams and channels", "userDescription": "Add and remove members from channels, on your behalf. Also allows changing a member's role, for example from owner to non-owner.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Add and remove members from all channels", "adminDescription": "Add and remove members from all channels, without a signed-in user. Also allows changing a member's role, for example from owner to non-owner.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -10079,7 +10126,7 @@ "adminDisplayName": "Read and write the members of channels of a team", "adminDescription": "Read and write the members of channels of a team, without a signed-in user", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -10172,7 +10219,7 @@ "adminDisplayName": "Read all channel messages", "adminDescription": "Allows the app to read all channel messages in Microsoft Teams", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -10334,7 +10381,7 @@ "adminDisplayName": "Flag channel messages for violating policy", "adminDescription": "Allows the app to update Microsoft Teams channel messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -10372,7 +10419,7 @@ "adminDisplayName": "Read the names, descriptions, and settings of all channels", "adminDescription": "Read all channel names, channel descriptions, and channel settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -10435,13 +10482,13 @@ "userDisplayName": "Read and write the names, descriptions, and settings of channels", "userDescription": "Read and write the names, descriptions, and settings of all channels, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write the names, descriptions, and settings of all channels", "adminDescription": "Read and write the names, descriptions, and settings of all channels, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -10558,7 +10605,7 @@ "adminDisplayName": "Create chats", "adminDescription": "Allows the app to create chats without a signed-in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -10665,7 +10712,7 @@ "adminDisplayName": "Delete and recover deleted chats", "adminDescription": "Allows the app to delete and recover deleted chats, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -10717,7 +10764,7 @@ "adminDisplayName": "Delete and recover deleted chat", "adminDescription": "Allows the app to delete and recover deleted chat, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -10828,7 +10875,7 @@ "adminDisplayName": "Read all chat messages", "adminDescription": "Allows the app to read all 1-to-1 or group chat messages in Microsoft Teams.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -10878,7 +10925,7 @@ "adminDisplayName": "Read all chat messages for chats where the associated Teams application is installed.", "adminDescription": "Allows the app to read all one-to-one or group chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -10933,7 +10980,7 @@ "adminDisplayName": "Read names and members of all chat threads", "adminDescription": "Read names and members of all one-to-one and group chats in Microsoft Teams, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -10971,7 +11018,7 @@ "adminDisplayName": "Read names and members of all chat threads where the associated Teams application is installed.", "adminDescription": "Allows the app to read names and members of all one-to-one and group chats in Microsoft Teams where the associated Teams application is installed, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -11101,13 +11148,13 @@ "adminDisplayName": "Read and write all chat messages", "adminDescription": "Allows an app to read and write all chat messages in Microsoft Teams, on behalf of the signed-in user.", "requiresAdminConsent": false, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all chat messages", "adminDescription": "Allows an app to read and write all chat messages in Microsoft Teams, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -11201,7 +11248,7 @@ "adminDisplayName": "Read and write all chat messages for chats where the associated Teams application is installed.", "adminDescription": "Allows the app to read and write all chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -11216,7 +11263,7 @@ "adminDisplayName": "Flag chat messages for violating policy", "adminDescription": "Allows the app to update Microsoft Teams 1-to-1 or group chat messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -11275,7 +11322,7 @@ "adminDisplayName": "Read the members of all chats", "adminDescription": "Read the members of all chats, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -11335,7 +11382,7 @@ "adminDisplayName": "Read the members of all chats where the associated Teams application is installed.", "adminDescription": "Allows the app to read the members of all chats where the associated Teams application is installed, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -11404,7 +11451,7 @@ "adminDisplayName": "Add and remove members from all chats", "adminDescription": "Add and remove members from all chats, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -11456,7 +11503,7 @@ "adminDisplayName": "Add and remove members from all chats where the associated Teams application is installed.", "adminDescription": "Allows the app to add and remove members from all chats where the associated Teams application is installed, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -11471,7 +11518,7 @@ "adminDisplayName": "Read all chat messages", "adminDescription": "Allows the app to read all one-to-one and group chats messages in Microsoft Teams, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -11646,13 +11693,13 @@ "userDisplayName": "Read discovered cloud application data", "userDescription": "Allows the app to read details of discovered cloud apps in the organization, on your behalf.", "requiresAdminConsent": false, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read all discovered cloud applications data", "adminDescription": "Allows the app to read all details of discovered cloud apps in the organization, without a signed-in user.", "requiresAdminConsent": false, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -11689,7 +11736,7 @@ "adminDisplayName": "Read Cloud PCs", "adminDescription": "Allows the app to read the properties of Cloud PCs, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -11820,7 +11867,9 @@ "/devicemanagement/virtualendpoint/reports/getdailyaggregatedremoteconnectionreports": "least=DelegatedWork,Application", "/devicemanagement/virtualendpoint/reports/getremoteconnectionhistoricalreports": "least=DelegatedWork,Application", "/devicemanagement/virtualendpoint/reports/getshareduselicenseusagereport": "least=DelegatedWork,Application", - "/devicemanagement/virtualendpoint/reports/gettotalaggregatedremoteconnectionreports": "least=DelegatedWork,Application" + "/devicemanagement/virtualendpoint/reports/gettotalaggregatedremoteconnectionreports": "least=DelegatedWork,Application", + "/deviceManagement/virtualEndpoint/reports/retrieveCloudPcPerformanceMetricsReport": "least=DelegatedWork,Application", + "/deviceManagement/virtualEndpoint/reports/retrieveCloudPcTroubleshootReports": "least=DelegatedWork,Application" } } ], @@ -11843,7 +11892,7 @@ "adminDisplayName": "Read and write Cloud PCs", "adminDescription": "Allows the app to read and write the properties of Cloud PCs, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -11941,8 +11990,9 @@ "/devicemanagement/virtualendpoint/reports/getremoteconnectionhistoricalreports": "", "/devicemanagement/virtualendpoint/reports/getshareduselicenseusagereport": "", "/devicemanagement/virtualendpoint/reports/gettotalaggregatedremoteconnectionreports": "", + "/deviceManagement/virtualEndpoint/reports/retrieveCloudPcPerformanceMetricsReport": "", "/deviceManagement/virtualEndpoint/reports/retrieveCloudPcRecommendationReports": "least=DelegatedWork,Application", - "/deviceManagement/virtualEndpoint/reports/retrieveCloudPcTroubleshootReports": "least=DelegatedWork,Application", + "/deviceManagement/virtualEndpoint/reports/retrieveCloudPcTroubleshootReports": "", "/devicemanagement/virtualendpoint/settingprofiles/{id}/assign": "least=DelegatedWork,Application", "/devicemanagement/virtualendpoint/settingprofiles/reorder": "least=DelegatedWork,Application", "/devicemanagement/virtualendpoint/settingprofiles/uploadimage": "least=DelegatedWork,Application", @@ -12153,7 +12203,7 @@ "adminDisplayName": "Read all Viva Engage communities", "adminDescription": "Allows the app to list Viva Engage communities, and to read their properties without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -12192,7 +12242,7 @@ "adminDisplayName": "Read and write all Viva Engage communities", "adminDescription": "Allows the app to create Viva Engage communities, read all community properties, update community properties, and delete communities without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -12267,7 +12317,7 @@ "adminDisplayName": "Read all Configuration Monitoring entities", "adminDescription": "Allows the app to read all Configuration Monitoring entities, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -12347,13 +12397,13 @@ "userDisplayName": "Read and write all Configuration Monitoring entities", "userDescription": "Allows the app to read and write all Configuration Monitoring entities on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all Configuration Monitoring entities", "adminDescription": "Allows the app to read and write all Configuration Monitoring entities, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -12503,7 +12553,7 @@ "adminDisplayName": "Read all consent requests", "adminDescription": "Allows the app to read consent requests and approvals without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -12538,13 +12588,13 @@ "userDisplayName": "Read and write consent requests", "userDescription": "Allows the app to read app consent requests for your approval, and deny or approve those request on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all consent requests", "adminDescription": "Allows the app to read app consent requests and approvals, and deny or approve those requests without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -12585,7 +12635,7 @@ "adminDisplayName": "Read and update the on-premises sync behavior of contacts", "adminDescription": "Allows the app to update the on-premises sync behavior of all contacts in all mailboxes without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -12633,7 +12683,7 @@ "adminDisplayName": "Read contacts in all mailboxes", "adminDescription": "Allows the app to read all contacts in all mailboxes without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -12747,7 +12797,7 @@ "adminDisplayName": "Read and write contacts in all mailboxes", "adminDescription": "Allows the app to create, read, update, and delete all contacts in all mailboxes without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -12916,7 +12966,7 @@ "adminDisplayName": "Process content for data security, governance and compliance", "adminDescription": "Allows the app to process and evaluate content for data security, governance and compliance outcomes at tenant scope.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13068,7 +13118,7 @@ "adminDisplayName": "Read all packages information", "adminDescription": "Allows the app to read packages information without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13105,7 +13155,7 @@ "adminDisplayName": "Read and update all packages information", "adminDescription": "Allows the app to read and update packages information without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13182,7 +13232,7 @@ "adminDisplayName": "Read Copilot policy settings", "adminDescription": "Allows the app to read Copilot policy settings for the organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13218,7 +13268,7 @@ "adminDisplayName": "Read and write Copilot policy settings", "adminDescription": "Allows the app to read and write Copilot policy settings for the organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13354,7 +13404,7 @@ "adminDisplayName": "Read cross-tenant basic information", "adminDescription": "Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13425,7 +13475,7 @@ "userDisplayName": "Read any shared cross-tenant user profiles and export data", "userDescription": "Allows the application to list and query any shared user profile information associated with the current tenant on your behalf. It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "DelegatedPersonal": { "adminDisplayName": "Read all shared cross-tenant user profiles and export their data", @@ -13433,13 +13483,13 @@ "userDisplayName": "Read any shared cross-tenant user profiles and export data", "userDescription": "Allows the application to list and query any shared user profile information associated with the current tenant on your behalf. It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read all shared cross-tenant user profiles and export their data", "adminDescription": "Allows the application to list and query any shared user profile information associated with the current tenant without a signed-in user. It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13529,13 +13579,13 @@ "userDisplayName": "Read any shared cross-tenant user profiles and export or delete data", "userDescription": "Allows the application to list and query any shared user profile information associated with the current tenant on your behalf. It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read all shared cross-tenant user profiles and export or delete their data", "adminDescription": "Allows the application to list and query any shared user profile information associated with the current tenant without a signed-in user. It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13589,7 +13639,7 @@ "adminDisplayName": "Read all identity custom authentication extensions", "adminDescription": "Allows the app to read your organization's custom authentication extnesions, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13639,7 +13689,7 @@ "adminDisplayName": "Read and write all identity custom authentication extensions", "adminDescription": "Allows the app to read and write your organization's custom authentication extnesions, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13703,7 +13753,7 @@ "adminDisplayName": "Read all custom detection rules", "adminDescription": "Allows the app to read custom detection rules without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13740,7 +13790,7 @@ "adminDisplayName": "Read and write all custom detection rules", "adminDescription": "Allows the app to read and write custom detection rules without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13780,7 +13830,7 @@ "adminDisplayName": "Read custom security attribute assignments", "adminDescription": "Allows the app to read custom security attribute assignments for all principals in the tenant without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -13797,13 +13847,13 @@ "userDisplayName": "Read and write custom security attribute assignments", "userDescription": "Allows the app to read and write custom security attribute assignments for all principals in the tenant on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write custom security attribute assignments", "adminDescription": "Allows the app to read and write custom security attribute assignments for all principals in the tenant without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -13826,7 +13876,7 @@ "adminDisplayName": "Read all custom security attribute audit logs", "adminDescription": "Allows the app to read all audit logs for events that contain information about custom security attributes, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13863,7 +13913,7 @@ "adminDisplayName": "Read custom security attribute definitions", "adminDescription": "Allows the app to read custom security attribute definitions for the tenant without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13898,13 +13948,13 @@ "userDisplayName": "Read and write custom security attribute definitions", "userDescription": "Allows the app to read and write custom security attribute definitions for the tenant on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write custom security attribute definitions", "adminDescription": "Allows the app to read and write custom security attribute definitions for the tenant without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -13952,13 +14002,13 @@ "userDisplayName": "Read the provisioning configuration of all active custom security attributes", "userDescription": "Allows the app to read the provisioning configuration of all active custom security attributes on behalf of a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read the provisioning configuration of all active custom security attributes", "adminDescription": "Allows the app to read the provisioning configuration of all active custom security attributes without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -13988,13 +14038,13 @@ "userDisplayName": "Read and edit the provisioning configuration of all active custom security attributes", "userDescription": "Allows the app to read and edit the provisioning configuration of all active custom security attributes on behalf of a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and edit the provisioning configuration of all active custom security attributes", "adminDescription": "Allows the app to read and edit the provisioning configuration of all active custom security attributes without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -14043,7 +14093,7 @@ "adminDisplayName": "Read all custom tags data", "adminDescription": "Read custom tags data, without a signed-in user", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -14080,7 +14130,7 @@ "adminDisplayName": "Read and write custom tags data", "adminDescription": "Read and write custom tags data, without a signed-in user", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -14131,7 +14181,7 @@ "adminDisplayName": "Read Delegated Admin relationships with customers", "adminDescription": "Allows the app to read details of delegated admin relationships with customers like access details (that includes roles) and the duration as well as specific role assignments to security groups without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -14171,13 +14221,13 @@ "userDisplayName": "Manage Delegated Admin relationships with customers", "userDescription": "Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers and role assignments to security groups for active Delegated Admin relationships on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Manage Delegated Admin relationships with customers", "adminDescription": "Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers and role assignments to security groups for active Delegated Admin relationships without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -14242,13 +14292,13 @@ "userDisplayName": "Manage all delegated permission grants", "userDescription": "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), on your behalf. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Manage all delegated permission grants", "adminDescription": "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -14384,7 +14434,7 @@ "userDisplayName": "Create a device from a device template you own.", "userDescription": "Allows the app to create a device from a device template you own.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -14689,13 +14739,13 @@ "userDisplayName": "Read device local credential passwords", "userDescription": "Allows the app to read device local credential properties including passwords, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read device local credential passwords", "adminDescription": "Allows the app to read device local credential properties including passwords, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -14732,7 +14782,7 @@ "adminDisplayName": "Read device local credential properties", "adminDescription": "Allows the app to read device local credential properties excluding passwords, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -14768,7 +14818,7 @@ "adminDisplayName": "Read Microsoft Intune apps", "adminDescription": "Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -15020,13 +15070,13 @@ "userDisplayName": "Read and write Microsoft Intune apps", "userDescription": "Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write Microsoft Intune apps", "adminDescription": "Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -15348,13 +15398,13 @@ "userDisplayName": "Read Microsoft Cloud PKI objects", "userDescription": "Allows the app to read certification authority information on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read Microsoft Cloud PKI objects", "adminDescription": "Allows the app to read certification authority information without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -15386,13 +15436,13 @@ "userDisplayName": "Read and write Microsoft Cloud PKI objects", "userDescription": "Allows the app to read and write certification authority information on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write Microsoft Cloud PKI objects", "adminDescription": "Allows the app to read and write certification authority information without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -15461,7 +15511,7 @@ "adminDisplayName": "Read Microsoft Intune device configuration and policies", "adminDescription": "Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -16587,13 +16637,13 @@ "userDisplayName": "Read and write Microsoft Intune Device Configuration and Policies", "userDescription": "Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write Microsoft Intune device configuration and policies", "adminDescription": "Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -17742,13 +17792,13 @@ "userDisplayName": "Perform user-impacting remote actions on Microsoft Intune devices", "userDescription": "Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Perform user-impacting remote actions on Microsoft Intune devices", "adminDescription": "Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -17995,7 +18045,7 @@ "adminDisplayName": "Read Microsoft Intune devices", "adminDescription": "Allows the app to read the properties of devices managed by Microsoft Intune, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -18393,13 +18443,13 @@ "userDisplayName": "Read and write Microsoft Intune devices", "userDescription": "Allows the app to read and write the properties of devices managed by Microsoft Intune. Does not allow high impact operations such as remote wipe and password reset on the device's owner.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write Microsoft Intune devices", "adminDescription": "Allows the app to read and write the properties of devices managed by Microsoft Intune, without a signed-in user. Does not allow high impact operations such as remote wipe and password reset on the device's owner", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -18800,7 +18850,7 @@ "adminDisplayName": "Read Microsoft Intune RBAC settings", "adminDescription": "Allows the app to read the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -18889,13 +18939,13 @@ "userDisplayName": "Read and write Microsoft Intune RBAC settings", "userDescription": "Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write Microsoft Intune RBAC settings", "adminDescription": "Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -19049,7 +19099,7 @@ "adminDisplayName": "Read Microsoft Intune Scripts", "adminDescription": "Allows the app to read Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -19089,13 +19139,13 @@ "userDisplayName": "Read and write Microsoft Intune Scripts", "userDescription": "Allows the app to read and write Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attripute shell scripts and device health scripts.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write Microsoft Intune Scripts", "adminDescription": "Allows the app to read and write Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -19174,7 +19224,7 @@ "adminDisplayName": "Read Microsoft Intune configuration", "adminDescription": "Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -19317,13 +19367,13 @@ "userDisplayName": "Read and write Microsoft Intune configuration", "userDescription": "Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write Microsoft Intune configuration", "adminDescription": "Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -19556,7 +19606,7 @@ "adminDisplayName": "Create device templates.", "adminDescription": "Allows the app to create device templates, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -19592,7 +19642,7 @@ "adminDisplayName": "Read all device templates, their owners, and devices created from those device templates.", "adminDescription": "Allows the app to read device templates, their owners, and devices created from those device templates, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -19631,7 +19681,7 @@ "adminDisplayName": "Read and write all device templates, their owners, and devices created from those device templates.", "adminDescription": "Allows the app to read and write all device templates, their owners, and devices created from those device templates without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -19700,7 +19750,7 @@ "userDisplayName": "Access the directory as you", "userDescription": "Allows the app to have the same access to information in your work or school directory as you do.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -19828,7 +19878,7 @@ "adminDisplayName": "Read directory data", "adminDescription": "Allows the app to read data in your organization's directory, such as users, groups and apps, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -20186,13 +20236,13 @@ "userDisplayName": "Read and write directory data", "userDescription": "Allows the app to read and write data in your organization's directory, such as other users, groups. It does not allow the app to delete users or groups, or reset user passwords but it does allow modification of recovery properties that may lead to account takeover.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write directory data", "adminDescription": "Allows the app to read and write data in your organization's directory, such as users, and groups, without a signed-in user. It does not allow user or group deletion.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -20829,7 +20879,7 @@ "adminDisplayName": "Read all Azure AD recommendations", "adminDescription": "Allows the app to read all Azure AD recommendations, without a signed-in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -20869,7 +20919,7 @@ "adminDisplayName": "Read and update all Azure AD recommendations", "adminDescription": "Allows the app to read and update all Azure AD recommendations, without a signed-in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -20951,7 +21001,7 @@ "adminDisplayName": "Read internal federation configuration for a domain.", "adminDescription": "Allows the app to read internal federation configuration for a domain.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -20982,13 +21032,13 @@ "userDisplayName": "Create, read, update and delete internal federation configuration for a domain.", "userDescription": "Allows the app to create, read, update and delete internal federation configuration for a domain.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Create, read, update and delete internal federation configuration for a domain.", "adminDescription": "Allows the app to create, read, update and delete internal federation configuration for a domain.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -21039,7 +21089,7 @@ "adminDisplayName": "Read domains", "adminDescription": "Allows the app to read all domain properties without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -21076,13 +21126,13 @@ "userDisplayName": "Read and write domains", "userDescription": "Allows the app to read and write all domain properties on your behalf. Also allows the app to add, verify and remove domains.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write domains", "adminDescription": "Allows the app to read and write all domain properties without a signed in user. Also allows the app to add, verify and remove domains.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -21177,7 +21227,7 @@ "adminDisplayName": "Read all eDiscovery objects", "adminDescription": "Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects without the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -21396,7 +21446,7 @@ "adminDisplayName": "Read all eDiscovery objects", "adminDescription": "Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects without the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -21689,7 +21739,7 @@ "adminDisplayName": "Read all class assignments with grades", "adminDescription": "Allows the app to read all class assignments with grades for all users without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -21798,7 +21848,7 @@ "adminDisplayName": "Read all class assignments information without reading any feedback or outcomes", "adminDescription": "Allows the app to read all class assignments information for all users without a signed-in user without reading any feedback or outcomes.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -22036,7 +22086,7 @@ "adminDisplayName": "Create, read, update and delete all class assignments with grades", "adminDescription": "Allows the app to create, read, update and delete all class assignments with grades for all users without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -22318,7 +22368,7 @@ "adminDisplayName": "Create, read, update, and delete all class assignments information without accessing or impacting any feedback or outcomes", "adminDescription": "Allows the app to create, read, update, and delete all class assignments information for all users without a signed-in user without accessing or impacting any feedback or outcomes.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -22437,7 +22487,7 @@ "adminDisplayName": "Read all class modules and resources", "adminDescription": "Allows the app to read all modules and resources, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -22526,7 +22576,7 @@ "adminDisplayName": "Read and write all class modules and resources", "adminDescription": "Allows the app to read and write all modules and resources, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -22583,7 +22633,7 @@ "adminDisplayName": "Read all tenant reading assignments, speaker assignments, and Reading Coach passages data.", "adminDescription": "Allows the app to read all tenant users reading assignments, speaker assignments, and Reading Coach passages data without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -22641,7 +22691,7 @@ "adminDisplayName": "Read all tenant reflect check-ins submissions data", "adminDescription": "Allows the app to read all tenant users reflect check-ins submissions data without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -22730,7 +22780,7 @@ "adminDisplayName": "Read the organization's roster", "adminDescription": "Allows the app to read the structure of schools and classes in the organization's roster and education-specific information about all users to be read.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -22834,7 +22884,7 @@ "adminDisplayName": "Read a limited subset of the organization's roster", "adminDescription": "Allows the app to read a limited subset of properties from both the structure of schools and classes in the organization's roster and education-specific information about all users. Includes name, status, role, email address and photo.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -22865,7 +22915,7 @@ "userDisplayName": "View and modify your school, class and user information", "userDescription": "Allows the app to view and modify information about schools and classes in your organization and education-related information about you and other users on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -22894,7 +22944,7 @@ "adminDisplayName": "Read and write the organization's roster", "adminDescription": "Allows the app to read and write the structure of schools and classes in the organization's roster and education-specific information about all users to be read and written.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -23048,7 +23098,7 @@ "adminDisplayName": "Read and write all Viva Engage conversations", "adminDescription": "Allows the app to create Viva Engage conversations without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -23109,7 +23159,7 @@ "adminDisplayName": "Read all Teams Q\u0026A conversations", "adminDescription": "Allows the app to list Teams Q\u0026A conversations, and to read their properties without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -23174,7 +23224,7 @@ "adminDisplayName": "Read all Viva Engage roles and role memberships", "adminDescription": "Allows the app to list all Viva Engage roles and role memberships without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -23206,13 +23256,13 @@ "userDisplayName": "Modify Viva Engage role membership", "userDescription": "Allows the app to assign Viva Engage role to a user, and remove a Viva Engage role from a user on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Modify Viva Engage role membership", "adminDescription": "Allows the app to assign Viva Engage role to a user, and remove a Viva Engage role from a user without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -23274,7 +23324,7 @@ "adminDisplayName": "Read all entitlement management resources", "adminDescription": "Allows the app to read access packages and related entitlement management resources without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -23412,7 +23462,7 @@ "adminDisplayName": "Read and write all entitlement management resources", "adminDescription": "Allows the app to read and write access packages and related entitlement management resources without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -23732,7 +23782,7 @@ "userDisplayName": "Read Preview jobs and snapshots", "userDescription": "Allows the app to list the all the snapshots, jobs and enumerate the changes of a specific preview job, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read Preview jobs and snapshots", @@ -23740,7 +23790,7 @@ "userDisplayName": "Read Preview jobs and snapshots", "userDescription": "Allows the app to list the all the snapshots, jobs and enumerate the changes of a specific preview job, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -23773,7 +23823,7 @@ "userDisplayName": "Create a preview job, read preview job and snapshots", "userDescription": "Allows the app to list the all the snapshots, create a preview job and enumerate the changes of a specific preview job, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -23802,7 +23852,7 @@ "userDisplayName": "Create preview and recovery job, read recovery job and snapshots", "userDescription": "Allows the app to list the all the snapshots, create a recovery job and enumerate the changes of a specific recovery job, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -23837,7 +23887,7 @@ "adminDisplayName": "Read all identity authentication event listeners", "adminDescription": "Allows the app to read your organization's authentication listeners, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -23891,7 +23941,7 @@ "adminDisplayName": "Read and write all identity authentication event listeners", "adminDescription": "Allows the app to read and write your organization's authentication listeners, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -24023,7 +24073,7 @@ "adminDisplayName": "Search the email message trace", "adminDescription": "Allows the app to search the email message trace, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -24061,7 +24111,7 @@ "adminDisplayName": "Read all external connections", "adminDescription": "Allows the app to read all external connections without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -24100,7 +24150,7 @@ "adminDisplayName": "Read and write all external connections", "adminDescription": "Allows the app to read and write all external connections without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -24190,7 +24240,7 @@ "adminDisplayName": "Read and write external connections", "adminDescription": "Allows the app to read and write external connections without a signed-in user. The app can only read and write external connections that it is authorized to, or it can create new external connections. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -24291,7 +24341,7 @@ "adminDisplayName": "Read all external items", "adminDescription": "Allows the app to read all external items without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -24341,7 +24391,7 @@ "adminDisplayName": "Read and write items in external datasets", "adminDescription": "Allow the app to read or write items in all external datasets that the app is authorized to access", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -24444,7 +24494,7 @@ "adminDisplayName": "Read and write external items", "adminDescription": "Allows the app to read and write external items without a signed-in user. The app can only read external items of the connection that it is authorized to.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -24541,13 +24591,13 @@ "userDisplayName": "Read external user profiles", "userDescription": "Allows the app to read available properties of external user profiles, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read all external user profiles", "adminDescription": "Allows the app to read available properties of external user profiles, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -24578,13 +24628,13 @@ "userDisplayName": "Read and write external user profiles", "userDescription": "Allows the app to read and write available properties of external user profiles, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all external user profiles", "adminDescription": "Allows the app to read and write available properties of external user profiles, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -24651,7 +24701,7 @@ "adminDisplayName": "Ingest SharePoint and OneDrive content to make it available in the search index", "adminDescription": "Allows the app to ingest SharePoint and OneDrive content to make it available in the search index, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -24680,7 +24730,7 @@ "adminDisplayName": "Manage onboarding for a Hybrid Cloud tenant", "adminDescription": "Allows the app to manage onboarding for a Hybrid Cloud tenant, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -25035,7 +25085,7 @@ "adminDisplayName": "Read files in all site collections", "adminDescription": "Allows the app to read all files in all site collections without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -26954,7 +27004,7 @@ "adminDisplayName": "Read and write files in all site collections", "adminDescription": "Allows the app to read, create, update and delete all files in all site collections without a signed in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -27849,7 +27899,7 @@ "userDisplayName": "Manage all file storage containers", "userDescription": "Allows the application to utilize the file storage container administration capabilities on behalf of an administrator user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -28348,13 +28398,13 @@ "userDisplayName": "Read group conversations", "userDescription": "Allows the app to read group conversations that the signed-in user has access to.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read all group conversations", "adminDescription": "Allows the app to read conversations of the groups this app has access to without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -28405,13 +28455,13 @@ "userDisplayName": "Read and write group conversations", "userDescription": "Allows the app to read and write group conversations that the signed-in user has access to.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all group conversations", "adminDescription": "Allows the app to read and write conversations of the groups this app has access to without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -28523,7 +28573,7 @@ "adminDisplayName": "Read and write groups' disableNesting property", "adminDescription": "Allows the app to read and write groups' disableNesting property without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -28573,7 +28623,7 @@ "adminDisplayName": "Read and update the on-premises sync behavior of groups", "adminDescription": "Allows the app to update the on-premises sync behavior of all groups without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -28639,7 +28689,7 @@ "adminDisplayName": "Create groups", "adminDescription": "Allows the app to create groups without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -28675,7 +28725,7 @@ "adminDisplayName": "Manage the Microsoft Information Protection (MIP) label for M365 and security groups.", "adminDescription": "Allows the app to list groups, and to read their basic properties and manage the MIP label for all label enabled groups without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -28724,7 +28774,7 @@ "adminDisplayName": "Read all groups", "adminDescription": "Allows the app to read group properties and memberships, and read conversations for all groups, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -28979,13 +29029,13 @@ "userDisplayName": "Read and write all groups", "userDescription": "Allows the app to create groups and read all group properties and memberships on your behalf. Additionally allows the app to manage your groups and to update group content for groups you are a member of.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all groups", "adminDescription": "Allows the app to create groups, read all group properties and memberships, update group properties and memberships, and delete groups. Also allows the app to read and write conversations. All of these operations can be performed by the app without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -29447,7 +29497,7 @@ "adminDisplayName": "Read all group memberships", "adminDescription": "Allows the app to read memberships and basic group properties for all groups without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -29548,13 +29598,13 @@ "userDisplayName": "Read and write group memberships", "userDescription": "Allows the app to list groups, read basic properties, read and update the membership of your groups. Group properties and owners cannot be updated and groups cannot be deleted.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all group memberships", "adminDescription": "Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -29599,13 +29649,13 @@ "userDisplayName": "Read all group settings that user can access", "userDescription": "Allows the app to read a list of tenant-level or group-specific group settings objects, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read all group settings", "adminDescription": "Allows the app to read a list of tenant-level or group-specific group settings objects, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -29644,13 +29694,13 @@ "userDisplayName": "Read and write all group settings that user can access", "userDescription": "Allows the app to create, read, update, and delete on the list of tenant-level or group-specific group settings objects that you have access to in the organization, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all group settings", "adminDescription": "Allows the app to create, read, update, and delete on the list of tenant-level or group-specific group settings objects, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -29736,7 +29786,7 @@ "adminDisplayName": "Read all scenario health monitoring alerts", "adminDescription": "Allows the app to read all scenario health monitoring alerts, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -29773,7 +29823,7 @@ "adminDisplayName": "Read and write all scenario monitoring alerts", "adminDescription": "Allows the app to read and write all scenario monitoring alerts, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -29810,7 +29860,7 @@ "adminDisplayName": "Read all scenario health monitoring alert configurations", "adminDescription": "Allows the app to read all scenario health monitoring alert configurations, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -29877,7 +29927,7 @@ "adminDisplayName": "Read all identity notification settings and templates", "adminDescription": "Allows the app to read identity notification settings, email templates, and prerequisites without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -29930,7 +29980,7 @@ "adminDisplayName": "Read and write all identity notification settings and templates", "adminDescription": "Allows the app to read and write identity notification settings, customize email templates, and send test emails without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30023,7 +30073,7 @@ "adminDisplayName": "Read identity providers", "adminDescription": "Allows the app to read your organization's identity (authentication) providers' properties without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30061,13 +30111,13 @@ "userDisplayName": "Read and write identity providers", "userDescription": "Allows the app to read and write your organization's identity (authentication) providers' properties on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write identity providers", "adminDescription": "Allows the app to read and write your organization's identity (authentication) providers' properties without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30173,7 +30223,7 @@ "adminDisplayName": "Read all identity risk event information", "adminDescription": "Allows the app to read the identity risk event information for your organization without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30208,7 +30258,7 @@ "adminDisplayName": "Read and write all risk detection information", "adminDescription": "Allows the app to read and update identity risk detection information for your organization without a signed-in user. Update operations include confirming risk event detections. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30246,7 +30296,7 @@ "adminDisplayName": "Read all risky agents information", "adminDescription": "Allows the app to read the risky agents information in your organization without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30277,13 +30327,13 @@ "userDisplayName": "Read and write risky agents information", "userDescription": "Allows the app to read and update identity risky agents information for all agents in your organization on your behalf. Update operations include dismissing risky agents.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write risky agents information", "adminDescription": "Allows the app to read and update risky agents information in your organization without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30321,7 +30371,7 @@ "adminDisplayName": "Read all identity risky service principal information", "adminDescription": "Allows the app to read all risky service principal information for your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30353,13 +30403,13 @@ "userDisplayName": "Read and write all identity risky service principal information", "userDescription": "Allows the app to read and update identity risky service principal information for all service principals in your organization, on your behalf. Update operations include dismissing risky service principals.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all identity risky service principal information", "adminDescription": "Allows the app to read and update identity risky service principal for your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30410,7 +30460,7 @@ "adminDisplayName": "Read all identity risky user information", "adminDescription": "Allows the app to read the identity risky user information for your organization without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30448,13 +30498,13 @@ "userDisplayName": "Read and write identity risky user information", "userDescription": "Allows the app to read and update identity risky user information for all users in your organization on your behalf. Update operations include dismissing risky users.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all risky user information", "adminDescription": "Allows the app to read and update identity risky user information for your organization without a signed-in user. Update operations include dismissing risky users.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30523,7 +30573,7 @@ "adminDisplayName": "Read all identity user flows", "adminDescription": "Allows the app to read your organization's user flows, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30584,7 +30634,7 @@ "adminDisplayName": "Read and write all identity user flows", "adminDescription": "Allows the app to read or write your organization's user flows, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30790,7 +30840,7 @@ "adminDisplayName": "View data connector definitions", "adminDescription": "Allows the app to read data connectors without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30822,13 +30872,13 @@ "userDisplayName": "Manage data connector definitions", "userDescription": "Allows the app to read and write data connectors on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Manage data connector definitions", "adminDescription": "Allows the app to read and write data connectors without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30917,7 +30967,7 @@ "adminDisplayName": "Upload files to a data connector", "adminDescription": "Allows the app to upload data files to a data connector without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -30966,7 +31016,7 @@ "adminDisplayName": "View inbound flow definitions", "adminDescription": "Allows the app to read inbound data flows without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31003,7 +31053,7 @@ "adminDisplayName": "Manage inbound flow definitions", "adminDescription": "Allows the app to read and write inbound data flows without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31052,7 +31102,7 @@ "adminDisplayName": "View outbound flowsets and flows definitions", "adminDescription": "Allows the app to read outbound data flowsets and flows without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31161,7 +31211,7 @@ "adminDisplayName": "View reference definitions", "adminDescription": "Allows the app to read reference definitions without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31196,7 +31246,7 @@ "adminDisplayName": "Manage reference definitions", "adminDescription": "Allows the app to read and write reference definitions without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31247,7 +31297,7 @@ "adminDisplayName": "View current and previous runs", "adminDescription": "Allows the app to read current and previous IndustryData runs without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31285,7 +31335,7 @@ "adminDisplayName": "View and start runs", "adminDescription": "Allows the app to view and start IndustryData runs without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31335,7 +31385,7 @@ "adminDisplayName": "View source system definitions", "adminDescription": "Allows the app to read source system definitions without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31373,7 +31423,7 @@ "adminDisplayName": "Manage source system definitions", "adminDescription": "Allows the app to read and write source system definitions without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31436,7 +31486,7 @@ "adminDisplayName": "Read time period definitions", "adminDescription": "Allows the app to read time period definitions without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31474,7 +31524,7 @@ "adminDisplayName": "Manage time period definitions", "adminDescription": "Allows the app to read and write time period definitions without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31537,7 +31587,7 @@ "adminDisplayName": "View basic service and resource information", "adminDescription": "Allows the app to read basic service and resource information without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31638,7 +31688,7 @@ "adminDisplayName": "Read all published labels and label policies for an organization.", "adminDescription": "Allows an app to read published sensitivity labels and label policy settings for the entire organization or a specific user, without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31714,7 +31764,7 @@ "adminDisplayName": "Read all user metrics insights", "adminDescription": "Allows an app to read all user metrics insights, such as daily and monthly active users, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31791,7 +31841,7 @@ "adminDisplayName": "Read all assignments", "adminDescription": "Allows the app to read data for all assignments in the organization's directory, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31821,7 +31871,7 @@ "adminDisplayName": "Read and write all assignments", "adminDescription": "Allows the app to create, update, read and delete all assignments in the organization's directory, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31891,7 +31941,7 @@ "adminDisplayName": "Read all learning content", "adminDescription": "Allows the app to read all learning content in the organization's directory, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -31929,7 +31979,7 @@ "adminDisplayName": "Manage all learning content", "adminDescription": "Allows the app to manage all learning content in the organization's directory, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32103,7 +32153,7 @@ "adminDisplayName": "Read and write all self-initiated courses", "adminDescription": "Allows the app to create, update, read and delete all self-initiated courses in the organization's directory, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32174,7 +32224,7 @@ "adminDisplayName": "Read all license assignments.", "adminDescription": "Allows an app to read license assignments for users and groups, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32223,7 +32273,7 @@ "adminDisplayName": "Manage all license assignments.", "adminDescription": "Allows an app to manage license assignments for users and groups, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32283,6 +32333,85 @@ "pathSets": [], "ownerInfo": {} }, + "LifecyclePolicies-AgentId.Read.All": { + "authorizationType": "oAuth2", + "schemes": { + "DelegatedWork": { + "adminDisplayName": "Read identity lifecycle policies for agent identities", + "adminDescription": "Allows the app to read identity lifecycle policies for agent identities that the signed-in user has access to in the organization.", + "userDisplayName": "Read identity lifecycle policies for agent identities", + "userDescription": "Allows the app to read identity lifecycle policies for agent identities that you have access to.", + "requiresAdminConsent": true, + "privilegeLevel": 3 + }, + "Application": { + "adminDisplayName": "Read identity lifecycle policies for agent identities", + "adminDescription": "Allows the app to read identity lifecycle policies for agent identities in the organization, without a signed-in user.", + "requiresAdminConsent": true, + "privilegeLevel": 3 + } + }, + "pathSets": [ + { + "schemeKeys": [ + "DelegatedWork", + "Application" + ], + "methods": [ + "GET" + ], + "paths": { + "/identitygovernance/lifecycleworkflows/lifecyclePolicies": "least=DelegatedWork,Application", + "/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}": "least=DelegatedWork,Application", + "/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/complianceRules": "least=DelegatedWork,Application" + } + } + ], + "ownerInfo": { + "ownerSecurityGroup": "aadlcm" + } + }, + "LifecyclePolicies-AgentId.ReadWrite.All": { + "authorizationType": "oAuth2", + "schemes": { + "DelegatedWork": { + "adminDisplayName": "Read and write identity lifecycle policies for agent identities", + "adminDescription": "Allows the app to read, create, update and delete identity lifecycle policies for agent identities that the signed-in user has access to in the organization.", + "userDisplayName": "Read and write identity lifecycle policies for agent identities", + "userDescription": "Allows the app to read, create, update and delete identity lifecycle policies for agent identities that you have access to.", + "requiresAdminConsent": true, + "privilegeLevel": 3 + }, + "Application": { + "adminDisplayName": "Read and write identity lifecycle policies for agent identities", + "adminDescription": "Allows the app to read, create, update and delete identity lifecycle policies for agent identities in the organization, without a signed-in user.", + "requiresAdminConsent": true, + "privilegeLevel": 3 + } + }, + "pathSets": [ + { + "schemeKeys": [ + "DelegatedWork", + "Application" + ], + "methods": [ + "DELETE", + "GET", + "PATCH", + "POST" + ], + "paths": { + "/identitygovernance/lifecycleworkflows/lifecyclePolicies": "least=DelegatedWork,Application", + "/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}": "least=DelegatedWork,Application", + "/identitygovernance/lifecycleworkflows/lifecyclePolicies/{id}/complianceRules": "least=DelegatedWork,Application" + } + } + ], + "ownerInfo": { + "ownerSecurityGroup": "aadlcm" + } + }, "LifecycleWorkflows-CustomExt.Read.All": { "authorizationType": "oAuth2", "schemes": { @@ -32298,7 +32427,7 @@ "adminDisplayName": "Read all Lifecycle workflows custom task extensionss", "adminDescription": "Allows the app to read all Lifecycle workflows custom task extensions without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32335,7 +32464,7 @@ "adminDisplayName": "Read and write all Lifecycle workflows custom task extensions", "adminDescription": "Allows the app to create, update, list, read and delete all Lifecycle workflows custom task extensions without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32397,7 +32526,7 @@ "adminDisplayName": "Read all Lifecycle workflows reports", "adminDescription": "Allows the app to read all Lifecycle workflows reports without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32455,7 +32584,7 @@ "adminDisplayName": "Run workflows on-demand in Lifecycle workflows", "adminDescription": "Allows the app run workflows on-demand without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32492,7 +32621,7 @@ "adminDisplayName": "Read all workflows in Lifecycle workflows", "adminDescription": "Allows the app to list and read all workflows and tasks without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32540,7 +32669,7 @@ "adminDisplayName": "List all workflows in Lifecycle workflows", "adminDescription": "Allows the app to list all workflows without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32577,7 +32706,7 @@ "adminDisplayName": "Read and write all workflows in Lifecycle workflows", "adminDescription": "Allows the app to create, update, list, read and delete all workflows and tasks in lifecycle workflows without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32668,7 +32797,7 @@ "adminDisplayName": "Read all lifecycle workflows resources", "adminDescription": "Allows the app to list and read all workflows, tasks and related lifecycle workflows resources without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32746,7 +32875,7 @@ "adminDisplayName": "Read and write all lifecycle workflows resources", "adminDescription": "Allows the app to create, update, list, read and delete all workflows, tasks and related lifecycle workflows resources without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -32947,7 +33076,7 @@ "adminDisplayName": "Read mail in all mailboxes", "adminDescription": "Allows the app to read mail in all mailboxes without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -33116,7 +33245,7 @@ "adminDisplayName": "Read basic mail in all mailboxes", "adminDescription": "Allows the app to read basic mail properties in all mailboxes without a signed-in user. Includes all properties except body, previewBody, attachments and any extended properties.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -33176,7 +33305,7 @@ "adminDisplayName": "Read and write mail in all mailboxes", "adminDescription": "Allows the app to create, read, update, and delete mail in all mailboxes without a signed-in user. Does not include permission to send mail.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -33374,7 +33503,7 @@ "adminDisplayName": "Send mail as any user", "adminDescription": "Allows the app to send mail as any user without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -33452,7 +33581,7 @@ "adminDisplayName": "Read all users' UserConfiguration objects", "adminDescription": "Allows the app to read all users' UserConfiguration objects.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -33498,7 +33627,7 @@ "adminDisplayName": "Read and write all users' UserConfiguration objects", "adminDescription": "Allows the app to create, read, update and delete all users' UserConfiguration objects.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -33574,7 +33703,7 @@ "adminDisplayName": "Read all the users' mailbox folders", "adminDescription": "Allows the app to read all the users' mailbox folders, without signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -33645,7 +33774,7 @@ "adminDisplayName": "Read and write all the users' mailbox folders", "adminDescription": "Allows the app to read and write all the users' mailbox folders, without signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -33715,7 +33844,7 @@ "adminDisplayName": "Export all the users' mailbox items", "adminDescription": "Allows the app to export all the users' mailbox items, without signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -33772,7 +33901,7 @@ "adminDisplayName": "Export and import all the users' mailbox items", "adminDescription": "Allows the app to export and import all the users' mailbox items, without signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -33830,7 +33959,7 @@ "adminDisplayName": "Read all the users' mailbox items", "adminDescription": "Allows the app to read all the users' mailbox items, without signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -33874,7 +34003,7 @@ "adminDisplayName": "Read all user mailbox settings", "adminDescription": "Allows the app to read user's mailbox settings without a signed-in user. Does not include permission to send mail.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -33956,7 +34085,7 @@ "adminDisplayName": "Read and write all user mailbox settings", "adminDescription": "Allows the app to create, read, update, and delete user's mailbox settings without a signed-in user. Does not include permission to send mail.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -34072,7 +34201,7 @@ "adminDisplayName": "Read mail tips for all users", "adminDescription": "Allows the app to read mail tips for all users in the organization without a signed-in user. Mail tips include automatic replies, mailbox status, custom tips, and delivery information.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -34140,7 +34269,7 @@ "userDisplayName": "Read all managed tenant information", "userDescription": "Allows the app to read all managed tenant information on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -34212,7 +34341,7 @@ "userDisplayName": "Read and write all managed tenant information", "userDescription": "Allows the app to read and write all managed tenant information on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -34373,7 +34502,7 @@ "adminDisplayName": "Read all hidden memberships", "adminDescription": "Allows the app to read the memberships of hidden groups and administrative units without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -34403,13 +34532,13 @@ "userDisplayName": "Read multi-tenant organization details and tenants", "userDescription": "Allows the app to read multi-tenant organization details and tenants on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read all multi-tenant organization details and tenants", "adminDescription": "Allows the app to read all multi-tenant organization details and tenants, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -34474,13 +34603,13 @@ "userDisplayName": "Read and write multi-tenant organization details and tenants", "userDescription": "Allows the app to read multi-tenant organization details and tenants on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all multi-tenant organization details and tenants", "adminDescription": "Allows the app to read and write all multi-tenant organization details and tenants, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -34551,13 +34680,13 @@ "userDisplayName": "Read all device authentication certificate configurations.", "userDescription": "Allows the app to read all device authentication certificate configurations on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read all device authentication certificate configurations.", "adminDescription": "Allows the app to read all device authentication certificate configurations without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -34588,13 +34717,13 @@ "userDisplayName": "Read and write all device authentication certificate configurations.", "userDescription": "Allows the app to read and write all device authentication certificate configurations on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all device authentication certificate configurations.", "adminDescription": "Allows the app the read and write all device authentication certificate configurations without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -34649,13 +34778,13 @@ "userDisplayName": "Read all network access reports", "userDescription": "Allows the app to read all network access reports and configuration settings, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read all network access reports", "adminDescription": "Allows the app to read all network access reports without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -34709,13 +34838,13 @@ "userDisplayName": "Read all network access information", "userDescription": "Allows the app to read all network access information and configuration settings, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read all network access information", "adminDescription": "Allows the app to read all network access information and configuration settings without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -34847,13 +34976,13 @@ "userDisplayName": "Read and write all network access information", "userDescription": "Allows the app to read and write all network access information and configuration settings, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 }, "Application": { "adminDisplayName": "Read and write all network access information", "adminDescription": "Allows the app to read and write all network access information and configuration settings without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -35399,7 +35528,7 @@ "adminDisplayName": "Read all OneNote notebooks", "adminDescription": "Allows the app to read all the OneNote notebooks in your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -35704,7 +35833,7 @@ "adminDisplayName": "Read and write all OneNote notebooks", "adminDescription": "Allows the app to read all the OneNote notebooks in your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -35962,7 +36091,7 @@ "adminDisplayName": "Read all AI Insights for online meetings.", "adminDescription": "Allows the app to read all AI Insights for all online meetings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -35994,7 +36123,7 @@ "adminDisplayName": "Read all AI Insights for online meetings where the Teams application is installed.", "adminDescription": "Allows the teams-app to read all aiInsights for online meetings where the Teams-app is installed, without a signed-in user.", "requiresAdminConsent": false, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -36027,7 +36156,7 @@ "adminDisplayName": "Read online meeting artifacts", "adminDescription": "Allows the app to read online meeting artifacts in your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -36111,7 +36240,7 @@ "adminDisplayName": "Read all recordings of online meetings.", "adminDescription": "Allows the app to read all recordings of all online meetings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -36157,7 +36286,7 @@ "adminDisplayName": "Read all recordings of online meetings where the Teams application is installed.", "adminDescription": "Allows the teams-app to read all recordings of online meetings where the Teams-app is installed, without a signed-in user.", "requiresAdminConsent": false, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -36241,7 +36370,7 @@ "adminDisplayName": "Read online meeting details", "adminDescription": "Allows the app to read online meeting details in your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -36425,7 +36554,7 @@ "adminDisplayName": "Read and create online meetings", "adminDescription": "Allows the app to read and create online meetings as an application in your organization.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -36525,7 +36654,7 @@ "adminDisplayName": "Read all transcripts of online meetings.", "adminDescription": "Allows the app to read all transcripts of all online meetings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -36574,7 +36703,7 @@ "adminDisplayName": "Read all transcripts of online meetings where the Teams app is installed.", "adminDescription": "Allows the Teams app to read all transcripts of online meetings where the Teams-app is installed, without a signed-in user.", "requiresAdminConsent": false, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -36675,7 +36804,7 @@ "userDisplayName": "Read and write all on-premises directory synchronization information", "userDescription": "Allows the app to read and write all on-premises directory synchronization information for the organization, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "", @@ -36751,7 +36880,7 @@ "adminDisplayName": "Manage on-premises published resources", "adminDescription": "Allows the app to create, view, update and delete on-premises published resources, on-premises agents and agent groups, as part of a hybrid identity configuration, without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -36867,7 +36996,7 @@ "adminDisplayName": "Read organization information", "adminDescription": "Allows the app to read the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -36924,7 +37053,7 @@ "adminDisplayName": "Read and write organization information", "adminDescription": "Allows the app to read and write the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37089,7 +37218,7 @@ "adminDisplayName": "Read organizational branding information", "adminDescription": "Allows the app to read the organizational branding resources, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37133,7 +37262,7 @@ "adminDisplayName": "Read and write organizational branding information", "adminDescription": "Allows the app to read and write the organizational branding resources, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37249,7 +37378,7 @@ "adminDisplayName": "Read organizational contacts", "adminDescription": "Allows the app to read all organizational contacts without a signed-in user. These contacts are managed by the organization and are different from a user's personal contacts.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37292,7 +37421,7 @@ "adminDisplayName": "Read organization-wide apps and services settings", "adminDescription": "Allows the app to read organization-wide apps and services settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37328,7 +37457,7 @@ "adminDisplayName": "Read and write organization-wide apps and services settings", "adminDescription": "Allows the app to read and write organization-wide apps and services settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37365,7 +37494,7 @@ "adminDisplayName": "Read organization-wide Dynamics customer voice settings", "adminDescription": "Allows the app to read organization-wide Dynamics customer voice settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37401,7 +37530,7 @@ "adminDisplayName": "Read and write organization-wide Dynamics customer voice settings", "adminDescription": "Allows the app to read and write organization-wide Dynamics customer voice settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37438,7 +37567,7 @@ "adminDisplayName": "Read organization-wide Microsoft Forms settings", "adminDescription": "Allows the app to read organization-wide Microsoft Forms settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37474,7 +37603,7 @@ "adminDisplayName": "Read and write organization-wide Microsoft Forms settings", "adminDescription": "Allows the app to read and write organization-wide Microsoft Forms settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37509,7 +37638,7 @@ "adminDisplayName": "Read organization-wide Microsoft 365 apps installation settings", "adminDescription": "Allows the app to read organization-wide Microsoft 365 apps installation settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37543,7 +37672,7 @@ "adminDisplayName": "Read and write organization-wide Microsoft 365 apps installation settings", "adminDescription": "Allows the app to read and write organization-wide Microsoft 365 apps installation settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37580,7 +37709,7 @@ "adminDisplayName": "Read organization-wide Microsoft To Do settings", "adminDescription": "Allows the app to read organization-wide Microsoft To Do settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37616,7 +37745,7 @@ "adminDisplayName": "Read and write organization-wide Microsoft To Do settings", "adminDescription": "Allows the app to read and write organization-wide Microsoft To Do settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37719,7 +37848,7 @@ "adminDisplayName": "Read security alerts of customer with CSP relationship", "adminDescription": "Allows the app to read security alerts of customer with CSP relationship, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37754,13 +37883,13 @@ "userDisplayName": "Read security alerts and update status of security alerts of customer with CSP relationship", "userDescription": "Allows the app to read security alerts and update status of alerts of customer with CSP relationship on behalf of you.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read security alerts and update status of security alerts of customer with CSP relationship", "adminDescription": "Allows the app to read security alerts and update status of alerts of customer with CSP relationship, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37803,13 +37932,13 @@ "userDisplayName": "Read pending external user profiles", "userDescription": "Allows the app to read available properties of pending external user profiles, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read all pending external user profiles", "adminDescription": "Allows the app to read available properties of pending external user profiles, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37840,13 +37969,13 @@ "userDisplayName": "Read and write pending external user profiles", "userDescription": "Allows the app to read and write available properties of pending external user profiles, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all pending external user profiles", "adminDescription": "Allows the app to read and write available properties of pending external user profiles, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37936,7 +38065,7 @@ "adminDisplayName": "Read all users' relevant people lists", "adminDescription": "Allows the app to read any user's scored list of relevant people, without a signed-in user. The list can include local contacts, contacts from social networking, your organization's directory, and people from recent communications (such as email and Skype).", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -37973,7 +38102,7 @@ "adminDisplayName": "Read all tenant-wide people settings", "adminDescription": "Allows the application to read tenant-wide people settings without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38021,7 +38150,7 @@ "adminDisplayName": "Read and write all tenant-wide people settings", "adminDescription": "Allows the application to read and write tenant-wide people settings without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38108,7 +38237,7 @@ "adminDisplayName": "Read all company places", "adminDescription": "Allows the app to read company places (conference rooms and room lists) for calendar events and other applications, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38167,7 +38296,7 @@ "adminDisplayName": "Read and write organization places", "adminDescription": "Allows the app to manage organization places (conference rooms and room lists) for calendar events and other applications, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38276,7 +38405,7 @@ "adminDisplayName": "Read all workplace devices", "adminDescription": "Allows the app to read all workplace devices, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38314,7 +38443,7 @@ "adminDisplayName": "Read and write all workplace devices", "adminDescription": "Allows the app to read and write all workplace devices, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38371,7 +38500,7 @@ "adminDisplayName": "Read and write telemetry for all workplace devices.", "adminDescription": "Allows the app to read and write telemetry for all workplace devices, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38415,7 +38544,7 @@ "adminDisplayName": "Read your organization's policies", "adminDescription": "Allows the app to read all your organization's policies without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38784,7 +38913,7 @@ "adminDisplayName": "Read authentication method policies", "adminDescription": "Allows the app to read all authentication method policies for the tenant, without a signed-in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38842,7 +38971,7 @@ "adminDisplayName": "Read your organization's B2BManagement policies", "adminDescription": "Allows the app to read all your organization's B2BManagement policies without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38881,7 +39010,7 @@ "adminDisplayName": "Read your organization's conditional access policies", "adminDescription": "Allows the app to read your organization's conditional access policies, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38941,13 +39070,13 @@ "userDisplayName": "Read your organization's device configuration policies", "userDescription": "Allows the app to read your organization's device configuration policies on your behalf. For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read your organization's device configuration policies", "adminDescription": "Allows the application to read your organization's device configuration policies without a signed-in user. For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -38983,7 +39112,7 @@ "adminDisplayName": "Read your organization's hybrid authentication policies", "adminDescription": "Allows the app to read your organization's hybrid authentication policies without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -39065,7 +39194,7 @@ "adminDisplayName": "Read consent and permission grant policies", "adminDescription": "Allows the app to read policies related to consent and permission grants for applications, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -39098,13 +39227,13 @@ "userDisplayName": "Read and write your organization's directory access review default policy", "userDescription": "Allows the app to read and write your organization's directory access review default policy on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's directory access review default policy", "adminDescription": "Allows the app to read and write your organization's directory access review default policy without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -39136,13 +39265,13 @@ "userDisplayName": "Read and write your organization's application configuration policies", "userDescription": "Allows the app to read and write your organization's application configuration policies on your behalf. This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy, tokenIssuancePolicy and tokenLifetimePolicy.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's application configuration policies", "adminDescription": "Allows the app to read and write your organization's application configuration policies, without a signed-in user. This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy, tokenIssuancePolicy and tokenLifetimePolicy.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -39335,13 +39464,13 @@ "userDisplayName": "Read and write your authentication flow policies", "userDescription": "Allows the app to read and write the authentication flow policies for your tenant, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write authentication flow policies", "adminDescription": "Allows the app to read and write all authentication flow policies for the tenant, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -39372,7 +39501,7 @@ "userDisplayName": "Read and write your authentication method policies ", "userDescription": "Allows the app to read and write the authentication method policies for your tenant, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "DelegatedPersonal": { "adminDisplayName": "Read and write authentication method policies", @@ -39380,13 +39509,13 @@ "userDisplayName": "Read and write your authentication method policies ", "userDescription": "Allows the app to read and write the authentication method policies for your tenant, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all authentication method policies ", "adminDescription": "Allows the app to read and write all authentication method policies for the tenant, without a signed-in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -39583,13 +39712,13 @@ "userDisplayName": "Read and write your organization's authorization policy", "userDescription": "Allows the app to read and write your organization's authorization policy on your behalf. For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's authorization policy", "adminDescription": "Allows the app to read and write your organization's authorization policy without a signed in user. For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -39647,13 +39776,13 @@ "userDisplayName": "Read and write your organization's B2BManagement policies", "userDescription": "Allows the app to read and write your organization's B2BManagement policies on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's B2BManagement policies", "adminDescription": "Allows the app to read and write all your organization's B2BManagement policies without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -39698,13 +39827,13 @@ "userDisplayName": "Read and write your organization's conditional access policies", "userDescription": "Allows the app to read and write your organization's conditional access policies on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's conditional access policies", "adminDescription": "Allows the app to read and write your organization's conditional access policies, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -39904,13 +40033,13 @@ "userDisplayName": "Read and write consent request policy", "userDescription": "Allows the app to read and write your organization's consent request policy on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's consent request policy", "adminDescription": "Allows the app to read and write your organization's consent requests policy without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -39941,13 +40070,13 @@ "userDisplayName": "Read and write your organization's cross tenant access policies", "userDescription": "Allows the app to read and write your organization's cross tenant access policies on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's cross tenant access policies", "adminDescription": "Allows the app to read and write your organization's cross tenant access policies without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40045,13 +40174,13 @@ "userDisplayName": "Read and write your organization's M365 cross tenant access capabilities", "userDescription": "Allows the app to read and write your organization's M365 cross tenant access capabilities on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's M365 cross tenant access capabilities", "adminDescription": "Allows the app to read and write your organization's M365 cross tenant access capabilities without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40134,13 +40263,13 @@ "userDisplayName": "Read and write your organization's device configuration policies", "userDescription": "Allows the app to read and write your organization's device configuration policies on your behalf. For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's device configuration policies", "adminDescription": "Allows the application to read and write your organization's device configuration policies without a signed-in user. For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40183,13 +40312,13 @@ "userDisplayName": "Read and write your organization's external identities policy", "userDescription": "Allows the application to read and update the organization's external identities policy on your behalf. For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's external identities policy", "adminDescription": "Allows the application to read and update the organization's external identities policy without a signed-in user. For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40226,7 +40355,7 @@ "adminDisplayName": "Read and write feature rollout policies", "adminDescription": "Allows the app to read and write feature rollout policies without a signed-in user. Includes abilities to assign and remove users and groups to rollout of a specific feature.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -40243,13 +40372,13 @@ "userDisplayName": "Read and write your organization's federated token validation policy", "userDescription": "Allows the app to read and write your organization's federated token validation policy on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's federated token validation policy", "adminDescription": "Allows the app to read and write your organization's federated token validation policy without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40286,7 +40415,7 @@ "adminDisplayName": "Read and write your organization's hybrid authentication policies", "adminDescription": "Allows the app to read and wrtie your organization's hybrid authentication policies without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40516,13 +40645,13 @@ "userDisplayName": "Manage consent and permission grant policies", "userDescription": "Allows the app to manage policies related to consent and permission grants for applications, on behalf of the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Manage consent and permission grant policies", "adminDescription": "Allows the app to manage policies related to consent and permission grants for applications, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40597,13 +40726,13 @@ "userDisplayName": "Read and write your organization's security defaults policy", "userDescription": "Allows the app to read and write your organization's security defaults policy on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's security defaults policy", "adminDescription": "Allows the app to read and write your organization's security defaults policy without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40634,13 +40763,13 @@ "userDisplayName": "Read and write trust framework policies", "userDescription": "Allows the app to read and write your organization's trust framework policies on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write your organization's trust framework policies", "adminDescription": "Allows the app to read and write your organization's trust framework policies without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40749,7 +40878,7 @@ "userDisplayName": "Read presence information of all users in your organization", "userDescription": "Allows the app to read presence information of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and work location.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -40838,7 +40967,7 @@ "adminDisplayName": "Read and write presence information for all users", "adminDescription": "Allows the app to read all presence information and write activity, availability and work location of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, time zone and work location.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -41174,7 +41303,7 @@ "adminDisplayName": "Read printers", "adminDescription": "Allows the application to read printers without a signed-in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -41229,7 +41358,7 @@ "adminDisplayName": "Read and update printers", "adminDescription": "Allows the application to read and update printers without a signed-in user. Does not allow creating (registering) or deleting (unregistering) printers.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -41538,7 +41667,7 @@ "adminDisplayName": "Perform advanced operations on print jobs", "adminDescription": "Allows the application to perform advanced operations like redirecting a print job to another printer without a signed-in user. Also allows the application to read and update the metadata of print jobs.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -41622,7 +41751,7 @@ "adminDisplayName": "Read print jobs", "adminDescription": "Allows the application to read the metadata and document content of print jobs without a signed-in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -41712,7 +41841,7 @@ "adminDisplayName": "Read basic information for print jobs", "adminDescription": "Allows the application to read the metadata of print jobs without a signed-in user. Does not allow access to print job document content.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -41827,7 +41956,7 @@ "adminDisplayName": "Read and write print jobs", "adminDescription": "Allows the application to read and update the metadata and document content of print jobs without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -41989,7 +42118,7 @@ "adminDisplayName": "Read and write basic information for print jobs", "adminDescription": "Allows the application to read and update the metadata of print jobs without a signed-in user. Does not allow access to print job document content.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42147,7 +42276,7 @@ "adminDisplayName": "Read, write and update print task definitions", "adminDescription": "Allows the application to read and update print task definitions without a signed-in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42211,7 +42340,7 @@ "adminDisplayName": "Read privileged access to Azure AD roles", "adminDescription": "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles in your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42241,13 +42370,13 @@ "userDisplayName": "Read privileged access to Azure AD groups", "userDescription": "Allows the app to read time-based assignment and just in time elevation (including scheduled elevation) of Azure AD groups in your organization, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read privileged access to Azure AD groups", "adminDescription": "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42288,7 +42417,7 @@ "adminDisplayName": "Read privileged access to Azure resources", "adminDescription": "Allows the app to read time-based assignment and just-in-time elevation of user privileges to audit Azure resources in your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42316,7 +42445,7 @@ "userDisplayName": "Read and write privileged access to Azure AD", "userDescription": "Allows the app to request and manage just in time elevation (including scheduled elevation) of users to Azure AD built-in administrative roles, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42397,13 +42526,13 @@ "userDisplayName": "Read and write privileged access to Azure AD groups", "userDescription": "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write privileged access to Azure AD groups", "adminDescription": "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on behalf of the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42457,7 +42586,7 @@ "userDisplayName": "Read and write privileged access to Azure resources", "userDescription": "Allows the app to request and manage time-based assignment and just-in-time elevation of user privileges to manage your Azure resources (like your subscriptions, resource groups, storage, compute) on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42542,13 +42671,13 @@ "userDisplayName": "Read, create, and delete assignment schedules for access to Azure AD groups", "userDescription": "Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read, create, and delete assignment schedules for access to Azure AD groups", "adminDescription": "Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42610,13 +42739,13 @@ "userDisplayName": "Delete assignment schedules for access to Azure AD groups", "userDescription": "Allows the app to delete time-based assignment schedules for access to Azure AD groups, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Delete assignment schedules for access to Azure AD groups", "adminDescription": "Delete time-based assignment schedules for access to Azure AD groups, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42690,13 +42819,13 @@ "userDisplayName": "Read, create, and delete eligibility schedules for access to Azure AD groups", "userDescription": "Allows the app to read, create, and delete time-based eligibility schedules for access to Azure AD groups, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read, create, and delete eligibility schedules for access to Azure AD groups", "adminDescription": "Allows the app to read, create, and delete time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42758,13 +42887,13 @@ "userDisplayName": "Delete eligibility schedules for access to Azure AD groups", "userDescription": "Allows the app to delete time-based eligibility schedules for access to Azure AD groups, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Delete eligibility schedules for access to Azure AD groups", "adminDescription": "Delete time-based eligibility schedules for access to Azure AD groups, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42800,7 +42929,7 @@ "adminDisplayName": "Read profile photo of a user or group", "adminDescription": "Allows the app to read all profile photos of users and groups, without a signed-in user", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42854,7 +42983,7 @@ "adminDisplayName": "Read and write profile photo of a user or group", "adminDescription": "Allows the app to read and write all profile photos of users and groups, without a signed-in user", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42936,7 +43065,7 @@ "adminDisplayName": "Read all programs", "adminDescription": "Allows the app to read programs and program controls in the organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -42969,13 +43098,13 @@ "userDisplayName": "Manage programs that you can access", "userDescription": "Allows the app to read, update and perform action on programs and program controls that you have access to.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Manage all programs", "adminDescription": "Allows the app to read, update, delete and perform actions on programs and program controls in the organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -43059,7 +43188,7 @@ "adminDisplayName": "Compute Purview policies at tenant scope", "adminDescription": "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for all users across tenant.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -43134,7 +43263,7 @@ "adminDisplayName": "Read all provisioning log data", "adminDescription": "Allows the app to read and query your provisioning log activities, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -43174,7 +43303,7 @@ "adminDisplayName": "Read all certificate based authentication configurations", "adminDescription": "Allows the application to read certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -43213,7 +43342,7 @@ "adminDisplayName": "Read and write all certificate based authentication configurations", "adminDescription": "Allows the application to read and write certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -43313,13 +43442,13 @@ "userDisplayName": "Access real-time enriched data in a meeting", "userDescription": "Allows the app to get direct access to real-time enriched data in a meeting, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Access real-time enriched data in a meeting", "adminDescription": "Allows the app to get direct access to real-time enriched data in a meeting, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -43393,7 +43522,7 @@ "adminDisplayName": "Read Records Management configuration, labels and policies", "adminDescription": "Allows the application to read any data from Records Management, such as configuration, labels, and policies without the signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -43447,7 +43576,7 @@ "adminDisplayName": "Read and write Records Management configuration, labels and policies", "adminDescription": "Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies without the signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -43550,7 +43679,7 @@ "adminDisplayName": "Read all usage reports", "adminDescription": "Allows an app to read all service usage reports without a signed-in user. Services that provide usage reports include Office 365 and Azure Active Directory.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -43752,7 +43881,7 @@ "adminDisplayName": "Read all admin report settings", "adminDescription": "Allows the app to read all admin report settings, such as whether to display concealed information in reports, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -43799,7 +43928,7 @@ "adminDisplayName": "Read and write all admin report settings", "adminDescription": "Allows the app to read and update all admin report settings, such as whether to display concealed information in reports, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44125,7 +44254,7 @@ "userDisplayName": "Read all active role assignments and role schedules for your company's directory", "userDescription": "Allows the app to read the active role-based access control (RBAC) assignments and schedules for your company's directory, without a signed-in user. This includes reading directory role templates, and directory roles.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44160,13 +44289,13 @@ "userDisplayName": "Read, update, and delete all active role assignments for your company's directory", "userDescription": "Allows the app to read and manage the active role-based access control (RBAC) assignments for your company's directory, on your behalf. This includes managing active directory role membership, and reading directory role templates, directory roles and active memberships.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read, update, and delete all policies for privileged role assignments of your company's directory", "adminDescription": "Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company's directory, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44217,13 +44346,13 @@ "userDisplayName": "Delete all active role assignments for your company's directory", "userDescription": "Allows the app to delete the active role-based access control (RBAC) assignments for your company's directory, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Delete all active role assignments of your company's directory", "adminDescription": "Delete all active privileged role-based access control (RBAC) assignments of your company's directory, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44261,7 +44390,7 @@ "userDisplayName": "Read all eligible role assignments and role schedules for your company's directory", "userDescription": "Allows the app to read the eligible role-based access control (RBAC) assignments and schedules for your company's directory, without a signed-in user. This includes reading directory role templates, and directory roles.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44296,7 +44425,7 @@ "userDisplayName": "Read, update, and delete all eligible role assignments for your company's directory", "userDescription": "Allows the app to read and manage the eligible role-based access control (RBAC) assignments for your company's directory, on your behalf. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read, update, and delete all eligible role assignments and schedules for your company's directory", @@ -44304,7 +44433,7 @@ "userDisplayName": "Read, update, and delete all eligible role assignments and schedules for your company's directory", "userDescription": "Allows the app to read and manage the eligible role-based access control (RBAC) assignments and schedules for your company's directory, without a signed-in user. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44355,13 +44484,13 @@ "userDisplayName": "Delete all eligible role assignments for your company's directory", "userDescription": "Allows the app to delete the eligible role-based access control (RBAC) assignments for your company's directory, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Delete all eligible role assignments of your company's directory", "adminDescription": "Delete all eligible privileged role-based access control (RBAC) assignments of your company's directory, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44397,7 +44526,7 @@ "adminDisplayName": "Read role management data for all RBAC providers", "adminDescription": "Allows the app to read role-based access control (RBAC) settings for all RBAC providers without a signed-in user. This includes reading role definitions and role assignments.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44486,7 +44615,7 @@ "adminDisplayName": "Read Cloud PC RBAC settings", "adminDescription": "Allows the app to read the Cloud PC role-based access control (RBAC) settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44525,7 +44654,7 @@ "adminDisplayName": "Read M365 Defender RBAC configuration", "adminDescription": "Allows the app to read the role-based access control (RBAC) settings for your company's directory, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44565,7 +44694,7 @@ "adminDisplayName": "Read all directory RBAC settings", "adminDescription": "Allows the app to read the role-based access control (RBAC) settings for your company's directory, without a signed-in user. This includes reading directory role templates, directory roles and memberships.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44649,7 +44778,7 @@ "adminDisplayName": "Read Exchange Online RBAC configuration", "adminDescription": "Allows the app to read the role-based access control (RBAC) configuration for your organization's Exchange Online service, without a signed-in user. This includes reading Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44684,13 +44813,13 @@ "userDisplayName": "Read and write Cloud PC RBAC settings", "userDescription": "Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, on your behalf. This includes reading and managing Cloud PC role definitions and memberships.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all Cloud PC RBAC settings", "adminDescription": "Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, without a signed-in user. This includes reading and managing Cloud PC role definitions and memberships.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44743,7 +44872,7 @@ "adminDisplayName": "Read M365 Defender RBAC configuration", "adminDescription": "Allows the app to read the role-based access control (RBAC) settings for your company's directory, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44804,13 +44933,13 @@ "userDisplayName": "Read and write directory RBAC settings", "userDescription": "Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, on your behalf. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all directory RBAC settings", "adminDescription": "Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, without a signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -44969,13 +45098,13 @@ "userDisplayName": "Read and write Exchange Online RBAC configuration", "userDescription": "Allows the app to read and manage the role-based access control (RBAC) settings for your organization's Exchange Online service, on your behalf. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write Exchange Online RBAC configuration", "adminDescription": "Allows the app to read and manage the role-based access control (RBAC) settings for your organization's Exchange Online service, without a signed-in user. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45045,7 +45174,7 @@ "adminDisplayName": "Read all alert data for your company's directory", "adminDescription": "Allows the app to read all role-based access control (RBAC) alerts for your company's directory, without a signed-in user. This includes reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45089,7 +45218,7 @@ "adminDisplayName": "Read all alert data, configure alerts, and take actions on all alerts for your company's directory", "adminDescription": "Allows the app to read and manage all role-based access control (RBAC) alerts for your company's directory, without a signed-in user. This includes managing alert settings, initiating alert scans, dimissing alerts, remediating alert incidents, and reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45187,7 +45316,7 @@ "userDisplayName": "Read, update, and delete all policies for privileged role assignments of your company's directory", "userDescription": "Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company's directory, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45231,7 +45360,7 @@ "adminDisplayName": "Trigger all working time policies", "adminDescription": "Allows the app to trigger the working time policies without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45279,7 +45408,7 @@ "adminDisplayName": "Read all schedule items", "adminDescription": "Allows the app to read all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45340,7 +45469,7 @@ "adminDisplayName": "Read and write all schedule items", "adminDescription": "Allows the app to manage all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45522,7 +45651,7 @@ "adminDisplayName": "Read/Write schedule permissions for a role", "adminDescription": "Allows the app to read/write schedule permissions for a specific role in Shifts application without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45561,7 +45690,7 @@ "adminDisplayName": "Read your organization's search configuration", "adminDescription": "Allows the app to read search configurations, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45640,7 +45769,7 @@ "adminDisplayName": "Read and write your organization's search configuration", "adminDescription": "Allows the app to read and write search configurations, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45719,7 +45848,7 @@ "adminDisplayName": "Read your organization's security actions", "adminDescription": "Allows the app to read security actions, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45749,13 +45878,13 @@ "userDisplayName": "Read and update your organization's security actions", "userDescription": "Allows the app to read and update security actions, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and update your organization's security actions", "adminDescription": "Allows the app to read or update security actions, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45813,7 +45942,7 @@ "adminDisplayName": "Create security alerts without a signed-in user", "adminDescription": "Allows the app to create security alerts in Microsoft 365 Defender, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45849,7 +45978,7 @@ "adminDisplayName": "Read all security alerts", "adminDescription": "Allows the app to read all security alerts, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45886,7 +46015,7 @@ "adminDisplayName": "Read and write to all security alerts", "adminDescription": "Allows the app to read and write to all security alerts, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45951,7 +46080,7 @@ "adminDisplayName": "Read security defender analyzed message data of an organization", "adminDescription": "Allows the app to read security defender analyzed message data of an organization without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -45979,7 +46108,7 @@ "adminDisplayName": "Read, create, and update all security defender analyzed message data of an organization", "adminDescription": "Allows the app to read, create, and update security defender analyzed message data of an organization without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46063,13 +46192,13 @@ "userDisplayName": "Write user's Security Copilot resources", "userDescription": "Allows the app to write Security Copilot resources owned by user on user's behalf.", "requiresAdminConsent": false, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Write all Security Copilot resources.", "adminDescription": "Allows the app to write all Security Copilot resources without a signed-in user", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -46112,7 +46241,7 @@ "adminDisplayName": "Read your organization's security events", "adminDescription": "Allows the app to read your organization's security events without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46153,7 +46282,7 @@ "adminDisplayName": "Read and update your organization's security events", "adminDescription": "Allows the app to read your organization's security events without a signed-in user. Also allows the app to update editable properties in security events.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46218,7 +46347,7 @@ "adminDisplayName": "Read all identity security available identity accounts", "adminDescription": "Allows the app to read all the identity security available identity accounts without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46241,6 +46370,7 @@ } }, "SecurityIdentitiesActions.ReadWrite.All": { + "authorizationType": "oAuth2", "schemes": { "DelegatedWork": { "adminDisplayName": "Read and perform identity security available actions", @@ -46254,7 +46384,7 @@ "adminDisplayName": "Read and perform all identity security available actions", "adminDescription": "Allows the app to read and write identity security available actions without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46290,7 +46420,7 @@ "adminDisplayName": "Read sensors window auditing configuration", "adminDescription": "Allows the app to read sensors window auditing configuration without a signed-in user", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46326,7 +46456,7 @@ "adminDisplayName": "Read and write sensors window auditing configuration", "adminDescription": "Allows the app to read and write sensors window auditing configuration without a signed-in user", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46362,7 +46492,7 @@ "adminDisplayName": "Read all identity security health issues", "adminDescription": "Allows the app to read all the identity security health issues without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46399,7 +46529,7 @@ "adminDisplayName": "Read and write all identity security health issues", "adminDescription": "Allows the app to read and write identity security health issues without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46448,7 +46578,7 @@ "adminDisplayName": "Read all identity security sensor migration", "adminDescription": "Allows the app to read all the identity security sensor migration information without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46484,7 +46614,7 @@ "adminDisplayName": "Read and write all identity security sensor migration", "adminDescription": "Allows the app to read and write identity security sensor migration without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46520,7 +46650,7 @@ "adminDisplayName": "Read all identity security sensors", "adminDescription": "Allows the app to read all the identity security sensors without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46560,7 +46690,7 @@ "adminDisplayName": "Read and write all identity security sensors", "adminDescription": "Allows the app to read and write identity security sensors without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46624,7 +46754,7 @@ "adminDisplayName": "Read all identity security available user actions", "adminDescription": "Allows the app to read all the identity security available user actions without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46660,7 +46790,7 @@ "adminDisplayName": "Read and perform all identity security available user actions", "adminDescription": "Allows the app to read and write identity security available user actions without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46696,7 +46826,7 @@ "adminDisplayName": "Read all identity security available users", "adminDescription": "Allows the app to read all the identity security available users without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46732,7 +46862,7 @@ "adminDisplayName": "Read all security incidents", "adminDescription": "Allows the app to read all security incidents, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46769,7 +46899,7 @@ "adminDisplayName": "Read and write to all security incidents", "adminDescription": "Allows the app to read and write to all security incidents, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46824,13 +46954,13 @@ "userDisplayName": "Evaluate labels user scope", "userDescription": "Evaluate labels tenant scope, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Evaluate labels user scope.", "adminDescription": "Allows the app to evaluate all sensitivity label.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -46873,13 +47003,13 @@ "userDisplayName": "Evaluate labels tenant scope", "userDescription": "Evaluate labels tenant scope, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Evaluate labels tenant scope.", "adminDescription": "Allows the app to evaluate all sensitivity label.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47006,6 +47136,7 @@ } }, "ServiceActivity-Exchange.Read.All": { + "authorizationType": "oAuth2", "schemes": { "DelegatedWork": { "adminDisplayName": "Read all Exchange service activity", @@ -47019,7 +47150,7 @@ "adminDisplayName": "Read all Exchange service activity", "adminDescription": "Allows the app to read all Exchange service activity, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47049,6 +47180,7 @@ } }, "ServiceActivity-Microsoft365Web.Read.All": { + "authorizationType": "oAuth2", "schemes": { "DelegatedWork": { "adminDisplayName": "Read all Microsoft 365 Web service activity", @@ -47062,7 +47194,7 @@ "adminDisplayName": "Read all Microsoft 365 Web service activity", "adminDescription": "Allows the app to read all Microsoft 365 Web service activity, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47088,6 +47220,7 @@ } }, "ServiceActivity-OneDrive.Read.All": { + "authorizationType": "oAuth2", "schemes": { "DelegatedWork": { "adminDisplayName": "Read all One Drive service activity", @@ -47101,7 +47234,7 @@ "adminDisplayName": "Read all One Drive service activity", "adminDescription": "Allows the app to read all One Drive service activity, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47123,6 +47256,7 @@ } }, "ServiceActivity-Teams.Read.All": { + "authorizationType": "oAuth2", "schemes": { "DelegatedWork": { "adminDisplayName": "Read all Teams service activity", @@ -47136,7 +47270,7 @@ "adminDisplayName": "Read all Teams service activity", "adminDescription": "Allows the app to read all Teams service activity, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47184,7 +47318,7 @@ "adminDisplayName": "Read service health", "adminDescription": "Allows the app to read your tenant's service health information, without a signed-in user. Health information may include service issues or service health overviews.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47232,7 +47366,7 @@ "adminDisplayName": "Read service messages", "adminDescription": "Allows the app to read your tenant's service announcement messages, without a signed-in user. Messages may include information about new or changed features.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47307,13 +47441,13 @@ "userDisplayName": "Read, write and manage SharePoint Cross-Tenant migration settings and tasks", "userDescription": "Allows the app to read, write and manage your tenant's SharePoint Cross-Tenant migration settings and tasks, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read, write and manage SharePoint Cross-Tenant migration settings and tasks", "adminDescription": "Allows the app to read, write and manage your tenant's SharePoint Cross-Tenant migration settings and tasks, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -47365,7 +47499,7 @@ "adminDisplayName": "Read SharePoint Cross-Tenant migration settings and tasks", "adminDescription": "Allows the app to read your tenant's SharePoint Cross-Tenant migration settings and tasks, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47408,7 +47542,7 @@ "adminDisplayName": "Read SharePoint and OneDrive tenant settings", "adminDescription": "Allows the application to read the tenant-level settings of SharePoint and OneDrive, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47438,13 +47572,13 @@ "userDisplayName": "Read and change SharePoint and OneDrive tenant settings", "userDescription": "Allows the application to read and change the tenant-level settings of SharePoint and OneDrive on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and change SharePoint and OneDrive tenant settings", "adminDescription": "Allows the application to read and change the tenant-level settings of SharePoint and OneDrive, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47522,7 +47656,7 @@ "adminDisplayName": "Read all users' short notes", "adminDescription": "Allows the app to read all the short notes without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47646,7 +47780,7 @@ "adminDisplayName": "Read, create, edit, and delete all users' short notes", "adminDescription": "Allows the app to read, create, edit, and delete all the short notes without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47721,7 +47855,7 @@ "adminDisplayName": "Read all sign-in identifiers", "adminDescription": "Allows the app to read your organization's sign-in identifiers, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47758,7 +47892,7 @@ "adminDisplayName": "Read and write all sign-in identifiers", "adminDescription": "Allows the app to read and write your organization's sign-in identifiers, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47803,13 +47937,13 @@ "userDisplayName": "Archive/Unarchive Site Collections, on behalf of the signed-in user", "userDescription": "Allow the application to archive/unarchive site collections on behalf of the signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Archive/unarchive Site Collections without a signed in user.", "adminDescription": "Allow the application to archive/unarchive site collections without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -47840,7 +47974,7 @@ "userDisplayName": "Have full control of all your site collections", "userDescription": "Allow the application to have full control of all site collections on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "DelegatedPersonal": { "adminDisplayName": "Have full control of all site collections", @@ -47848,13 +47982,13 @@ "userDisplayName": "Have full control of all your site collections", "userDescription": "Allow the application to have full control of all site collections on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Have full control of all site collections", "adminDescription": "Allows the app to have full control of all site collections without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -48173,7 +48307,7 @@ "adminDisplayName": "Create, edit, and delete items and lists in all site collections", "adminDescription": "Allows the app to create or delete document libraries and lists in all site collections without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -48425,7 +48559,7 @@ "adminDisplayName": "Read items in all site collections ", "adminDescription": "Allows the app to read documents and list items in all site collections without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -48879,7 +49013,7 @@ "adminDisplayName": "Read and write items in all site collections", "adminDescription": "Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -49568,7 +49702,7 @@ "adminDisplayName": "Access selected site collections", "adminDescription": "Allow the application to access a subset of site collections without a signed in user. The specific site collections and the permissions granted will be configured in SharePoint Online.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -49655,7 +49789,7 @@ "adminDisplayName": "Read SPIFFE trust domains and child resources", "adminDescription": "Allows the app to read your organization's SPIFFE trust domains and child resources without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -49712,7 +49846,7 @@ "adminDisplayName": "Read and write SPIFFE trust domains and child resources", "adminDescription": "Allows the app to read and write your organization's SPIFFE trust domains and child resources without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -49835,7 +49969,7 @@ "adminDisplayName": "Read and write all Viva Engage storylines", "adminDescription": "Allows the app to modify Viva Engage storylines, read all storylines properties, update storyline properties, and delete storyline properties without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -49984,7 +50118,7 @@ "adminDisplayName": "Read all Azure AD synchronization data. ", "adminDescription": "Allows the application to read Azure AD synchronization information, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -50022,13 +50156,13 @@ "userDisplayName": "Read and write all Azure AD synchronization data", "userDescription": "Allows the app to configure the Azure AD synchronization service, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all Azure AD synchronization data. ", "adminDescription": "Allows the application to configure the Azure AD synchronization service, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -50163,6 +50297,7 @@ } }, "SynchronizationData-User.Upload": { + "authorizationType": "oAuth2", "schemes": { "DelegatedWork": { "adminDisplayName": "Upload user data to the identity synchronization service", @@ -50176,7 +50311,7 @@ "adminDisplayName": "Upload user data to the identity synchronization service", "adminDescription": "Allows the application to upload bulk user data to the identity synchronization service, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -50198,12 +50333,13 @@ } }, "SynchronizationData-User.Upload.OwnedBy": { + "authorizationType": "oAuth2", "schemes": { "Application": { "adminDisplayName": "Upload user data to the identity sync service for apps that this application creates or owns", "adminDescription": "Allows the application to upload bulk user data to the identity synchronization service for apps that this application creates or owns, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -50422,7 +50558,7 @@ "adminDisplayName": "Read all users' tasks and tasklist", "adminDescription": "Allows the app to read all users' tasks and task lists in your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -50897,7 +51033,7 @@ "adminDisplayName": "Read and write all users' tasks and tasklists", "adminDescription": "Allows the app to create, read, update and delete all users' tasks and task lists in your organization, without a signed-in user", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51071,7 +51207,7 @@ "adminDisplayName": "Create teams", "adminDescription": "Allows the app to create teams without a signed-in user. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51108,7 +51244,7 @@ "adminDisplayName": "Get a list of all teams", "adminDescription": "Get a list of all teams, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51149,7 +51285,7 @@ "adminDisplayName": "Read the members of all teams", "adminDescription": "Read the members of all teams, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51209,13 +51345,13 @@ "userDisplayName": "Add and remove members from teams and channels", "userDescription": "Add and remove members from teams, on your behalf. Also allows changing a member's role, for example from owner to non-owner.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Add and remove members from all teams", "adminDescription": "Add and remove members from all teams, without a signed-in user. Also allows changing a team member's role, for example from owner to non-owner.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51295,13 +51431,13 @@ "userDisplayName": "Add and remove non-owner members from teams", "userDescription": "Add and remove non-owner members from teams, on your behalf. Does not allow changing a member's role to or from owner.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Add and remove non-owner members from all teams", "adminDescription": "Add and remove non-owner members from all teams, without a signed-in user. Does not allow changing a member's role to or from owner.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51360,7 +51496,7 @@ "adminDisplayName": "Read all users' teamwork activity feed", "adminDescription": "Allows the app to read all users' teamwork activity feed, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -51383,7 +51519,7 @@ "adminDisplayName": "Send a teamwork activity to any user", "adminDescription": "Allows the app to create new notifications in users' teamwork activity feeds without a signed in user. These notifications may not be discoverable or be held or governed by compliance policies.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51514,6 +51650,7 @@ } }, "TeamsApp.Read.Group": { + "authorizationType": "oAuth2", "schemes": { "Application": { "adminDisplayName": "", @@ -51545,7 +51682,7 @@ "userDisplayName": "Manage installation and permission grants of selected Teams apps in chats", "userDescription": "Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Gives the ability to manage permission grants for accessing those specific chats' data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51607,7 +51744,7 @@ "adminDisplayName": "Manage installation and permission grants of selected Teams apps in all chats", "adminDescription": "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any chat, without a signed-in user. Gives the ability to manage permission grants for accessing those specific chats' data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51682,7 +51819,7 @@ "userDisplayName": "Manage installation and permission grants of selected Teams apps in teams", "userDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Gives the ability to manage permission grants for accessing those specific teams' data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51758,7 +51895,7 @@ "adminDisplayName": "Manage installation and permission grants of selected Teams apps in all teams", "adminDescription": "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams' data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51837,7 +51974,7 @@ "userDisplayName": "Manage installation and permission grants of selected Teams apps in users' personal scope", "userDescription": "Allows the app to read, install, upgrade, and uninstall seleected Teams apps in user accounts, on behalf of the signed-in user. Gives the ability to manage permission grants for accessing those specific users' data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51899,7 +52036,7 @@ "adminDisplayName": "Manage installation and permission grants of selected Teams apps for all user accounts", "adminDescription": "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users' data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -51972,7 +52109,7 @@ "adminDisplayName": "Read installed Teams apps for all installation scopes", "adminDescription": "Allows the app to read the Teams apps that are installed in any scope, without a signed-in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52133,7 +52270,7 @@ "adminDisplayName": "Read installed Teams apps for all chats", "adminDescription": "Allows the app to read the Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52196,7 +52333,7 @@ "adminDisplayName": "Read installed Teams apps for all teams", "adminDescription": "Allows the app to read the Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52261,7 +52398,7 @@ "adminDisplayName": "Read installed Teams apps for all users", "adminDescription": "Allows the app to read the Teams apps that are installed for any user, without a signed-in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52291,7 +52428,7 @@ "adminDisplayName": "Read selected installed Teams apps in all chats", "adminDescription": "Allows the app to read the selected Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52318,7 +52455,7 @@ "adminDisplayName": "Read selected installed Teams apps in all teams", "adminDescription": "Allows the app to read the selected Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52345,7 +52482,7 @@ "adminDisplayName": "Read selected installed Teams apps for all users", "adminDescription": "Allows an app to read, install, upgrade, and uninstall selected apps to any user, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52413,7 +52550,7 @@ "adminDisplayName": "Manage installation and permission grants of Teams apps for all chats", "adminDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Gives the ability to manage permission grants for accessing those specific chats' data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52465,7 +52602,7 @@ "userDisplayName": "Manage installation and permission grants of Teams apps in teams", "userDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Gives the ability to manage permission grants for accessing those specific teams' data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52504,7 +52641,7 @@ "adminDisplayName": "Manage installation and permission grants of Teams apps for all teams", "adminDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams' data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52558,7 +52695,7 @@ "userDisplayName": "Manage installation and permission grants of Teams apps on your user account", "userDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps for your account, on your behalf. Gives the ability to manage permission grants for accessing your data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52620,7 +52757,7 @@ "adminDisplayName": "Manage installation and permission grants of Teams apps in all user accounts", "adminDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users' data.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -52724,7 +52861,7 @@ "adminDisplayName": "Allow the Teams app to manage itself and its permission grants for all chats", "adminDescription": "Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user, and manage its permission grants for accessing those specific chats' data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52765,7 +52902,7 @@ "userDisplayName": "Allow the Teams app to manage itself and its permission grants in teams", "userDescription": "Allows a Teams app to read, install, upgrade, and uninstall itself in teams the signed-in user can access, and manage its permission grants for accessing those specific teams' data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52816,7 +52953,7 @@ "adminDisplayName": "Allow the Teams app to manage itself and its permission grants for all teams", "adminDescription": "Allows a Teams app to read, install, upgrade, and uninstall itself for any team, without a signed-in user, and manage its permission grants for accessing those specific teams' data.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52869,7 +53006,7 @@ "userDisplayName": "Allow the Teams app to manage itself and its permission grants on your user account", "userDescription": "Allows a Teams app to read, install, upgrade, and uninstall itself in your account, and manage its permission grants for accessing your data, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -52931,7 +53068,7 @@ "adminDisplayName": "Allow the Teams app to manage itself and its permission grants in all user accounts", "adminDescription": "Allows a Teams app to read, install, upgrade, and uninstall itself for any user account, without a signed-in user, and manage its permission grants for accessing those specific users' data.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -53057,7 +53194,7 @@ "adminDisplayName": "Manage Teams apps for all chats", "adminDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -53122,7 +53259,7 @@ "userDisplayName": "Manage installed Teams apps in teams", "userDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps in teams you can access. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -53199,7 +53336,7 @@ "adminDisplayName": "Manage Teams apps for all teams", "adminDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -53341,7 +53478,7 @@ "adminDisplayName": "Manage Teams apps for all users", "adminDescription": "Allows the app to read, install, upgrade, and uninstall Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -53404,7 +53541,7 @@ "adminDisplayName": "Manage selected installed Teams apps in all chats", "adminDescription": "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -53431,7 +53568,7 @@ "adminDisplayName": "Manage selected installed Teams apps in all teams", "adminDescription": "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -53460,7 +53597,7 @@ "userDisplayName": "Manage selected Teams apps installed for a user", "userDescription": "Allows the app to read, install, upgrade, and uninstall selected Teams apps installed for the signed in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -53522,7 +53659,7 @@ "adminDisplayName": "Manage selected Teams apps installed for all users", "adminDescription": "Allows the app to read, install, upgrade, and uninstall selected Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -53659,7 +53796,7 @@ "adminDisplayName": "Allow the Teams app to manage itself for all chats", "adminDescription": "Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -53802,7 +53939,7 @@ "adminDisplayName": "Allow the Teams app to manage itself for all teams", "adminDescription": "Allows a Teams app to read, install, upgrade, and uninstall itself in any team, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -53929,7 +54066,7 @@ "adminDisplayName": "Allow the app to manage itself for all users", "adminDescription": "Allows a Teams app to read, install, upgrade, and uninstall itself to any user, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -53998,7 +54135,7 @@ "adminDisplayName": "Read all teams' settings", "adminDescription": "Read all team's settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -54059,13 +54196,13 @@ "userDisplayName": "Read and change teams' settings", "userDescription": "Read and change all teams' settings, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and change all teams' settings", "adminDescription": "Read and change all teams' settings, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -54164,13 +54301,13 @@ "userDisplayName": "Read and Write Teams policy user assignment and unassigment for all policy types.", "userDescription": "Allow the app to read or write/update the policy assignment and unassigment for Teams users for all policy type categories.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and Write Teams policy user assignment and unassigment for all policy types.", "adminDescription": "Allow the app to read or write/update the policy assignment and unassigment for Teams users for all policy type categories.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -54219,7 +54356,7 @@ "adminDisplayName": "Read Teams resource accounts", "adminDescription": "Allows the app to read your tenant's resource accounts without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -54256,7 +54393,7 @@ "adminDisplayName": "Create tabs in Microsoft Teams.", "adminDescription": "Allows the app to create tabs in any team in Microsoft Teams, without a signed-in user. This does not grant the ability to read, modify or delete tabs after they are created, or give access to the content inside the tabs.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -54401,7 +54538,7 @@ "adminDisplayName": "Read tabs in Microsoft Teams.", "adminDescription": "Read the names and settings of tabs inside any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs. ", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -54495,7 +54632,7 @@ "adminDisplayName": "Read and write tabs in Microsoft Teams.", "adminDescription": "Read and write tabs in any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -54679,7 +54816,7 @@ "adminDisplayName": "Allow the Teams app to manage all tabs for all chats", "adminDescription": "Allows a Teams app to read, install, upgrade, and uninstall all tabs for any chat, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -54761,7 +54898,7 @@ "adminDisplayName": "Allow the Teams app to manage all tabs for all teams", "adminDescription": "Allows a Teams app to read, install, upgrade, and uninstall all tabs in any team, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -54845,7 +54982,7 @@ "adminDisplayName": "Allow the Teams app to manage only its own tabs for all chats", "adminDescription": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any chat, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -54929,7 +55066,7 @@ "adminDisplayName": "Allow the Teams app to manage only its own tabs for all teams", "adminDescription": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in any team, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -54978,7 +55115,7 @@ "adminDisplayName": "Read Tenant-Acquired Telephone Number Details", "adminDescription": "Allows the app to read your tenant's acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55016,7 +55153,7 @@ "adminDisplayName": "Read and Modify Tenant-Acquired Telephone Number Details", "adminDescription": "Allows the app to read your tenant's acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55068,7 +55205,7 @@ "adminDisplayName": "Read Teams user configurations", "adminDescription": "Allows the app to read your tenant's user configurations, without a signed-in user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55129,7 +55266,7 @@ "adminDisplayName": "Read all available Teams Templates", "adminDescription": "Allows the app to read all available Teams Templates, without a signed-user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55165,7 +55302,7 @@ "adminDisplayName": "Create and update chat and channel messages with anyone's identity and with any timestamp", "adminDescription": "Allows the app to create and update chat and channel messages, without a signed in user. The app specifies which user appears as the sender, and can backdate the message to appear as if it was sent long ago. The messages can be sent to any chat or channel in the organization.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55277,7 +55414,7 @@ "adminDisplayName": "Read Teams app settings", "adminDescription": "Allows the app to read the Teams app settings without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55306,13 +55443,13 @@ "userDisplayName": "Read and write Teams app settings", "userDescription": "Allows the app to read and write the Teams app settings on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write Teams app settings", "adminDescription": "Allows the app to read and write the Teams app settings without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55334,6 +55471,7 @@ } }, "TeamworkCustomEmoji.Create": { + "authorizationType": "oAuth2", "schemes": { "DelegatedWork": { "adminDisplayName": "Create custom emoji", @@ -55362,12 +55500,13 @@ } }, "TeamworkCustomEmoji.Create.All": { + "authorizationType": "oAuth2", "schemes": { "Application": { "adminDisplayName": "Create custom emoji", "adminDescription": "Create custom emoji without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55388,6 +55527,7 @@ } }, "TeamworkCustomEmoji.Read": { + "authorizationType": "oAuth2", "schemes": { "DelegatedWork": { "adminDisplayName": "Read custom emoji", @@ -55416,12 +55556,13 @@ } }, "TeamworkCustomEmoji.Read.All": { + "authorizationType": "oAuth2", "schemes": { "Application": { "adminDisplayName": "Read custom emoji", "adminDescription": "Read custom emoji without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55456,7 +55597,7 @@ "adminDisplayName": "Read Teams devices", "adminDescription": "Allow the app to read the management data for Teams devices, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55492,13 +55633,13 @@ "userDisplayName": "Read and write Teams devices", "userDescription": "Allow the app to read and write the management data for Teams devices on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write Teams devices", "adminDescription": "Allow the app to read and write the management data for Teams devices, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55582,7 +55723,7 @@ "adminDisplayName": "Read all users' teamwork sections in Teams", "adminDescription": "Allows the app to read all users' teamwork sections (folders) for organizing chats and channels in Teams, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55690,7 +55831,7 @@ "adminDisplayName": "Read and write all users' teamwork sections in Teams", "adminDescription": "Allows the app to read and write all users' teamwork sections (folders) for organizing chats and channels in Teams, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55794,7 +55935,7 @@ "adminDisplayName": "Read tags in Teams", "adminDescription": "Allows the app to read tags in Teams without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55890,7 +56031,7 @@ "adminDisplayName": "Read and write tags in Teams", "adminDescription": "Allows the app to read and write tags in Teams without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55955,7 +56096,7 @@ "adminDisplayName": "Read all targeted messages of group chat or channel", "adminDescription": "Allows the app to read all group chat or channel targeted messages in Microsoft Teams.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -55985,7 +56126,7 @@ "userDisplayName": "Update targeted messages belonging to the user", "userDescription": "Update targeted messages of group chat or channel on your behalf", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56062,7 +56203,7 @@ "userDisplayName": "Read Tenant Governance invitations", "userDescription": "Allows the application to list and read all Tenant Governance invitations.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56093,7 +56234,7 @@ "userDisplayName": "Read and write Tenant Governance invitations", "userDescription": "Allows the application to list, read, create, and delete Tenant Governance invitations on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56153,7 +56294,7 @@ "userDisplayName": "Read Tenant Governance policy templates", "userDescription": "Allows the application to list and read all Tenant Governance policy templates.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56184,7 +56325,7 @@ "userDisplayName": "Read and write Tenant Governance policy templates", "userDescription": "Allows the application to list, read, create, update, and delete Tenant Governance policy templates on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56255,7 +56396,7 @@ "userDisplayName": "Read related tenants", "userDescription": "Allows the application to list and read related tenants information.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56287,7 +56428,7 @@ "userDisplayName": "Read and write related tenants", "userDescription": "Allows the application to list, read, and refresh related tenants information on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56337,7 +56478,7 @@ "userDisplayName": "Read Tenant Governance relationships", "userDescription": "Allows the application to list and read all Tenant Governance relationships.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56368,7 +56509,7 @@ "userDisplayName": "Read and write Tenant Governance relationships", "userDescription": "Allows the application to list, read, and update Tenant Governance relationships on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56417,7 +56558,7 @@ "userDisplayName": "Read Tenant Governance requests", "userDescription": "Allows the application to list and read all Tenant Governance requests.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56448,7 +56589,7 @@ "userDisplayName": "Read and write Tenant Governance requests", "userDescription": "Allows the application to list, read, create, and update Tenant Governance requests on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56508,7 +56649,7 @@ "userDisplayName": "Read Tenant Governance settings", "userDescription": "Allows the application to read Tenant Governance settings.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56538,7 +56679,7 @@ "userDisplayName": "Read and write Tenant Governance settings", "userDescription": "Allows the application to read Tenant Governance settings and update them on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56740,7 +56881,7 @@ "adminDisplayName": "Read threat assessment requests", "adminDescription": "Allows an app to read your organization's threat assessment requests, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56817,7 +56958,7 @@ "adminDisplayName": "Run hunting queries", "adminDescription": "Allows the app to run hunting queries, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56865,7 +57006,7 @@ "adminDisplayName": "Read all threat indicators", "adminDescription": "Allows the app to read all the indicators for your organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [], @@ -56888,7 +57029,7 @@ "adminDisplayName": "Manage threat indicators this app creates or owns", "adminDescription": "Allows the app to create threat indicators, and fully manage those threat indicators (read, update and delete), without a signed-in user. It cannot update any threat indicators it does not own.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -56954,7 +57095,7 @@ "adminDisplayName": "Read all Threat Intelligence Information", "adminDescription": "Allows the app to read threat intellgence information, such as indicators, observations, and and articles, without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57015,7 +57156,7 @@ "adminDisplayName": "Read all of the organization's threat submissions", "adminDescription": "Allows the app to read your organization's threat submissions and to view threat submission policies without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57058,7 +57199,7 @@ "adminDisplayName": "Read and write all of the organization's threat submissions", "adminDescription": "Allows the app to read your organization's threat submissions and threat submission policies without a signed-in user. Also allows the app to create new threat submissions without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57123,7 +57264,7 @@ "adminDisplayName": "Read and write all of the organization's threat submission policies", "adminDescription": "Allows the app to read your organization's threat submission policies without a signed-in user. Also allows the app to create new threat submission polices without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57185,7 +57326,7 @@ "adminDisplayName": "Read trust framework key sets", "adminDescription": "Allows the app to read trust framework key set properties without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57223,7 +57364,7 @@ "adminDisplayName": "Read and write trust framework key sets", "adminDescription": "Allows the app to read and write trust framework key set properties without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57314,13 +57455,13 @@ "userDisplayName": "Convert an external user to internal member user", "userDescription": "Allow the app to convert an external user to an internal member user on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Convert an external user to internal member user", "adminDescription": "Allow the app to convert an external user to an internal member user, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57350,13 +57491,13 @@ "userDisplayName": "Update other mails property for all users", "userDescription": "Allows the app to Update other mails property for all users, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Update other mails property for all users", "adminDescription": "Allows the app to update other mails property for all users, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57392,7 +57533,7 @@ "adminDisplayName": "Read and update the on-premises sync behavior of users", "adminDescription": "Allows the app to update the on-premises sync behavior of all users without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57424,13 +57565,13 @@ "userDisplayName": "Update password profile property and reset password for all users", "userDescription": "Allows the app to update password profile property and reset password for all users, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Update password profile property and reset password for all users", "adminDescription": "Allows the app to update password profile property and reset password for all users, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57471,13 +57612,13 @@ "userDisplayName": "Update business phones and mobile phone properties for all users", "userDescription": "Allows the app to update business phones and mobile phone properties for all users, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Update business phones and mobile phone properties for all users", "adminDescription": "Allows the app to update business phones and mobile phone properties for all users, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57507,13 +57648,13 @@ "userDisplayName": "Delete and restore user accounts", "userDescription": "Allows the app to delete and restore users' accounts, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Delete and restore user accounts", "adminDescription": "Allows the app to delete and restore users' accounts, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57555,13 +57696,13 @@ "userDisplayName": "Enable and disable user accounts", "userDescription": "Allows the app to enable and disable users' accounts, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Enable and disable user accounts", "adminDescription": "Allows the app to enable and disable users' accounts, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57596,7 +57737,7 @@ "adminDisplayName": "Export user's data", "adminDescription": "Allows the app to export data (e.g. customer content or system-generated logs), associated with any user in your company, when the app is used by a privileged user (e.g. a Company Administrator).", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57638,13 +57779,13 @@ "userDisplayName": "Invite guest users to the organization", "userDescription": "Allows the app to invite guest users to the organization, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Invite guest users to the organization", "adminDescription": "Allows the app to invite guest users to the organization, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -57680,7 +57821,7 @@ "adminDisplayName": "Manage all users' identities", "adminDescription": "Allows the app to read, update and delete identities that are associated with a user's account, without a signed in user. This controls the identities users can sign-in with.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -58021,7 +58162,7 @@ "adminDisplayName": "Read all users' full profiles and company properties", "adminDescription": "Allows the app to read the full set of user properties of all users in the organization and read company properties without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -58360,7 +58501,7 @@ "adminDisplayName": "Read all users' basic profiles", "adminDescription": "Allows the app to read a basic set of profile properties of users in your organization, without a signed-in user. This includes display name, first and last name, email address, photo, id and security identifier.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -58886,13 +59027,13 @@ "userDisplayName": "Read and write all users' full profiles", "userDescription": "Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, and read basic company properties, on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' full profiles", "adminDescription": "Allows the app to read and update user profiles and read basic company properties without a signed in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -59446,13 +59587,13 @@ "userDisplayName": "Revokes all sign in sessions for a user", "userDescription": "Allow the app to revoke all sign in sessions for a user on your behalf.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Revoke all sign in sessions for a user", "adminDescription": "Allow the app to revoke all sign in sessions for a user, without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -59643,7 +59784,7 @@ "adminDisplayName": " Read all users' authentication methods", "adminDescription": " Allows the app to read authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user's phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -59918,13 +60059,13 @@ "userDisplayName": "Read and write all users' authentication methods", "userDescription": "Allows the app to read and write authentication methods of all users you have access to in your organization. Authentication methods include things like a user's phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 }, "Application": { "adminDisplayName": "Read and write all users' authentication methods ", "adminDescription": "Allows the application to read and write authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user's phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods", "requiresAdminConsent": true, - "privilegeLevel": 5 + "privilegeLevel": 4 } }, "pathSets": [ @@ -60185,7 +60326,7 @@ "adminDisplayName": "Read all users' email methods", "adminDescription": "Allows the app to read email methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -60285,13 +60426,13 @@ "userDisplayName": "Read and write all users' email methods", "userDescription": "Allows the app to read and write email methods of all users you have access to in your organization. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' email methods", "adminDescription": "Allows the application to read and write email methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -60418,7 +60559,7 @@ "adminDisplayName": "Read all users' external authentication methods", "adminDescription": "Allows the app to read external authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -60501,13 +60642,13 @@ "userDisplayName": "Read and write all users' external authentication methods", "userDescription": "Allows the app to read and write external authentication methods of all users you have access to in your organization. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' external authentication methods", "adminDescription": "Allows the application to read and write external authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -60600,7 +60741,7 @@ "adminDisplayName": "Read all users' HardwareOATH authentication methods", "adminDescription": "Allows the app to read HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -60707,13 +60848,13 @@ "userDisplayName": "Read and write all users' HardwareOATH authentication methods", "userDescription": "Allows the app to read and write HardwareOATH authentication methods of all users you have access to in your organization. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' HardwareOATH authentication methods", "adminDescription": "Allows the application to read and write HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -60852,7 +60993,7 @@ "adminDisplayName": "Read all users' Microsoft authentication methods", "adminDescription": "Allows the app to read Microsoft authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -60949,13 +61090,13 @@ "userDisplayName": "Read and write all users' Microsoft Authentication methods", "userDescription": "Allows the app to read and write Microsoft Authentication methods of all users you have access to in your organization. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' Microsoft Authentication methods", "adminDescription": "Allows the application to read and write Microsoft Authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -61065,7 +61206,7 @@ "adminDisplayName": "Read all users' passkey authentication methods", "adminDescription": "Allows the app to read passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -61153,13 +61294,13 @@ "userDisplayName": "Read and write all users' passkey authentication methods", "userDescription": "Allows the app to read and write passkey authentication methods of all users you have access to in your organization. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' passkey authentication methods", "adminDescription": "Allows the application to read and write passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -61255,7 +61396,7 @@ "adminDisplayName": "Read all users' password authentication methods", "adminDescription": "Allows the app to read password authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -61332,13 +61473,13 @@ "userDisplayName": "Read and write all users' password authentication methods", "userDescription": "Allows the app to read and write password authentication methods of all users you have access to in your organization. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' password authentication methods", "adminDescription": "Allows the application to read and write password authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -61431,7 +61572,7 @@ "adminDisplayName": "Read all users' phone authentication methods", "adminDescription": "Allows the app to read phone authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -61535,13 +61676,13 @@ "userDisplayName": "Read and write all users' phone methods", "userDescription": "Allows the app to read and write phone methods of all users you have access to in your organization. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' phone methods", "adminDescription": "Allows the application to read and write phone methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -61685,7 +61826,7 @@ "adminDisplayName": "Read all users' platform credentials methods", "adminDescription": "Allows the app to read platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -61772,13 +61913,13 @@ "userDisplayName": "Read and write all users' platform credentials methods", "userDescription": "Allows the app to read and write platform credentials methods of all users you have access to in your organization. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' platform credentials methods", "adminDescription": "Allows the application to read and write platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -61886,7 +62027,7 @@ "adminDisplayName": "Read all users' QR methods", "adminDescription": "Allows the app to read QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -62000,13 +62141,13 @@ "userDisplayName": "Read and write all users' QR methods", "userDescription": "Allows the app to read and write QR authentication methods of all users you have access to in your organization. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' QR methods", "adminDescription": "Allows the application to read and write QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -62131,13 +62272,13 @@ "userDisplayName": "Read and delete the keys associated with the user representing a resource account.", "userDescription": "Allows the user to read and delete the keys associated with the user representing a resource account.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and delete all users' external authentication methods", "adminDescription": "Allows the app to read and delete the keys associated with the user representing a resource account.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -62218,7 +62359,7 @@ "adminDisplayName": "Read all users' SoftwareOATH methods", "adminDescription": "Allows the app to read SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -62305,13 +62446,13 @@ "userDisplayName": "Read and write all users' SoftwareOATH methods", "userDescription": "Allows the app to read and write SoftwareOATH authentication methods of all users you have access to in your organization. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' SoftwareOATH methods", "adminDescription": "Allows the application to read and write SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -62415,7 +62556,7 @@ "adminDisplayName": "Read all users' Temporary Access Pass methods", "adminDescription": "Allows the app to read Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -62513,13 +62654,13 @@ "userDisplayName": "Read and write all users' Temporary Access Pass methods", "userDescription": "Allows the app to read and write Temporary Access Pass authentication methods of all users you have access to in your organization. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' Temporary Access Pass methods", "adminDescription": "Allows the application to read and write Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -62646,7 +62787,7 @@ "adminDisplayName": "Read all users' Windows Hello methods", "adminDescription": "Allows the app to read Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -62733,13 +62874,13 @@ "userDisplayName": "Read and write all users' Windows Hello methods", "userDescription": "Allows the app to read and write Windows Hello authentication methods of all users you have access to in your organization. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 }, "Application": { "adminDisplayName": "Read and write all users' Windows Hello authentication methods", "adminDescription": "Allows the application to read and write Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -62842,7 +62983,7 @@ "adminDisplayName": "Read all user shift preferences", "adminDescription": "Allows the app to read all users' shift schedule preferences without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -62867,7 +63008,7 @@ "adminDisplayName": "Read and write all user shift preferences", "adminDescription": "Allows the app to manage all users' shift schedule preferences without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -62922,7 +63063,7 @@ "adminDisplayName": "Read all user teamwork settings", "adminDescription": "Allows the app to read all user teamwork settings without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -63062,7 +63203,7 @@ "adminDisplayName": "Read Verified Id profiles", "adminDescription": "This role can read Verified Id profiles in a tenant.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -63093,7 +63234,7 @@ "userDisplayName": "Read and write Verified Id profiles", "userDescription": "This role can read and write Verified Id profiles in a tenant.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -63154,7 +63295,7 @@ "adminDisplayName": "Read all virtual appointments for users, as authorized by online meetings application access policy", "adminDescription": "Allows the application to read virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user's data by the online meetings application access policy.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -63212,7 +63353,7 @@ "adminDisplayName": "Read-write all virtual appointments for users, as authorized by online meetings app access policy", "adminDescription": "Allows the application to read and write virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user's data by the online meetings application access policy.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -63233,6 +63374,7 @@ } }, "VirtualAppointmentNotification.Send": { + "authorizationType": "oAuth2", "schemes": { "DelegatedWork": { "adminDisplayName": "Send notification regarding virtual appointments for the signed-in user", @@ -63246,7 +63388,7 @@ "adminDisplayName": "Send notification regarding virtual appointments as any user", "adminDescription": "Allows the application to send notification regarding virtual appointments as any user, without a signed-in user. The app must also be authorized to access an individual user's data by the online meetings application access policy.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -63330,7 +63472,7 @@ "userDisplayName": "Read your virtual events", "userDescription": "Allows the app to read all virtual events without a signed-in user", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -63560,7 +63702,7 @@ "adminDisplayName": "Read all Windows update deployment settings", "adminDescription": "Allows the app to read all Windows update deployment settings for the organization without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ @@ -63641,7 +63783,7 @@ "adminDisplayName": "Read and write all Windows update deployment settings", "adminDescription": "Allows the app to read and write all Windows update deployment settings for the organization without a signed-in user.", "requiresAdminConsent": true, - "privilegeLevel": 4 + "privilegeLevel": 3 } }, "pathSets": [ diff --git a/permissions/new/provisioningInfo.json b/permissions/new/provisioningInfo.json index d0ffe9fc..b55edea2 100644 --- a/permissions/new/provisioningInfo.json +++ b/permissions/new/provisioningInfo.json @@ -362,6 +362,46 @@ "resourceAppId": "00000002-0000-0000-c000-000000000000" } ], + "AgentCommunicationConfiguration.Read": [ + { + "id": "d01e70c9-c10b-4118-b5fd-7d5a4161afa5", + "scheme": "DelegatedWork", + "environment": "PPE;public", + "isHidden": true, + "isEnabled": true, + "resourceAppId": "ab3be6b7-f5df-413d-ac2d-abf1e3fd9c0b" + } + ], + "AgentCommunicationConfiguration.Read.All": [ + { + "id": "4c8a935b-d2f3-4664-a8fa-941d7a064af7", + "scheme": "Application", + "environment": "PPE;public", + "isHidden": true, + "isEnabled": true, + "resourceAppId": "ab3be6b7-f5df-413d-ac2d-abf1e3fd9c0b" + } + ], + "AgentCommunicationConfiguration.ReadWrite": [ + { + "id": "ba73006a-a3cf-419f-bfb6-459fd44d5932", + "scheme": "DelegatedWork", + "environment": "PPE;public", + "isHidden": true, + "isEnabled": true, + "resourceAppId": "ab3be6b7-f5df-413d-ac2d-abf1e3fd9c0b" + } + ], + "AgentCommunicationConfiguration.ReadWrite.All": [ + { + "id": "21c97e25-9a86-4fd3-b368-27c48af755f3", + "scheme": "Application", + "environment": "PPE;public", + "isHidden": true, + "isEnabled": true, + "resourceAppId": "ab3be6b7-f5df-413d-ac2d-abf1e3fd9c0b" + } + ], "AgentIdentityBlueprint.Read.All": [ { "id": "", @@ -9011,7 +9051,7 @@ "id": "3d09c9ee-9db9-4c84-85ec-f63a21b4ad2c", "scheme": "DelegatedWork", "environment": "public", - "isHidden": true, + "isHidden": false, "isEnabled": true, "resourceAppId": "ce79fdc4-cd1d-4ea5-8139-e74d7dbe0bb7" }, @@ -9019,7 +9059,7 @@ "id": "75d9ca3df-7017-4feb-baa0-06a339b6c338", "scheme": "Application", "environment": "public", - "isHidden": true, + "isHidden": false, "isEnabled": true, "resourceAppId": "ce79fdc4-cd1d-4ea5-8139-e74d7dbe0bb7" } @@ -9029,7 +9069,7 @@ "id": "f6fdb5f4-56bf-4daf-bb35-0b5ccdf56c4c", "scheme": "DelegatedWork", "environment": "public", - "isHidden": true, + "isHidden": false, "isEnabled": true, "resourceAppId": "ce79fdc4-cd1d-4ea5-8139-e74d7dbe0bb7" }, @@ -9037,7 +9077,7 @@ "id": "079f94bb-be92-4268-b63c-ce4fb09f4318", "scheme": "Application", "environment": "public", - "isHidden": true, + "isHidden": false, "isEnabled": true, "resourceAppId": "ce79fdc4-cd1d-4ea5-8139-e74d7dbe0bb7" } @@ -13041,11 +13081,11 @@ ], "Calls.ReportSyntheticMedia.All": [ { - "id": "e4d4cb9c-a3d1-425d-90a2-8504eb334d6b", + "id": "050b0d28-840a-4ff6-bdf9-cc6221acbc1f", "scheme": "Application", "environment": "public", - "isHidden": true, - "isEnabled": false, + "isHidden": false, + "isEnabled": true, "resourceAppId": "26a18ebc-cdf7-4a6a-91cb-beb352805e81" } ],