Merge pull request #23451 from microsoftgraph/main

Merge to publish.

.github/policies/resourceManagement.yml

@@ -8,42 +8,6 @@ where:
 configuration:
   resourceManagementConfiguration:
     scheduledSearches:
-    - description: Add no recent activity label to pull requests labeled do not merge with no activity for 60 days
-      frequencies:
-      - daily:
-          time: 11:0
-      filters:
-      - isOpen
-      - isPullRequest
-      - hasLabel:
-          label: do not merge
-      - noActivitySince:
-          days: 60
-      - isNotLabeledWith:
-          label: content review complete
-      actions:
-      - addLabel:
-          label: no recent activity
-      - addReply:
-          reply: >-
-            This PR has been automatically marked as stale because it has been labeled "do not merge" but has not had any activity for **60 days**. It will be closed if no further activity occurs **within 7 days of this comment**.
-
-
-            If you still intend to merge this pull request eventually, please add a comment to keep this open, and update the status labels accordingly.
-    - description: Close pull requests with no recent activity label with no activity for 7 days
-      frequencies:
-      - daily:
-          time: 11:0
-      filters:
-      - isOpen
-      - hasLabel:
-          label: do not merge
-      - hasLabel:
-          label: no recent activity
-      - noActivitySince:
-          days: 7
-      actions:
-      - closeIssue
     - description: Close issues with needs more info label with no activity for 14 days
       frequencies:
       - hourly:
@@ -85,66 +49,6 @@ configuration:
       actions:
       - addLabel:
           label: MSTeams-Developer-Support
-    - description: Add reminder to pull requests with changes requested label with no activity for 14 days
-      frequencies:
-      - hourly:
-          hour: 6
-      filters:
-      - noActivitySince:
-          days: 14
-      - hasLabel:
-          label: changes requested
-      - isPullRequest
-      - isOpen
-      - isNotLabeledWith:
-          label: blocked
-      actions:
-      - addReply:
-          reply: >-
-            > [!NOTE]
-
-            > The following guidance is for Microsoft employees only. Community contributors can ignore this message; our content team will manage the status.
-
-            Hello, @${issueAuthor}.
-
-
-            Your PR has been in "Changes requested" state for more than 2 weeks.
-
-
-            Please address the feedback left by your reviewer. Feel free to ping your reviewer on the side if you have any questions.
-
-
-            Thank you!
-    - description: Add reminder to pull requests with content review complete label with no activity for 14 days
-      frequencies:
-      - hourly:
-          hour: 6
-      filters:
-      - noActivitySince:
-          days: 14
-      - hasLabel:
-          label: content review complete
-      - isPullRequest
-      - isOpen
-      - isNotLabeledWith:
-          label: blocked
-      actions:
-      - addReply:
-          reply: >-
-            > [!NOTE]
-
-            > The following guidance is for Microsoft employees only. Community contributors can ignore this message; our content team will manage the status.
-
-            Hello, @${issueAuthor}.
-
-
-            Your PR was approved by your reviewer more than 2 weeks ago.
-
-
-            Please add the label "ready to merge" when you are ready to publish your PR.
-
-
-            Thank you!
     eventResponderTasks:
     - description: 'Close issues when they are labeled question, serviceissue, or request: feature'
       if:
@@ -180,17 +84,6 @@ configuration:
       - addReply:
           reply: "This issue will be closed because we do not support feedback captured directly from the GitHub new issue page. Also, this issues list is not intended for service issues, questions, or service feedback.\n\nTo provide feedback on [Microsoft Graph documentation](https://learn.microsoft.com/graph/overview), please scroll to the **Feedback** section at the bottom of the related documentation page. You can click **This page** and create new feedback there. This gives the team the necessary context of your feedback.\n\nIf you have service issues and want to raise a support request, and if one of the following applies:\n- You are an administrator of an active Azure subscription - raise a new technical support ticket at the **[Azure Admin Center](https://ms.portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/newsupportreq)**.\n- You are an administrator of an Office 365 or Microsoft 365 tenant - raise a new service request using the **Support** menu in the **[Microsoft 365 Admin Center](https://admin.microsoft.com)**.\n- You are an administrator of a Microsft Entra service - raise a new technical support ticket at the **[Microsoft Entra admin center](https://entra.microsoft.com/#view/Microsoft_Azure_Support/NewSupportRequestV3Blade/callerName/ActiveDirectory/issueType/technical)**.\n\nIf you would like to ask a question about Microsoft Graph, please visit [Microsoft Q&A](https://aka.ms/askGraph). \n\nIf you have suggestions or feedback on Microsoft Graph, please visit [Microsoft Feedback](https://aka.ms/graphfeedback).\n\nIf you are looking to provide feedback or raise issues on Microsoft Graph SDKs, please visit the [respective Github repo](https://github.com/microsoftgraph?utf8=%E2%9C%93&q=sdk&type=&language=). "
       - closeIssue
-    - description: Remove no recent activity label if pull request is updated
-      if:
-      - payloadType: Pull_Request
-      - not:
-          isAction:
-            action: Closed
-      - hasLabel:
-          label: no recent activity
-      then:
-      - removeLabel:
-          label: no recent activity
     - description: Remove no recent activity label if issue receives a comment
       if:
       - payloadType: Issue_Comment

api-reference/beta/api/identitygovernance-taskprocessingresult-resume.md

@@ -24,11 +24,12 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "identitygovernance_taskprocessingresult_resume" } -->
 [!INCLUDE [permissions-table](../includes/permissions/identitygovernance-taskprocessingresult-resume-permissions.md)]
 
-[!INCLUDE [rbac-lifecycle-workflows-apis-write](../includes/rbac-for-apis/rbac-lifecycle-workflows-apis-write.md)].
+[!INCLUDE [rbac-lifecycle-workflows-apis-write](../includes/rbac-for-apis/rbac-lifecycle-workflows-apis-write.md)]
 
 > [!IMPORTANT]
-> Apps specified in `authorizedApps` within the [customTaskExtensionCallbackConfiguration](../resources/identitygovernance-customtaskextensioncallbackconfiguration.md) of the [custom task extension](../resources/identitygovernance-customtaskextension.md) are allowed to resume the task processing result without application permissions or role assignments.
-> The app specified in `resourceId` within the [azureAdTokenAuthentication](../resources/identitygovernance-customtaskextensioncallbackconfiguration.md) of the [custom task extension](../resources/identitygovernance-customtaskextension.md) is allowed to resume the task processing result without an application permission or role assignment.
+> The following applies to app-only access to better follow the principle of least privilege:
+> - Apps specified in `authorizedApps` within the [customTaskExtensionCallbackConfiguration](../resources/identitygovernance-customtaskextensioncallbackconfiguration.md) of the [custom task extension](../resources/identitygovernance-customtaskextension.md) are allowed to resume the task processing result without application permissions or role assignments.
+> - The app specified in `resourceId` within the [azureAdTokenAuthentication](../resources/identitygovernance-customtaskextensioncallbackconfiguration.md) of the [custom task extension](../resources/identitygovernance-customtaskextension.md) is allowed to resume the task processing result without an application permission or role assignment.
 
 ## HTTP request
 

api-reference/beta/includes/permissions/learningcontent-get-permissions.md

@@ -6,7 +6,7 @@ ms.localizationpriority: medium
 
 |Permission type|Least privileged permissions|Higher privileged permissions|
 |:---|:---|:---|
-|Delegated (work or school account)|Not supported.|Not supported.|
+|Delegated (work or school account)|LearningContent.Read.All|Not available.|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
 |Application|LearningContent.Read.All|LearningContent.ReadWrite.All|
 

api-reference/beta/includes/permissions/learningprovider-list-learningcontents-permissions.md

@@ -6,7 +6,7 @@ ms.localizationpriority: medium
 
 |Permission type|Least privileged permissions|Higher privileged permissions|
 |:---|:---|:---|
-|Delegated (work or school account)|Not supported.|Not supported.|
+|Delegated (work or school account)|LearningContent.Read.All|Not available.|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
 |Application|LearningContent.Read.All|LearningContent.ReadWrite.All|
 

api-reference/beta/includes/permissions/teamworktag-list-permissions.md

@@ -6,7 +6,7 @@ ms.localizationpriority: medium
 
 |Permission type|Least privileged permissions|Higher privileged permissions|
 |:---|:---|:---|
-|Delegated (work or school account)|TeamworkTag.ReadWrite|TeamworkTag.Read|
+|Delegated (work or school account)|TeamworkTag.Read|TeamworkTag.ReadWrite|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|TeamworkTag.ReadWrite.All|TeamworkTag.Read.All|
+|Application|TeamworkTag.Read.All|TeamworkTag.ReadWrite.All|
 

api-reference/beta/includes/permissions/user-list-approleassignedresources-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|Directory.Read.All|AppRoleAssignment.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|AppRoleAssignment.ReadWrite.All|
+|Application|AppRoleAssignment.ReadWrite.All|Not available.|
 

api-reference/beta/includes/permissions/user-list-directreports-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, User.Read.All, User.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/beta/includes/permissions/user-list-licensedetails-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, User.Read.All, User.ReadWrite.All|
 |Delegated (personal Microsoft account)|User.Read|Not available.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/beta/includes/permissions/user-list-manager-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read.All|Directory.Read.All, Directory.ReadWrite.All, User.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/beta/includes/permissions/user-list-memberof-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, GroupMember.Read.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/beta/includes/permissions/user-list-oauth2permissiongrants-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|Directory.Read.All|DelegatedPermissionGrant.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|DelegatedPermissionGrant.ReadWrite.All|
+|Application|DelegatedPermissionGrant.ReadWrite.All|Not available.|
 

api-reference/beta/includes/permissions/user-list-ownedobjects-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, User.Read.All, User.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/beta/includes/permissions/user-list-registereddevices-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, User.Read.All, User.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/beta/includes/permissions/user-list-scopedrolememberof-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|Directory.Read.All|Directory.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/beta/includes/permissions/user-list-transitivememberof-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, Group.Read.All, GroupMember.Read.All, User.Read.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|User.Read.All|Directory.Read.All, Directory.ReadWrite.All, Group.Read.All, GroupMember.Read.All|
+|Application|Not supported.|Not supported.|
 

api-reference/beta/includes/permissions/user-revokesigninsessions-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.ReadWrite.All|Directory.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.ReadWrite.All|Not available.|
+|Application|Not supported.|Not supported.|
 

api-reference/v1.0/api/identitygovernance-taskprocessingresult-resume.md

@@ -22,11 +22,12 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "identitygovernance_taskprocessingresult_resume" } -->
 [!INCLUDE [permissions-table](../includes/permissions/identitygovernance-taskprocessingresult-resume-permissions.md)]
 
-[!INCLUDE [rbac-lifecycle-workflows-apis-write](../includes/rbac-for-apis/rbac-lifecycle-workflows-apis-write.md)].
+[!INCLUDE [rbac-lifecycle-workflows-apis-write](../includes/rbac-for-apis/rbac-lifecycle-workflows-apis-write.md)]
 
 > [!IMPORTANT]
-> Apps specified in `authorizedApps` within the [customTaskExtensionCallbackConfiguration](../resources/identitygovernance-customtaskextensioncallbackconfiguration.md) of the [custom task extension](../resources/identitygovernance-customtaskextension.md) are allowed to resume the task processing result without application permissions or role assignments.
-> The app specified in `resourceId` within the [azureAdTokenAuthentication](../resources/identitygovernance-customtaskextensioncallbackconfiguration.md) of the [custom task extension](../resources/identitygovernance-customtaskextension.md) is allowed to resume the task processing result without an application permission or role assignment.
+ The following applies to app-only access to better follow the principle of least privilege:
+> - Apps specified in `authorizedApps` within the [customTaskExtensionCallbackConfiguration](../resources/identitygovernance-customtaskextensioncallbackconfiguration.md) of the [custom task extension](../resources/identitygovernance-customtaskextension.md) are allowed to resume the task processing result without application permissions or role assignments.
+> - The app specified in `resourceId` within the [azureAdTokenAuthentication](../resources/identitygovernance-customtaskextensioncallbackconfiguration.md) of the [custom task extension](../resources/identitygovernance-customtaskextension.md) is allowed to resume the task processing result without an application permission or role assignment.
 
 ## HTTP request
 

api-reference/v1.0/includes/permissions/learningcontent-get-permissions.md

@@ -6,7 +6,7 @@ ms.localizationpriority: medium
 
 |Permission type|Least privileged permissions|Higher privileged permissions|
 |:---|:---|:---|
-|Delegated (work or school account)|Not supported.|Not supported.|
+|Delegated (work or school account)|LearningContent.Read.All|Not available.|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
 |Application|LearningContent.Read.All|LearningContent.ReadWrite.All|
 

api-reference/v1.0/includes/permissions/learningprovider-list-learningcontents-permissions.md

@@ -6,7 +6,7 @@ ms.localizationpriority: medium
 
 |Permission type|Least privileged permissions|Higher privileged permissions|
 |:---|:---|:---|
-|Delegated (work or school account)|Not supported.|Not supported.|
+|Delegated (work or school account)|LearningContent.Read.All|Not available.|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
 |Application|LearningContent.Read.All|LearningContent.ReadWrite.All|
 

api-reference/v1.0/includes/permissions/teamworktag-list-permissions.md

@@ -6,7 +6,7 @@ ms.localizationpriority: medium
 
 |Permission type|Least privileged permissions|Higher privileged permissions|
 |:---|:---|:---|
-|Delegated (work or school account)|TeamworkTag.ReadWrite|TeamworkTag.Read|
+|Delegated (work or school account)|TeamworkTag.Read|TeamworkTag.ReadWrite|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|TeamworkTag.ReadWrite.All|TeamworkTag.Read.All|
+|Application|TeamworkTag.Read.All|TeamworkTag.ReadWrite.All|
 

api-reference/v1.0/includes/permissions/user-list-licensedetails-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, User.Read.All, User.ReadWrite.All|
 |Delegated (personal Microsoft account)|User.Read|Not available.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/v1.0/includes/permissions/user-list-manager-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read.All|Directory.Read.All, Directory.ReadWrite.All, User.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/v1.0/includes/permissions/user-list-memberof-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, GroupMember.Read.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/v1.0/includes/permissions/user-list-oauth2permissiongrants-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|Directory.Read.All|DelegatedPermissionGrant.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|DelegatedPermissionGrant.ReadWrite.All|
+|Application|DelegatedPermissionGrant.ReadWrite.All|Not available.|
 

api-reference/v1.0/includes/permissions/user-list-owneddevices-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, User.Read.All, User.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/v1.0/includes/permissions/user-list-ownedobjects-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, User.Read.All, User.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/v1.0/includes/permissions/user-list-registereddevices-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, User.Read.All, User.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.Read.All|Directory.ReadWrite.All|
+|Application|Not supported.|Not supported.|
 

api-reference/v1.0/includes/permissions/user-list-transitivememberof-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, Group.Read.All, GroupMember.Read.All, User.Read.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|User.Read.All|Directory.Read.All, Directory.ReadWrite.All, Group.Read.All, GroupMember.Read.All|
+|Application|Not supported.|Not supported.|
 

api-reference/v1.0/includes/permissions/user-revokesigninsessions-permissions.md

@@ -8,5 +8,5 @@ ms.localizationpriority: medium
 |:---|:---|:---|
 |Delegated (work or school account)|User.ReadWrite.All|Directory.ReadWrite.All|
 |Delegated (personal Microsoft account)|Not supported.|Not supported.|
-|Application|Directory.ReadWrite.All|Not available.|
+|Application|Not supported.|Not supported.|