Update overview-assign-app-owners.md #1842
Conversation
Updating per internal Epic 1436967
|
Learn Build status updates of commit 1b38a4a: ✅ Validation status: passed
For more details, please refer to the build report. |
There was a problem hiding this comment.
Pull request overview
This PR adds a new NOTE block to the enterprise application ownership documentation to clarify limitations for application owners added through non-UI methods (Graph API, PowerShell). This addresses internal Epic 1436967 by documenting that such owners have restricted management capabilities compared to those added through the Entra admin center.
Key Changes
- Added a NOTE block explaining that application owners added via Graph API or PowerShell have limited access to certain enterprise application settings
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| > The application may have more permissions than the owner, and thus would be an elevation of privilege over what the owner has access to as a user. An application owner can create or update users or other objects while impersonating the application. The elevation of privilege to owners can raise a security concern in some cases depending on the application's permissions. | ||
| > [!NOTE] | ||
| > Currently due to background applications and service principals objects settings dependencies, the application owners added by other than Entra admin center means (Graph API, PowerShell), will not be able to manage some enterprise applications settings like attributes and claims, modify configured SAML certificates properties or token encryption settings, etc. |
There was a problem hiding this comment.
The sentence is overly long and complex, making it difficult to read. Consider breaking it into two sentences or restructuring for better clarity. For example: "Currently, due to background applications and service principals object settings dependencies, application owners added by means other than the Entra admin center (such as Graph API or PowerShell) have limited management capabilities. They will not be able to manage certain enterprise application settings, such as attributes and claims, SAML certificate properties, or token encryption settings."
| > Currently due to background applications and service principals objects settings dependencies, the application owners added by other than Entra admin center means (Graph API, PowerShell), will not be able to manage some enterprise applications settings like attributes and claims, modify configured SAML certificates properties or token encryption settings, etc. | |
| > Currently, due to dependencies related to background applications and service principal object settings, application owners who are added by means other than the Entra admin center (such as Graph API or PowerShell) have limited management capabilities. They will not be able to manage certain enterprise application settings, such as attributes and claims, SAML certificate properties, or token encryption settings. |
|
@secherka : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
prmerger-automator
bot
added
Change sent to author
enterprise-apps/subsvc
entra-id/svc
labels
|
@secherka - This PR was opened in the public repo. FTEs should work in the private repo if possible. I see that you submitted a PR to the private repo last year. If feasible, add a Otherwise, @omondiatieno - Could you please review and sign off if you approve? IMPORTANT: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
3 participants
Updating per internal Epic 1436967 https://identitydivision.visualstudio.com/Engineering/_workitems/edit/1436967