Weekly Permissions sync 2025-12-26 #1392
Conversation
There was a problem hiding this comment.
Pull request overview
This PR implements a weekly permissions sync that adds support for conditional access classic policies endpoints. The changes introduce new API path permissions for reading the classic policies collection and updating individual classic policy resources.
- Adds GET permission for
/identity/conditionalaccess/classicpoliciescollection endpoint - Adds PATCH permission for
/identity/conditionalaccess/classicpolicies/{id}individual resource endpoint - Updates both the
Policy.Read.AllandPolicy.ReadWrite.ConditionalAccesspermission scopes
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| { | ||
| "schemeKeys": [ | ||
| "DelegatedWork" | ||
| ], | ||
| "methods": [ | ||
| "PATCH" | ||
| ], | ||
| "paths": { | ||
| "/identity/conditionalaccess/classicpolicies/{id}": "least=DelegatedWork" | ||
| } | ||
| }, |
There was a problem hiding this comment.
The permissions define a PATCH method for the individual classicpolicies resource but no GET method. This is inconsistent with similar conditional access resources in this file. For example, vpnconnectivitycertificates has GET defined for both the collection and individual resources (lines 37040-37046), and namedlocations and policies have GET, PATCH, and DELETE combined for individual resources (line 36937-36950). Consider adding a GET method entry for /identity/conditionalaccess/classicpolicies/{id} to align with the established pattern and allow clients to retrieve individual classic policies after creating or updating them.
Weekly Permissions sync 2025-12-26