search

MicrosoftDocs / azure-docs

Open source documentation of Microsoft Azure
https://docs.microsoft.com/azure
Creative Commons Attribution 4.0 International
10.21k stars 21.36k forks source link

Unexpected permissions #18405

Closed DeanGross closed 5 years ago

DeanGross commented 5 years ago

I added an account to the Guest Inviter role and they are able to create new Groups, which, is not what I expected, but since the documentation is not clear, I'm not sure which role could be providing additional permissions.

The Note for the Guest Inviter role states "This role inherits additional permissions from the role." Please identify which role the Guest Inviter is inheriting from. There are several other roles that have the same note, please review all of the notes to ensure that they clearly state what roles they inherit from.

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

MarileeTurscak-MSFT commented 5 years ago

@DeanGross Thanks for your feedback! We will investigate and update as appropriate.

DeanGross commented 5 years ago

Have you been able to find any information?

curtand commented 5 years ago

Hi @DeanGross In addition to the explicitly described permissions in the roles article, this role also grants the default user permissions in Azure Active Directory. I just found out what that really means. I'll see if I can pull them together and link to them from the role descriptions. They're here. https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions?context=azure/active-directory/users-groups-roles/context/ugr-context

curtand commented 5 years ago

We have reworked the documentation and removed those references. Keep your eye on roles docs, because we're expanding the doc set.

@DeanGross @MarileeTurscak-MSFT

please-close

MarileeTurscak-MSFT commented 5 years ago

Thanks, @curtand