From 80328e9a2ea4e88cc6f6226a2e9e1fc3cf83ac4d Mon Sep 17 00:00:00 2001 From: Yuan Karppanen <46729835+yyuank@users.noreply.github.com> Date: Fri, 28 Aug 2026 09:32:29 -0700 Subject: [PATCH] Clarify role assignment requirements for delegated scenarios --- .../v1.0/includes/users-passwordprofile-permissions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/api-reference/v1.0/includes/users-passwordprofile-permissions.md b/api-reference/v1.0/includes/users-passwordprofile-permissions.md index fddfcfb1bda..a0e5d15aa47 100644 --- a/api-reference/v1.0/includes/users-passwordprofile-permissions.md +++ b/api-reference/v1.0/includes/users-passwordprofile-permissions.md @@ -7,7 +7,7 @@ ms.topic: include - *User-PasswordProfile.ReadWrite.All* is the least privileged permission to update the **passwordProfile** property. -- In delegated scenarios, the calling app must be assigned a supported permission *and* a supported Microsoft Entra role. +- In delegated scenarios, the calling app must be assigned a supported permission *and* the signed in user assigned with supported Microsoft Entra role. - *Privileged Authentication Administrator* is the least privileged role that's allowed to update this property for *all* administrators in the tenant. - In general, the signed-in user must have a higher privileged administrator role as indicated in [Who can reset passwords](/graph/api/resources/users#who-can-reset-passwords). - In app-only scenarios using Microsoft Graph application permissions, *User-PasswordProfile.ReadWrite.All* is the least privileged permission.