Microsoft Entra Delegated Permissions - Allow user to modify only their own custom security attributes

Question

Microsoft Entra Delegated Permissions - Allow user to modify only their own custom security attributes

Jack 20

My javascript client application needs to read/modify custom security attributes via the Graph API using delegated permissions. This works if I assign the "Attribute Assignment Administrator" and "Attribute Assignment Reader" role to the respective user.

However, with this role the users can read the custom security attributes of all users.

I want to have the permissions such that the users can only read/modify their own custom security attributes.

Futher information: I also granted the delegated "API Permissions" "CustomSecAttributeAssignment.ReadWrite.All". This permissions is not enough though. The Graph API returns either zero customSecurityAttributes (read) or denies the PATCH request with authorization denied.

Accepted answer

0 additional answers

Your answer

Answer 1

Vasil Michev 119.3K MVP Volunteer Moderator

Managing custom security attributes is an admin-level operation, you cannot delegate it to the end users themselves. Well you can, but you cannot restrict it as you've already noticed.

Jack 20 Reputation points

2024-05-24T18:19:19.7733333+00:00

Thank you very much for the clarification.

Are you aware of any alternative I could use for this task instead of security attributes? Something which can be read and modified by only the users himself and stored in user profile?
Vasil Michev 119.3K Reputation points MVP Volunteer Moderator

2024-05-25T06:28:39.6166667+00:00

Generally speaking, changing attributes is an admin operation. Even for attributes that the user can change themselves, an admin will always be able to override the change.

That said, there are a handful of properties the users can change themselves, probably the easiest way to do so is via Delve: https://support.microsoft.com/en-us/office/view-and-update-your-profile-in-delve-4e84343b-eedf-45a1-aeb9-8627ccca14ba

You will then be able to access said properties via Graph, i.e. $select=aboutMe,skills,etc
Jack 20 Reputation points

2024-05-30T10:22:37.55+00:00
Thanks but I'm trying to store a secret value in the user profile only the user itself (and maybe admins) are allowed to read/modify. Skills/AboutMe in the profile are public and hence not a viable solution for my scenario.

In the last few days I read a lot in the documentation but no extensions seems to fulfill my needs:

Via delegated permissions a user should be able to set and read the secret value. But he should not be able to read/modify the secret value of other users.

With the given application permissions, it shall not be possible to read the secret value. However, the application permissions needs to have the right to read the users profile (atleast user id, name, email). In order to synchronize the users. (The login is via SSO, but I need a solution for user deprovisioning, i.e. if a user leaves the company, the user profile in the third party app shall be deleted.)

With this constraints, extension attributes and open extensions are not possible, because with the application-permission User.Read it is also possible to read the two extensions. Schema and directory extensions require Applicaiton.ReadWrite permissions, violating the requirement that the user shall only be able to modify his own secret value.

Is there any suitable extension for this scenario? Or some way to have a custom permission model fulfilling this needs?

Or is there some other possiblity to synchronize users via app registration without the possiblity to read user extensions?

Thanks a lot in advance!

Share via

Microsoft Entra Delegated Permissions - Allow user to modify only their own custom security attributes

0 additional answers

Your answer