MODIFIED docs/identity/role-based-access-control/permissions-reference.md

Modified by rolyon on Dec 23, 2025 7:46 PM
📖 View on learn.microsoft.com

+7 / -1 lines changed

Commit: Microsoft 365 Support Engineer

Changes:

Before

After

ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: reference
ms.date: 11/19/2025
ms.author: rolyon
ms.reviewer: abhijeetsinha
ms.custom: generated, it-pro, fasttrack-edit, has-azure-ad-ps-ref, azure-ad-ref-level-one-done, sfi-ga-nochange
> | [Message Center Reader](#message-center-reader) | Can read messages and updates for their organization in Office 365 Message Center only. | 790c1fb9-7f7d-4f88-86a1-ef1f95c05c1b |
> | [Microsoft 365 Backup Administrator](#microsoft-365-backup-administrator) | Back up and restore content across supported services (SharePoint, OneDrive, and Exchange Online) in Microsoft 365 Backup | 1707125e-0aa2-4d4d-8655-a7c786c76a25 |
> | [Microsoft 365 Migration Administrator](#microsoft-365-migration-administrator) | Perform all migration functionality to migrate content to Microsoft 365 using Migration Manager. | 8c8b803f-96e1-4129-9349-20738d9f9652 |
> | [Microsoft Entra Joined Device Local Administrator](#microsoft-entra-joined-device-local-administrator) | Users assigned to this role are added to the local administrators group on Microsoft Entra joined devices. | 9f06204d-73c1-4d4c-880a-6edb90606fd8 |
> | [Microsoft Graph Data Connect Administrator](#microsoft-graph-data-connect-administrator) | Manage aspects of Microsoft Graph Data Connect service in a tenant. | ee67aa9c-e510-4759-b906-227085a7fd4d |
> | [Microsoft Hardware Warranty Administrator](#microsoft-hardware-warranty-administrator) | Create and manage all aspects warranty claims and entitlements for Microsoft manufactured hardware, like Surface and HoloLens. | 1501b917-7653-4ff9-a4b5-203eaf33784f |
 
[!INCLUDE [microsoft-365-migration-administrator](includes/microsoft-365-migration-administrator.md)]
 
## Microsoft Entra Joined Device Local Administrator
 
[!INCLUDE [microsoft-entra-joined-device-local-administrator](includes/microsoft-entra-joined-device-local-administrator.md)]
| Device Users | Deprecated | [Deprecated roles documentation](#deprecated-roles) |

ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: reference
ms.date: 12/23/2025
ms.author: rolyon
ms.reviewer: abhijeetsinha
ms.custom: generated, it-pro, fasttrack-edit, has-azure-ad-ps-ref, azure-ad-ref-level-one-done, sfi-ga-nochange
> | [Message Center Reader](#message-center-reader) | Can read messages and updates for their organization in Office 365 Message Center only. | 790c1fb9-7f7d-4f88-86a1-ef1f95c05c1b |
> | [Microsoft 365 Backup Administrator](#microsoft-365-backup-administrator) | Back up and restore content across supported services (SharePoint, OneDrive, and Exchange Online) in Microsoft 365 Backup | 1707125e-0aa2-4d4d-8655-a7c786c76a25 |
> | [Microsoft 365 Migration Administrator](#microsoft-365-migration-administrator) | Perform all migration functionality to migrate content to Microsoft 365 using Migration Manager. | 8c8b803f-96e1-4129-9349-20738d9f9652 |
> | [Microsoft 365 Support Engineer](#microsoft-365-support-engineer) | Do not use - not intended for general use. | 00cf5c54-4693-4f59-a0ac-ab79ef0a974d |
> | [Microsoft Entra Joined Device Local Administrator](#microsoft-entra-joined-device-local-administrator) | Users assigned to this role are added to the local administrators group on Microsoft Entra joined devices. | 9f06204d-73c1-4d4c-880a-6edb90606fd8 |
> | [Microsoft Graph Data Connect Administrator](#microsoft-graph-data-connect-administrator) | Manage aspects of Microsoft Graph Data Connect service in a tenant. | ee67aa9c-e510-4759-b906-227085a7fd4d |
> | [Microsoft Hardware Warranty Administrator](#microsoft-hardware-warranty-administrator) | Create and manage all aspects warranty claims and entitlements for Microsoft manufactured hardware, like Surface and HoloLens. | 1501b917-7653-4ff9-a4b5-203eaf33784f |
 
[!INCLUDE [microsoft-365-migration-administrator](includes/microsoft-365-migration-administrator.md)]
 
## Microsoft 365 Support Engineer
 
[!INCLUDE [microsoft-365-support-engineer](includes/microsoft-365-support-engineer.md)]

MODIFIED docs/identity/role-based-access-control/whats-new.md

Modified by rolyon on Dec 23, 2025 7:46 PM
📖 View on learn.microsoft.com

+2 / -1 lines changed

Commit: Microsoft 365 Support Engineer

Changes:

Before

After

ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: whats-new
ms.date: 10/02/2025
ms.author: rolyon
 
---
 
| Date | Area | Description |
| --- | --- | --- |
| November 2025 | Roles | Added [SharePoint Advanced Management Administrator](permissions-reference.md#sharepoint-advanced-management-administrator) role. |
| November 2025 | Roles | Updated [Exchange Backup Administrator](permissions-reference.md#exchange-backup-administrator) role. |
| November 2025 | Roles | Updated [SharePoint Backup Administrator](permissions-reference.md#sharepoint-backup-administrator) role. |
 

ms.service: entra-id
ms.subservice: role-based-access-control
ms.topic: whats-new
ms.date: 12/23/2025
ms.author: rolyon
 
---
 
| Date | Area | Description |
| --- | --- | --- |
| December 2025 | Roles | Added [Microsoft 365 Support Engineer](permissions-reference.md#microsoft-365-support-engineer) role. |
| November 2025 | Roles | Added [SharePoint Advanced Management Administrator](permissions-reference.md#sharepoint-advanced-management-administrator) role. |
| November 2025 | Roles | Updated [Exchange Backup Administrator](permissions-reference.md#exchange-backup-administrator) role. |
| November 2025 | Roles | Updated [SharePoint Backup Administrator](permissions-reference.md#sharepoint-backup-administrator) role. |

MODIFIED docs/global-secure-access/how-to-configure-threat-intelligence.md

Modified by Frank Gomulka on Dec 23, 2025 7:34 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: edits based on Dhruvin's comments

Changes:

Before

After

> Applying a new security profile can take up to 60-90 minutes because security profiles are enforced via access tokens.
 
> [!NOTE]
> To expedite Conditional Access configuration changes, revoke user sessions in the Entra Admin Center (select **Revoke sessions** on the user's overview page). This forces users to obtain new tokens with updated policies. Learn more about [Continuous Access Evaluation](concept-universal-continuous-access-evaluation.md).
 
## Verify end user policy enforcement

> Applying a new security profile can take up to 60-90 minutes because security profiles are enforced via access tokens.
 
> [!NOTE]
> To expedite Conditional Access configuration changes *for testing*, revoke user sessions in the Entra Admin Center (select **Revoke sessions** on the user's overview page). This forces users to obtain new tokens with updated policies. Learn more about [Continuous Access Evaluation](concept-universal-continuous-access-evaluation.md).
 
## Verify end user policy enforcement

MODIFIED docs/global-secure-access/how-to-configure-web-content-filtering.md

Modified by Frank Gomulka on Dec 23, 2025 7:34 PM
📖 View on learn.microsoft.com

+1 / -1 lines changed

Commit: edits based on Dhruvin's comments

Changes:

Before

After

> Configuration changes in the Global Secure Access experience related to web content filtering typically take effect in less than 5 minutes. Configuration changes in Conditional Access related to web content filtering take effect in approximately one hour.
 
> [!NOTE]
> To expedite Conditional Access configuration changes, revoke user sessions in the Entra Admin Center (select **Revoke sessions** on the user's overview page). This forces users to obtain new tokens with updated policies. Learn more about [Continuous Access Evaluation](concept-universal-continuous-access-evaluation.md).
 
## Next steps

> Configuration changes in the Global Secure Access experience related to web content filtering typically take effect in less than 5 minutes. Configuration changes in Conditional Access related to web content filtering take effect in approximately one hour.
 
> [!NOTE]
> To expedite Conditional Access configuration changes *for testing*, revoke user sessions in the Entra Admin Center (select **Revoke sessions** on the user's overview page). This forces users to obtain new tokens with updated policies. Learn more about [Continuous Access Evaluation](concept-universal-continuous-access-evaluation.md).
 
## Next steps

📋 Microsoft Entra Documentation Changes

📊 Summary

🆕 New Documentation Files

📝 Modified Documentation Files