Guidance changes

Week of 9 Nov 2026

1. Microsoft Entra Entra built-in roles and permissions

   Watch

   May need admin actionCheck the roles and permissions you grant.

   Changed article references · 3 added · 0 removed

   • Added link: Resource Policy Administrator#resource-policy-administrator
   • Added link: Resource Policy Evaluator#resource-policy-evaluator
   • Added link: Resource Policy Reader#resource-policy-reader

   9 new passages (about 260 words), 1 edited passage (51 words changed).

   New sections: Resource Policy Administrator · Resource Policy Evaluator · Resource Policy Reader

   Also changed: All roles

   Changed wording view

   Inline diff Before After

   … data from Microsoft 365 when accessing from the Microsoft Purview portal. e07494ad-1654-4dd2-922e-6f81a71bf00f Purview Workload Content Writer Read and edit data from Microsoft 365 when accessing from the Microsoft Purview portal. 02d5655b-c1cf-4e5f-98da-5fb919085bf6 Reports Reader Can read sign-in and audit reports. 4a5d8f65-41da-4de4-8968-e035b65339cf [added: Resource Policy Administrator Can manage resource policy definitions, assignments, tenant-wide configuration, and evaluation. c0c46a03-c257-4f91-ab71-3c7e59c89d97 Resource Policy Evaluator Can evaluate a supplied resource policy without reading or changing policy definitions or assignments. 1dae4b79-8aea-40ab-9ad0-30d3ab1fa9c1 Resource Policy Reader Can read resource policy definitions, assignments, and tenant-wide configuration, and evaluate policies without making changes. 311877b7-9a2e-4337-81c2-068a250eaa22] Search Administrator Can create and manage all aspects of Microsoft Search settings. 0964bb5e-9bdb-4d7b-ac29-58e794862a40 Search Editor Can create and manage the editorial content such as bookmarks, Q and As, locations, floorplan. 8835291a-918c-4fd7-a9ce-faa49f0cf7d9 Security Administrator Can read security information and reports, and …

   Before: … data from Microsoft 365 when accessing from the Microsoft Purview portal. e07494ad-1654-4dd2-922e-6f81a71bf00f Purview Workload Content Writer Read and edit data from Microsoft 365 when accessing from the Microsoft Purview portal. 02d5655b-c1cf-4e5f-98da-5fb919085bf6 Reports Reader Can read sign-in and audit reports. 4a5d8f65-41da-4de4-8968-e035b65339cf Search Administrator Can create and manage all aspects of Microsoft Search settings. 0964bb5e-9bdb-4d7b-ac29-58e794862a40 Search Editor Can create and manage the editorial content such as bookmarks, Q and As, locations, floorplan. 8835291a-918c-4fd7-a9ce-faa49f0cf7d9 Security Administrator Can read security information and reports, and …

   After: … data from Microsoft 365 when accessing from the Microsoft Purview portal. e07494ad-1654-4dd2-922e-6f81a71bf00f Purview Workload Content Writer Read and edit data from Microsoft 365 when accessing from the Microsoft Purview portal. 02d5655b-c1cf-4e5f-98da-5fb919085bf6 Reports Reader Can read sign-in and audit reports. 4a5d8f65-41da-4de4-8968-e035b65339cf Resource Policy Administrator Can manage resource policy definitions, assignments, tenant-wide configuration, and evaluation. c0c46a03-c257-4f91-ab71-3c7e59c89d97 Resource Policy Evaluator Can evaluate a supplied resource policy without reading or changing policy definitions or assignments. 1dae4b79-8aea-40ab-9ad0-30d3ab1fa9c1 Resource Policy Reader Can read resource policy definitions, assignments, and tenant-wide configuration, and evaluate policies without making changes. 311877b7-9a2e-4337-81c2-068a250eaa22 Search Administrator Can create and manage all aspects of Microsoft Search settings. 0964bb5e-9bdb-4d7b-ac29-58e794862a40 Search Editor Can create and manage the editorial content such as bookmarks, Q and As, locations, floorplan. 8835291a-918c-4fd7-a9ce-faa49f0cf7d9 Security Administrator Can read security information and reports, and …

   [added: Users with this role can create, read, update, and delete resource policy definitions and assignments in Microsoft Graph. They can also read and update tenant-wide resource policy configuration and evaluate policies.]

   Before: No saved wording on this side.

   After: Users with this role can create, read, update, and delete resource policy definitions and assignments in Microsoft Graph. They can also read and update tenant-wide resource policy configuration and evaluate policies.

   5 more changed passages · see them all

   Microsoft's commit: docs: add Resource Policy built-in roles (#14780)

   Observed today 11:42 UTC · current page · MIT

2. Microsoft Entra Configure dynamic membership with the memberOf operator

   Watch

   Read to decideThe wording changed without matching a rule; read the changed passages to decide.

   1 edited passage (10 words changed).

   Changed wording view

   Inline diff Before After

   Membership of a memberOf dynamic group doesn't automatically update when a child group is [removed: deleted or when members are removed from a child group.] [added: deleted.] The affected users or devices remain members of the memberOf dynamic group until the rule is modified.

   Before: Membership of a memberOf dynamic group doesn't automatically update when a child group is deleted or when members are removed from a child group. The affected users or devices remain members of the memberOf dynamic group until the rule is modified.

   After: Membership of a memberOf dynamic group doesn't automatically update when a child group is deleted. The affected users or devices remain members of the memberOf dynamic group until the rule is modified.

   Microsoft's commit: Review the memberOf preview limitation on members removed from a child group (#2153)

   Observed 10 Nov 18:49 UTC · current page · MIT

Quoted wording: © Microsoft Corporation · source and applicable license beside each change.