Add RBAC for alerts and incidents APIs

FaithOmbongi · FaithOmbongi · commit 73bf211ffd36 · 2026-03-18T20:52:00.000+03:00
diff --git a/api-reference/beta/api/security-alert-get.md b/api-reference/beta/api/security-alert-get.md
@@ -25,6 +25,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_alert_get" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-alert-get-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-read](../includes/rbac-for-apis/rbac-security-alerts-apis-read.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/security-alert-post-comments.md b/api-reference/beta/api/security-alert-post-comments.md
@@ -23,6 +23,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_alert_post_comments" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-alert-post-comments-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-write](../includes/rbac-for-apis/rbac-security-alerts-apis-write.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/security-alert-update.md b/api-reference/beta/api/security-alert-update.md
@@ -23,6 +23,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_alert_update" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-alert-update-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-write](../includes/rbac-for-apis/rbac-security-alerts-apis-write.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/security-incident-get.md b/api-reference/beta/api/security-incident-get.md
@@ -25,6 +25,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_incident_get" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-incident-get-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-read](../includes/rbac-for-apis/rbac-security-alerts-apis-read.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/security-incident-post-comments.md b/api-reference/beta/api/security-incident-post-comments.md
@@ -21,6 +21,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_incident_post_comments" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-incident-post-comments-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-write](../includes/rbac-for-apis/rbac-security-alerts-apis-write.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/security-incident-update.md b/api-reference/beta/api/security-incident-update.md
@@ -24,6 +24,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_incident_update" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-incident-update-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-write](../includes/rbac-for-apis/rbac-security-alerts-apis-write.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/security-incidenttask-executeresponseaction.md b/api-reference/beta/api/security-incidenttask-executeresponseaction.md
@@ -29,6 +29,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 -->
 [!INCLUDE [permissions-table](../includes/permissions/security-incidenttask-executeresponseaction-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-write](../includes/rbac-for-apis/rbac-security-alerts-apis-write.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/security-incidenttask-get.md b/api-reference/beta/api/security-incidenttask-get.md
@@ -29,6 +29,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 -->
 [!INCLUDE [permissions-table](../includes/permissions/security-incidenttask-get-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-read](../includes/rbac-for-apis/rbac-security-alerts-apis-read.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/security-incidenttask-update.md b/api-reference/beta/api/security-incidenttask-update.md
@@ -29,6 +29,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 -->
 [!INCLUDE [permissions-table](../includes/permissions/security-incidenttask-update-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-write](../includes/rbac-for-apis/rbac-security-alerts-apis-write.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/security-list-alerts_v2.md b/api-reference/beta/api/security-list-alerts_v2.md
@@ -25,6 +25,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_list_alerts_v2" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-list-alerts_v2-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-read](../includes/rbac-for-apis/rbac-security-alerts-apis-read.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/security-list-incidents.md b/api-reference/beta/api/security-list-incidents.md
@@ -27,6 +27,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_list_incidents" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-list-incidents-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-read](../includes/rbac-for-apis/rbac-security-alerts-apis-read.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/api/security-list-incidenttasks.md b/api-reference/beta/api/security-list-incidenttasks.md
@@ -29,6 +29,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 -->
 [!INCLUDE [permissions-table](../includes/permissions/security-list-incidenttasks-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-read](../includes/rbac-for-apis/rbac-security-alerts-apis-read.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/beta/includes/rbac-for-apis/rbac-security-alerts-apis-read.md b/api-reference/beta/includes/rbac-for-apis/rbac-security-alerts-apis-read.md
@@ -0,0 +1,11 @@
+---
+author: BenAlfasi
+ms.topic: include
+---
+
+> [!IMPORTANT]
+> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
+> - Security Reader
+> - Global Reader
+> - Security Operator
+> - Security Administrator
diff --git a/api-reference/beta/includes/rbac-for-apis/rbac-security-alerts-apis-write.md b/api-reference/beta/includes/rbac-for-apis/rbac-security-alerts-apis-write.md
@@ -0,0 +1,9 @@
+---
+author: BenAlfasi
+ms.topic: include
+---
+
+> [!IMPORTANT]
+> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
+> - Security Operator
+> - Security Administrator
diff --git a/api-reference/v1.0/api/security-alert-get.md b/api-reference/v1.0/api/security-alert-get.md
@@ -21,6 +21,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_alert_get" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-alert-get-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-read](../includes/rbac-for-apis/rbac-security-alerts-apis-read.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/v1.0/api/security-alert-post-comments.md b/api-reference/v1.0/api/security-alert-post-comments.md
@@ -21,6 +21,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_alert_post_comments" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-alert-post-comments-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-write](../includes/rbac-for-apis/rbac-security-alerts-apis-write.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/v1.0/api/security-alert-update.md b/api-reference/v1.0/api/security-alert-update.md
@@ -21,6 +21,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_alert_update" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-alert-update-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-write](../includes/rbac-for-apis/rbac-security-alerts-apis-write.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/v1.0/api/security-incident-get.md b/api-reference/v1.0/api/security-incident-get.md
@@ -23,6 +23,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_incident_get" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-incident-get-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-read](../includes/rbac-for-apis/rbac-security-alerts-apis-read.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/v1.0/api/security-incident-post-comments.md b/api-reference/v1.0/api/security-incident-post-comments.md
@@ -19,6 +19,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_incident_post_comments" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-incident-post-comments-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-write](../includes/rbac-for-apis/rbac-security-alerts-apis-write.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/v1.0/api/security-incident-update.md b/api-reference/v1.0/api/security-incident-update.md
@@ -22,6 +22,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_incident_update" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-incident-update-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-write](../includes/rbac-for-apis/rbac-security-alerts-apis-write.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/v1.0/api/security-list-alerts_v2.md b/api-reference/v1.0/api/security-list-alerts_v2.md
@@ -23,6 +23,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_list_alerts_v2" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-list-alerts_v2-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-read](../includes/rbac-for-apis/rbac-security-alerts-apis-read.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/v1.0/api/security-list-incidents.md b/api-reference/v1.0/api/security-list-incidents.md
@@ -25,6 +25,8 @@ Choose the permission or permissions marked as least privileged for this API. Us
 <!-- { "blockType": "permissions", "name": "security_list_incidents" } -->
 [!INCLUDE [permissions-table](../includes/permissions/security-list-incidents-permissions.md)]
 
+[!INCLUDE [rbac-security-alerts-apis-read](../includes/rbac-for-apis/rbac-security-alerts-apis-read.md)]
+
 ## HTTP request
 
 <!-- {
diff --git a/api-reference/v1.0/includes/rbac-for-apis/rbac-security-alerts-apis-read.md b/api-reference/v1.0/includes/rbac-for-apis/rbac-security-alerts-apis-read.md
@@ -0,0 +1,11 @@
+---
+author: BenAlfasi
+ms.topic: include
+---
+
+> [!IMPORTANT]
+> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
+> - Security Reader
+> - Global Reader
+> - Security Operator
+> - Security Administrator
diff --git a/api-reference/v1.0/includes/rbac-for-apis/rbac-security-alerts-apis-write.md b/api-reference/v1.0/includes/rbac-for-apis/rbac-security-alerts-apis-write.md
@@ -0,0 +1,9 @@
+---
+author: BenAlfasi
+ms.topic: include
+---
+
+> [!IMPORTANT]
+> In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json) or a custom role with a supported role permission. The following least privileged roles are supported for this operation.
+> - Security Operator
+> - Security Administrator
