Summary
Item‑level APIs/cmdlets so engineers can automate what the UI can do without requiring Tenant Admin scopes.
Problem
Key actions (e.g., sensitivity labels) are admin‑only via REST; others lack item‑level endpoints. Ownership/permissions and structured deployment need elevated roles or manual UI. This blocks least‑privilege automation.
Proposed solution
- Item‑scoped endpoints/cmdlets to:
- **Set/Get item permissions** on paginated reports.
- **Set/Get sensitivity labels** at item scope (honor label policy) without admin.
- **Create/list/move to folders** and deploy RDLs to them (see Folders idea).
Acceptance criteria
- A Service Principal with workspace **Contributor** can set a paginated report’s permissions and sensitivity label via API (no Tenant.ReadWrite.All), and move/deploy it into a folder path.
Impact
Enables proper DevOps with least privilege; removes brittle manual steps.
1 Comment
It makes no sense that there are a huge number of Workspace Admin tasks that can't be done using the API without Tenant Admin permissions! Does not support RBAC and Principal of Least Privilege security best practices.
