Weekly Permissions sync 2026-09-03

[David (marabooy)]

Weekly Permissions sync 2026-09-03

[Copilot]

🟡 Changes recommended

permissions/new/provisioningInfo.json introduces ThreatHunting.ReadWrite.All deployment objects without the required id field, which is likely to break downstream validation/tooling.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Weekly permissions catalog synchronization to keep DevX permission metadata aligned with upstream Microsoft Graph permissions, deployments, and endpoint coverage mappings.

Changes:

• Added new permission deployment entries (and adjusted some existing deployment properties) in provisioningInfo.json.
• Updated permission metadata and endpoint-to-permission mappings (including new permissions like Lockbox* and Device-CloudLicensing*) in permissions.json.
• Adjusted a few existing permission attributes (for example, privilege level changes and path set reshaping).

File summaries

File	Description
permissions/new/provisioningInfo.json	Adds/updates permission deployment entries (scheme/environment/isHidden/isEnabled/resourceAppId) for the weekly sync.
permissions/new/permissions.json	Updates permission definitions and path coverage mappings to reflect newly added/changed endpoints and permissions.

Review details

Suppressed comments (1)

permissions/new/provisioningInfo.json:18295

• The ThreatHunting.ReadWrite.All Application deployment object is missing the required id field. Other deployment objects in provisioningInfo.json include id (it may be an empty string), and omitting it can break downstream tooling that expects the field to exist.

      {
        "scheme": "Application",
        "environment": "public",
        "isHidden": true,
        "isEnabled": false,

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.