docs: Update HelpTexts for AZ role edges BED-7061 #2184
Conversation
martinsohn
changed the title
WalkthroughUpdated help-text UI components across Entra/role-related modules: replaced "Azure AD"/related phrasing with "Entra ID" and clarified principal role wording; added external Microsoft Entra reference links. No logic, exports, or control-flow changes. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
martinsohn
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZPrivilegedRoleAdmin/General.tsx (1)
23-23: Consider retaining capability information.The updated text standardizes terminology but removes helpful context about what the Privileged Role Administrator can do ("can grant any other admin role to another principal at the tenant level"). This information is valuable for understanding the security implications of this edge.
Consider expanding the text to include both the role status and key capabilities:
-The principal has the Privileged Role Administrator Entra ID role active against the target tenant. +The principal has the Privileged Role Administrator Entra ID role active against the target tenant and can grant any other admin role to another principal at the tenant level.packages/javascript/bh-shared-ui/src/components/HelpTexts/AZRoleEligible/General.tsx (1)
23-24: Minor wording improvement for clarity.The updated text is much clearer and the cross-reference to AZHasRole is helpful. Consider using "activated" instead of "active" in the second sentence for grammatical precision.
-The principal is eligible for assignment to the Entra ID role via Privileged Identity Management (PIM). When the role is active the principal will also have an AZHasRole edge to the role. +The principal is eligible for assignment to the Entra ID role via Privileged Identity Management (PIM). When the role is activated the principal will also have an AZHasRole edge to the role.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (17)
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZAppAdmin/General.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZAppAdmin/References.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZCloudAppAdmin/General.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZCloudAppAdmin/References.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZGlobalAdmin/General.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZGlobalAdmin/References.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZHasRole/Abuse.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZHasRole/General.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZHasRole/Opsec.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZPrivilegedAuthAdmin/General.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZPrivilegedAuthAdmin/References.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZPrivilegedRoleAdmin/Abuse.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZPrivilegedRoleAdmin/General.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZPrivilegedRoleAdmin/References.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZRoleApprover/General.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZRoleApprover/References.tsx(1 hunks)packages/javascript/bh-shared-ui/src/components/HelpTexts/AZRoleEligible/General.tsx(1 hunks)
🧰 Additional context used
🧠 Learnings (2)
📚 Learning: 2025-11-06T21:35:02.751Z
Learnt from: dcairnsspecterops
Repo: SpecterOps/BloodHound PR: 2010
File: packages/javascript/bh-shared-ui/src/components/Navigation/AppLink.tsx:30-30
Timestamp: 2025-11-06T21:35:02.751Z
Learning: In AppLink component (packages/javascript/bh-shared-ui/src/components/Navigation/AppLink.tsx), the aria-label="Navigate to ${path}" is added as a fallback for cases where children may be non-string content (icons, JSX elements) rather than readable text.
Applied to files:
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZCloudAppAdmin/References.tsxpackages/javascript/bh-shared-ui/src/components/HelpTexts/AZPrivilegedRoleAdmin/References.tsxpackages/javascript/bh-shared-ui/src/components/HelpTexts/AZPrivilegedAuthAdmin/References.tsxpackages/javascript/bh-shared-ui/src/components/HelpTexts/AZRoleApprover/References.tsxpackages/javascript/bh-shared-ui/src/components/HelpTexts/AZAppAdmin/References.tsx
📚 Learning: 2025-08-06T20:45:32.705Z
Learnt from: JimSycurity
Repo: SpecterOps/BloodHound PR: 1761
File: packages/javascript/bh-shared-ui/src/components/HelpTexts/ProtectAdminGroups/References.tsx:22-43
Timestamp: 2025-08-06T20:45:32.705Z
Learning: The SpecterOps URL https://specterops.io/resources/adminsdholder in the ProtectAdminGroups References.tsx component is a placeholder link created by marketing that will become active when JimSycurity's AdminSDHolder whitepaper is published. This is intentional and should not be flagged as a broken link.
Applied to files:
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZGlobalAdmin/References.tsx
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: Build BloodHound Container Image / Build and Package Container
- GitHub Check: build-ui
- GitHub Check: run-tests
- GitHub Check: run-analysis
🔇 Additional comments (14)
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZHasRole/Abuse.tsx (1)
24-25: LGTM! Terminology correctly updated.The text properly reflects Microsoft's rebranding from Azure AD to Entra ID, and the help text clearly communicates the edge semantics.
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZPrivilegedRoleAdmin/Abuse.tsx (1)
23-23: LGTM – Clear abuse vector description.The added sentence effectively communicates the core privilege escalation risk of the Privileged Role Administrator role. The documentation improvement aligns well with the PR's goal of clarifying edge semantics.
Since this describes Entra ID role permissions, consider verifying the statement accuracy against the official Microsoft Entra Privileged Role Administrator documentation (which the PR adds references to).
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZRoleApprover/General.tsx (1)
23-25: LGTM! Clear and accurate PIM approver documentation.The updated help text effectively clarifies the approver role in the PIM policy workflow and appropriately references the AZRoleEligible edge for cross-context. The terminology standardization to "Entra ID" aligns with the PR objectives.
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZPrivilegedRoleAdmin/References.tsx (1)
23-29: LGTM! Link to Microsoft Entra documentation is correct and properly implemented with security attributes.The implementation correctly adds a reference to Microsoft Entra built-in roles documentation, with proper security attributes (
rel='noopener noreferrer'), descriptive link text, and consistent structure with other reference links in the component.packages/javascript/bh-shared-ui/src/components/HelpTexts/AZCloudAppAdmin/References.tsx (1)
23-29: Link implementation is correct and properly configured.The Link component uses appropriate security attributes (
target="_blank"withrel="noopener noreferrer") and includes descriptive text. The Microsoft Entra documentation URL is valid and accessible.packages/javascript/bh-shared-ui/src/components/HelpTexts/AZAppAdmin/References.tsx (1)
23-29: Link structure and security attributes are correct. The Material-UI Link component properly usesrel='noopener noreferrer'withtarget='_blank'when linking to the external Microsoft documentation. The Microsoft Learn documentation URL for Entra Application Administrator roles is valid and accessible. The implementation follows Material-UI's recommended security best practices for external links.packages/javascript/bh-shared-ui/src/components/HelpTexts/AZRoleApprover/References.tsx (1)
23-29: LGTM! Documentation reference added correctly.The new Microsoft Entra PIM documentation link is properly formatted with appropriate security attributes (
target='_blank',rel='noopener noreferrer') and provides valuable context for users understanding the role approver edge.packages/javascript/bh-shared-ui/src/components/HelpTexts/AZPrivilegedAuthAdmin/References.tsx (1)
45-53: LGTM! References updated to Microsoft Entra terminology.The link text and URLs have been correctly updated to reflect Microsoft's rebranding from Azure AD to Microsoft Entra. The changes maintain proper link attributes and improve clarity.
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZGlobalAdmin/References.tsx (1)
23-26: LGTM! Official documentation reference added.The new Microsoft Entra Global Administrator documentation link is properly formatted with appropriate security attributes and provides valuable reference material for users.
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZAppAdmin/General.tsx (1)
23-23: LGTM! Clear and informative help text.The updated text successfully standardizes terminology to "Entra ID" while retaining important capability information ("can control tenant-resident apps"). This provides users with both the role status and security implications.
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZCloudAppAdmin/General.tsx (1)
23-23: LGTM! Consistent with other role help texts.The updated text maintains consistency with the Application Administrator help text while correctly identifying the specific Cloud Application Administrator role. Includes both role status and capability information.
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZHasRole/General.tsx (1)
23-23: LGTM! Improved clarity and terminology.The updated text is more concise and uses current "Entra ID" terminology. The phrase "active assignment" is clearer than the previous "has been granted" wording and aligns well with the PIM context established in related help texts.
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZGlobalAdmin/General.tsx (1)
23-25: LGTM! Clear and accurate terminology update.The updated text correctly reflects Microsoft's rebranding to "Entra ID" and maintains clarity about the Global Administrator role's scope and privileges. The phrasing is consistent with the standardization across other role documentation in this PR.
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZPrivilegedAuthAdmin/General.tsx (1)
23-23: LGTM! Concise and consistent.The updated description is clear and follows the standardized format used across other Entra ID role documentation in this PR. The simplification successfully removes redundancy while maintaining essential information about the role assignment.
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZHasRole/Opsec.tsx
Outdated
Show resolved
Hide resolved
martinsohn
changed the title
martinsohn
changed the title
The terminology change from "AzureAD" to "Entra ID" is correct and aligns with Microsoft's rebranding. However, the text uses “ (left double quotation mark) instead of an apostrophe for the possessive form "principal's".
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZHasRole/Opsec.tsx (1)
23-23: LGTM! Terminology update is correct.The terminology change from "AzureAD" to "Entra ID" aligns with Microsoft's rebranding. The previous punctuation issue with the apostrophe has been correctly addressed.
Optional: Consider minor phrasing improvement.
For slightly more natural reading, you could rephrase "what the action taken is" as "what action is taken":
- The opsec considerations for a particular action authorized by a principal's active Entra ID role - assignment will wholly depend on what the action taken is. This edge does not capture all abusable + The opsec considerations for a particular action authorized by a principal's active Entra ID role + assignment will wholly depend on what action is taken. This edge does not capture all abusable
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
packages/javascript/bh-shared-ui/src/components/HelpTexts/AZHasRole/Opsec.tsx(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: Build BloodHound Container Image / Build and Package Container
- GitHub Check: run-tests
- GitHub Check: build-ui
- GitHub Check: run-analysis
rvazarkar
left a comment
rvazarkar
left a comment
There was a problem hiding this comment.
All looks good to me, and since its all just copy change, easy peasy
Description
This PR updates the help text and documentation for Azure Entra ID role-related edges to improve consistency, clarity, and accuracy. The changes address terminology updates, add missing references to official Microsoft documentation, and provide more detailed explanations of edge relationships.
1. Lack of Consistency
2. Vague and Lacking Detail
3. Missing Official References
4. Improved Edge Descriptions
Updated descriptions to be more specific and actionable:
AZRoleEligible:
AZRoleApprover:
AZPrivilegedRoleAdmin:
AZPrivilegedAuthAdmin:
Motivation and Context
Resolves BED-7061
Changes required in bloodhound-docs SpecterOps/bloodhound-docs#137
How Has This Been Tested?
Built BH CE locally, verified each edge entity panel showed correct info, and links were clickable.
Screenshots (optional):
Types of changes
Checklist:
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.