> For the complete documentation index, see [llms.txt](https://hub.equipme.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hub.equipme.io/documentation/automation/connectors/microsoft-entra-id-connector/required-permissions.md).

# Required Permissions

The connector uses delegated permissions, which means two things have to line up: the connection needs the right scopes, and the signed-in account needs the right Entra ID role.

{% hint style="warning" %}
Scopes never widen what an account is allowed to do. Granting a scope does not give the account a permission it does not already hold through its Entra ID role.
{% endhint %}

#### Scopes by area

| Area                                     | Delegated permissions                                                  |
| ---------------------------------------- | ---------------------------------------------------------------------- |
| Reading and writing users                | `User.Read.All` / `User.ReadWrite.All`, `User-LifeCycleInfo.*`         |
| Resetting passwords                      | `User-PasswordProfile.ReadWrite.All`                                   |
| Revoking sessions                        | `User.RevokeSessions.All`                                              |
| Inviting guests                          | `User.Invite.All`                                                      |
| Groups                                   | `Group.Read.All` / `Group.ReadWrite.All`                               |
| Devices                                  | `Device.Read.All` / `Device.ReadWrite.All`                             |
| Licenses                                 | `Organization.Read.All`, `User.ReadWrite.All`                          |
| Directory roles                          | `RoleManagement.Read.Directory` / `RoleManagement.ReadWrite.Directory` |
| Deleted items                            | `Directory.Read.All` / `Directory.ReadWrite.All`                       |
| App registrations and secrets            | `Application.Read.All` / `Application.ReadWrite.All`                   |
| Authentication methods and access passes | `UserAuthenticationMethod.Read.All` / `.ReadWrite.All`                 |
| Sign-in activity and MFA reporting       | `AuditLog.Read.All`                                                    |

#### Admin consent

All of these permissions require consent from an administrator. Components request only the scopes they actually need, so using a component for the first time can prompt a fresh sign-in and a new consent step even though the connection already worked for other components.

If a component fails with "Insufficient privileges to complete the operation", the connection predates that component's scope. Disconnect it in the flow, sign in again and confirm admin consent.

#### Planning ahead

If you know which areas your flows will cover, it is worth requesting consent for those scopes in one go rather than one interruption at a time. Sharing this page with whoever grants consent in your organisation is usually the fastest route — it lists exactly what will be asked for and why.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hub.equipme.io/documentation/automation/connectors/microsoft-entra-id-connector/required-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.