Required Permissions

The connector uses delegated permissions, which means two things have to line up: the connection needs the right scopes, and the signed-in account needs the right Entra ID role.

Scopes never widen what an account is allowed to do. Granting a scope does not give the account a permission it does not already hold through its Entra ID role.

Scopes by area

Area	Delegated permissions
Reading and writing users	User.Read.All / User.ReadWrite.All, User-LifeCycleInfo.*
Resetting passwords	User-PasswordProfile.ReadWrite.All
Revoking sessions	User.RevokeSessions.All
Inviting guests	User.Invite.All
Groups	Group.Read.All / Group.ReadWrite.All
Devices	Device.Read.All / Device.ReadWrite.All
Licenses	Organization.Read.All, User.ReadWrite.All
Directory roles	RoleManagement.Read.Directory / RoleManagement.ReadWrite.Directory
Deleted items	Directory.Read.All / Directory.ReadWrite.All
App registrations and secrets	Application.Read.All / Application.ReadWrite.All
Authentication methods and access passes	UserAuthenticationMethod.Read.All / .ReadWrite.All
Sign-in activity and MFA reporting	AuditLog.Read.All

Admin consent

All of these permissions require consent from an administrator. Components request only the scopes they actually need, so using a component for the first time can prompt a fresh sign-in and a new consent step even though the connection already worked for other components.

If a component fails with "Insufficient privileges to complete the operation", the connection predates that component's scope. Disconnect it in the flow, sign in again and confirm admin consent.

Planning ahead

If you know which areas your flows will cover, it is worth requesting consent for those scopes in one go rather than one interruption at a time. Sharing this page with whoever grants consent in your organisation is usually the fastest route — it lists exactly what will be asked for and why.