Microsoft Entra Permissions Requested
AOH Sync requires a Microsoft Entra App Registration in your tenant to authenticate your administrators. This page lists every Microsoft Graph permission the App Registration requests, the permission type, and why AOH Sync needs it.
How AOH Sync uses the App Registration
The App Registration is used exclusively for user authentication — letting your Entra ID administrators sign in to the AOH Sync web interface via the standard Microsoft OIDC login flow. AOH Sync exchanges the authorization code for identity claims (email, name, user object ID, roles, tenant ID) and then creates a session for the user.
The App Registration is not the credential AOH Sync uses to read from your source Azure AD or to provision your target Entra ID tenant. That provisioning credential is a separate service principal with its own configuration, set up during the provisioning wizard.
Permissions the App Registration requests
The following four delegated permissions are added to the App Registration during Step 1 — App Registration:
email
Delegated
AOH Sync reads the signed-in user's email address to populate the user session and display it in the interface.
openid
Delegated
Required by the OpenID Connect protocol to initiate a sign-in and receive an ID token. Without this permission the login flow cannot complete.
profile
Delegated
AOH Sync reads the user's basic profile (display name, given name, surname) from the ID token to identify who is signed in.
User.Read
Delegated
Allows the signed-in user to read their own profile from Microsoft Graph, which AOH Sync uses to confirm the authenticated identity and populate session claims.
All four permissions are delegated (not application permissions). This means they operate in the context of the signed-in user — AOH Sync cannot use them to read other users' data without an interactive login from that user.
Admin consent requirement
These permissions require admin consent to be granted for your organization before they take effect. The App Registration setup step includes granting admin consent via the Azure Portal. Once granted, your users can sign in to AOH Sync without being individually prompted.
All four permissions are read-only and scoped to the signed-in user. AOH Sync does not request write access to your directory via this App Registration.
Permissions AOH Sync does not request via the App Registration
AOH Sync does not request any of the following via the App Registration used for user authentication:
Application permissions (permissions that operate without a signed-in user)
Directory read or write permissions (
Directory.Read.All,Directory.ReadWrite.All)Group read or write permissions
Any permissions beyond the four listed above
Provisioning-related permissions — required to read your source directory and write to your target Entra tenant — are configured separately as part of the provisioning setup and are scoped to the specific service principal you create for that purpose.
Related
Last updated