> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/trust-security-and-data-handling/entra-permissions.md).

# Microsoft Entra Permissions Requested

AOH Sync requires a Microsoft Entra App Registration in your tenant to authenticate your administrators. This page lists every Microsoft Graph permission the App Registration requests, the permission type, and why AOH Sync needs it.

***

## How AOH Sync uses the App Registration

The App Registration is used exclusively for **user authentication** — letting your Entra ID administrators sign in to the AOH Sync web interface via the standard Microsoft OIDC login flow. AOH Sync exchanges the authorization code for identity claims (email, name, user object ID, roles, tenant ID) and then creates a session for the user.

The App Registration is **not** the credential AOH Sync uses to read from your source Azure AD or to provision your target Entra ID tenant. That provisioning credential is a separate service principal with its own configuration, set up during the provisioning wizard.

***

## Permissions the App Registration requests

The following four delegated permissions are added to the App Registration during [Step 1 — App Registration](/getting-started/02-app-registration.md):

| Permission  | Type      | Why AOH Sync needs it                                                                                                                                            |
| ----------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `email`     | Delegated | AOH Sync reads the signed-in user's email address to populate the user session and display it in the interface.                                                  |
| `openid`    | Delegated | Required by the OpenID Connect protocol to initiate a sign-in and receive an ID token. Without this permission the login flow cannot complete.                   |
| `profile`   | Delegated | AOH Sync reads the user's basic profile (display name, given name, surname) from the ID token to identify who is signed in.                                      |
| `User.Read` | Delegated | Allows the signed-in user to read their own profile from Microsoft Graph, which AOH Sync uses to confirm the authenticated identity and populate session claims. |

All four permissions are **delegated** (not application permissions). This means they operate in the context of the signed-in user — AOH Sync cannot use them to read other users' data without an interactive login from that user.

***

## Admin consent requirement

These permissions require **admin consent** to be granted for your organization before they take effect. The App Registration setup step includes granting admin consent via the Azure Portal. Once granted, your users can sign in to AOH Sync without being individually prompted.

{% hint style="info" %}
All four permissions are read-only and scoped to the signed-in user. AOH Sync does not request write access to your directory via this App Registration.
{% endhint %}

***

## Permissions AOH Sync does not request via the App Registration

AOH Sync does not request any of the following via the App Registration used for user authentication:

* Application permissions (permissions that operate without a signed-in user)
* Directory read or write permissions (`Directory.Read.All`, `Directory.ReadWrite.All`)
* Group read or write permissions
* Any permissions beyond the four listed above

Provisioning-related permissions — required to read your source directory and write to your target Entra tenant — are configured separately as part of the provisioning setup and are scoped to the specific service principal you create for that purpose.

***

## Related

* [Step 1 — App Registration](/getting-started/02-app-registration.md)
* [The Identity Dataplane](/trust-security-and-data-handling/identity-dataplane.md)
* [Where Your Data Lives](/trust-security-and-data-handling/data-residency.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aohwv.dev/trust-security-and-data-handling/entra-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.