Microsoft Entra ID Permissions

This guide applies to Mac computers and Windows computers

Microsoft Entra ID Permissions

Microsoft Entra ID permissions in Iru Endpoint are the Microsoft Graph permissions that Iru Endpoint requests for directory integration. With these permissions, Iru Endpoint can sync users and groups and authenticate directory users.

How It Works

Integration Overview

The Microsoft Entra ID integration in Iru Endpoint syncs Microsoft Entra ID user and group objects into the Iru Endpoint user directory, so administrators can assign devices to those users. Iru Endpoint uses these delegated Microsoft Graph permissions to sync directory information. To connect the integration, see User Directory Integration with Microsoft Entra ID.

Permissions Overview

The following permissions are automatically requested and required to sync Microsoft Entra ID users and groups into Iru Endpoint. A Microsoft Entra ID administrator needs sufficient permissions to delegate them to Iru Endpoint.

Permission	Display Text	Justification
`Group.Read.All`	Read all groups	Allows Iru Endpoint to list groups, and to read their properties and all group memberships on behalf of the signed-in user.
`User.Read.All`	Read all users’ full profiles	Synchronize all Microsoft Entra ID users
`User.Read`	Sign in and read user profile	Store the integrating Microsoft Entra ID administrator’s information
`offline_access`	Maintain access to data you have given it access to	Allows long-term syncing
`openid`	Allows users to sign in to the app with their work or school accounts and allows the app to see basic user profile information.	Used for legacy OpenID sign-in for Microsoft Entra ID users in Iru Endpoint. (This is now handled by a new independent Microsoft Entra ID application record)

Getting Started

Devices

Agent

Blueprints

Enrollment

Library

Deployment Guides

Settings

Integrations

Endpoint Detection & Response

Vulnerability Management

API

Microsoft Entra ID Permissions