Why Read Directory permission is absolutely required for Azure AD connection?

[nlenepveu]

Hello Community,

I’d need to set up an Azure AD connection for a customer but I’m not able to explain why they need to grant Directory.All.Read access to their app.

This question has already been asked but there is no clear answer.

Is Read Directory permission absolutely required for Azure AD connection?

Hello, I’d like to know if the admin level privilege in Azure (Read Directory Data) is absolutely required to operate with an Azure AD connection. I have a potential customer who is running into a consent dialog and it would be much easier if we don’t need to request that permission. Thank you

I want to turn off the "Read Directory" permission for Azure AD connection - what will happen?

Hi there We have set up an application registration for our application and ticked the permission “Read directory data” as per the instructions in the doc below: We now want to set this permission to OFF. We don’t need any extended profiles or security groups or other group info from the directory - we just need the signed in user’s basic details. What would happen if we turn this off? Note: I have already seen this topic but it didn’t really tell me why this permissions was needed, so want…

Can someone help me with that ?

Best,
Nicolas

[sam.julien]

To sum up what we talked about on Twitter:

• It’s only required if you choose to get more user details (groups, extended properties, etc.)
• …but you just opted in for the basic user data & Azure AD is still telling you the apps need more permissions (that only an admin can grant).
• Sign in and read user profile permissions are normal for apps authenticating using OpenID Connect (Microsoft Graph permissions reference - Microsoft Graph | Microsoft Learn)
• You manage the Azure AD of the working connection and set the correct permissions as described in the Auth0 doc.

And the key question is: How could I tell the Connection to not ask for Directory Read permissions?

I think the doc in question is here: Connect Your App to Microsoft Azure Active Directory

Are we on track?

[nlenepveu]

Thanks for this summary! We’re perfectly on track!

[kstrongholte]

Hi Nicolas,

I’ve reached out internally for more information regarding this permission requirement and will share what I discover.

[nlenepveu]

Hello Kevin,

Any updates regarding this topic ? My first need would be to be able to explain why the permission is required. Could you help with this ? Sorry to bug you again about this.

[kstrongholte]

We only require User.Read if the extended profile is enabled, and Directory.Read.All if groups are requested.

And yet you’re still being prompted to provide these permissions?

Can you verify that the following options are not enabled on your Azure AD configuration page?

[nlenepveu]

Hi Kevin,

Thanks for your reply. The permissions were not enabled on the configuration pages of both connections.
I just removed the permissions in the Azure AD that I manage and indeed, both permissions are not required, I am able to configure a working connection.
So, I suppose there is a misconfiguration in the permissions of the tenant of my client (that I don’t manage).

Sorry for disturbing you guys about this.

Thanks again for your support!

Best,
Nicolas