For the enrollment use case, imper.ai requires the following Microsoft Entra ID / Microsoft Graph permissions to identify new hires and verify their first sign-in after enrollment.

This article explains which permissions are required and why they are needed.

---

How Permissions Are Granted

Permissions are granted during the Microsoft Entra consent flow when an administrator authorizes imper.ai in the Azure / Entra portal. They are approved at the tenant level.

NOTE

Some permissions require a Global Administrator or Application Administrator role.

---

Permissions Requested by imper.ai

imper.ai uses these permissions to fetch and identify users during enrollment.

User.Read.All

Type: Application

Used for:

• Reading user profiles to identify and match new hires

---

User.ReadBasic.All

Type: Application

Used for:

• Reading basic profile information (such as display name and email) to identify and match new hires

---

Directory.Read.All

Type: Application

Used for:

• Reading directory data associated with the new hire

---

RoleManagement.Read.All

Type: Application

Used for:

• Identifying privileged users (such as administrators) so that certain actions are not performed on them

---

AuditLog.Read.All

Type: Application

Used for:

• Reading sign-in logs to verify that the new hire signed in after enrollment

• Requires Azure AD Premium P1

---

Permissions for Temporary Access Pass (TAP)

The following additional permissions are required to issue a Temporary Access Pass (TAP) for the new hire.

NOTE

If your organization does not issue a TAP through imper.ai, these permissions are optional and can be removed during integration.

UserAuthenticationMethod.ReadWrite.All

Type: Application

Used for:

• Managing the user's authentication methods in order to create a Temporary Access Pass (TAP)

---

Policy.Read.AuthenticationMethod

Type: Application

Used for:

• Reading the authentication methods policy to confirm that Temporary Access Pass is enabled and configured for the tenant