For the enrollment use case, imper.ai requires the following Microsoft Entra ID / Microsoft Graph permissions to identify new hires and verify their first sign-in after enrollment.

This article explains which permissions are required and why they are needed.

---

How Permissions Are Granted

Permissions are granted during the Microsoft Entra consent flow when an administrator authorizes imper.ai in the Azure / Entra portal. They are approved at the tenant level.

NOTE

Some permissions require a Global Administrator or Application Administrator role.

---

Permissions Requested by imper.ai

imper.ai uses these permissions to fetch and identify users during enrollment.

User.Read.All

Type: Application

Used for:

• Reading user profiles to identify and match new hires

---

User.ReadBasic.All

Type: Application

Used for:

• Reading basic profile information (such as display name and email) to identify and match new hires

---

Directory.Read.All

Type: Application

Used for:

• Reading directory data associated with the new hire

---

RoleManagement.Read.All

Type: Application

Used for:

• Identifying privileged users (such as administrators) so that certain actions are not performed on them

---

AuditLog.Read.All

Type: Application

Used for:

• Reading sign-in logs to verify that the new hire signed in after enrollment

• Requires Azure AD Premium P1