Appearance
For the helpdesk use case, imper.ai requires the following Entra app permissions to build identity verification questions from available data and to reset passwords during remediation.
This article explains which permissions are required and why they are needed.
NOTE
These permissions are for a full integration. If you prefer, any of them can be removed - the verification questions that rely on the removed data will simply not be available for your organization.
How Permissions Are Granted
Permissions are granted during the Microsoft Entra consent flow when an administrator authorizes imper.ai in the Azure / Entra portal. They are approved at the tenant level.
NOTE
Some permissions require a Global Administrator or Application Administrator role. Resetting a user's password also requires the imper.ai service principal to hold a privileged role such as Privileged Authentication Administrator or User Administrator.
Permissions Requested by imper.ai
User.Read.All
Type: Application
Used for:
- Reading user profiles to identify users and build verification questions
User.ReadBasic.All
Type: Application
Used for:
- Reading basic profile information (such as display name and email) to identify users
Directory.Read.All
Type: Application
Used for:
- Reading directory data and organizational context used during verification
RoleManagement.Read.All
Type: Application
Used for:
- Identifying privileged users (such as administrators) so that certain actions are not performed on them
Group.Read.All
Type: Application
Used for:
- Reading group memberships to generate group-based verification questions
AuditLog.Read.All
Type: Application
Used for:
Reading sign-in (login) history used during verification
Requires Azure AD Premium P1
Mail.Read
Type: Application
Used for:
- Reading email metadata to generate verification questions
Calendars.Read
Type: Application
Used for:
- Reading calendar events to generate verification questions
Chat.Read.All
Type: Application
Used for:
- Reading recent chats to generate verification questions
ChatMessage.Read.All
Type: Application
Used for:
- Reading chat message content to generate verification questions
Password Reset Permissions
These permissions are relevant only for organizations that reset passwords directly in Microsoft Entra. They allow imper.ai to reset a user's credentials during helpdesk remediation, after successful verification.
NOTE
If your organization does not reset passwords in Entra, these permissions are optional and can be removed during integration.
User-PasswordProfile.ReadWrite.All
Type: Application
Used for:
- Setting or resetting a user's corporate password in Entra during remediation
UserAuthenticationMethod.ReadWrite.All
Type: Application
Used for:
- Managing a user's authentication methods (such as resetting MFA) in Entra during remediation