Appearance
For the helpdesk use case, imper.ai requires the following Entra app permissions to build identity verification questions from available data and to issue a Temporary Access Pass during remediation.
This article explains which permissions are required and why they are needed.
NOTE
These permissions are for a full integration. If you prefer, any of them can be removed - the verification questions that rely on the removed data will simply not be available for your organization.
How Permissions Are Granted
Permissions are granted during the Microsoft Entra consent flow when an administrator authorizes imper.ai in the Azure / Entra portal. They are approved at the tenant level.
NOTE
Some permissions require a Global Administrator or Application Administrator role. Issuing a Temporary Access Pass also requires the imper.ai service principal to hold a privileged role such as Privileged Authentication Administrator or Authentication Administrator.
Permissions Requested by imper.ai
User.Read.All
Type: Application
Used for:
- Reading user profiles to identify users and build verification questions
User.ReadBasic.All
Type: Application
Used for:
- Reading basic profile information (such as display name and email) to identify users
Directory.Read.All
Type: Application
Used for:
- Reading directory data and organizational context used during verification
RoleManagement.Read.All
Type: Application
Used for:
- Identifying privileged users (such as administrators) so that certain actions are not performed on them
Group.Read.All
Type: Application
Used for:
- Reading group memberships to generate group-based verification questions
AuditLog.Read.All
Type: Application
Used for:
Reading sign-in (login) history used during verification
Requires Azure AD Premium P1
Mail.Read
Type: Application
Used for:
- Reading email metadata to generate verification questions
Calendars.Read
Type: Application
Used for:
- Reading calendar events to generate verification questions
Chat.Read.All
Type: Application
Used for:
- Reading recent chats to generate verification questions
ChatMessage.Read.All
Type: Application
Used for:
- Reading chat message content to generate verification questions
Permissions for Temporary Access Pass (TAP)
After successful verification, imper.ai can issue a Temporary Access Pass (TAP) for the user during helpdesk remediation. This requires the following permissions.
NOTE
If your organization does not issue a TAP through imper.ai, these permissions are optional and can be removed during integration.
UserAuthenticationMethod.ReadWrite.All
Type: Application
Used for:
- Managing the user's authentication methods in order to create a Temporary Access Pass (TAP)
Policy.Read.AuthenticationMethod
Type: Application
Used for:
- Reading the authentication methods policy to confirm that Temporary Access Pass is enabled and configured for the tenant