Permissions (least privilege)

Which Microsoft Graph permissions the Swopi integration with Entra ID uses — read-only, the principle of least privilege, with admin consent.

This page is for IT and security teams: it describes exactly which permissions the Swopi integration with Microsoft Entra ID requires and why. Nothing more than necessary.

Summary for a security review: Swopi LiveSync™ reads from Microsoft Graph read-only, within the scope required to create and update business cards. No writes to your directory. Everything under admin consent, which you can revoke at any time.

#The principle of least privilege

The integration is built on the principle of least privilege — it has exactly as much access as it needs to do its job (reading the members of selected groups and their basic profile), and nothing more. No permission to write, delete, or manage your tenant.

#Microsoft Graph permissions used

The integration uses Application permissions (app-only, the client_credentials flow) — read-only, with admin consent:

Permission Type What it is used for
User.Read.All Application (read-only) Reading member profiles (name, email, position, company, phone) to create the business card
GroupMember.Read.All Application (read-only) Determining who is a member of the selected groups — they drive synchronization and role mapping

If you also use SSO via OIDC, the standard sign-in scopes openid, profile, email (the identity of the user signing in) are added.

#What the integration does NOT do

  • Does not write anything to your Entra ID — the direction is strictly Entra ID → Swopi.
  • Does not delete users or groups in your directory.
  • Does not read passwords, mailboxes, files, or calendars — only the profile and group membership you select.
  • Does not synchronize groups you do not select; access is limited to the security groups you choose.

#Security of credentials

  • The client secret entered during configuration is stored encrypted and never leaves the Swopi server (it is not shown in the interface and is not sent to the browser).
  • Swopi data runs in the EU (europe-west1).
  • You can revoke both admin consent and the client secret in the Azure Portal at any time — this immediately terminates access.

Granting is described in the Synchronizing members from Entra ID guide (Step 1 — App Registration → Grant admin consent). Access can be revoked in the Azure Portal: Entra ID → Enterprise applications → (the Swopi application) → Permissions, or by deleting the client secret in the App registration.

Questions about integration security: support@swopi.co