Permissions
When using the CIPP SAM Wizard, the application and set permissions are created for you. If you have a manual SAM installation you'll need to setup these permissions yourself.
You may skip this step if you are planning to use the Secure Application Model Wizard within CIPP
Manual SAM setup
You should grant the following permissions to the secure application model registration, to add permissions follow these instructions:
- Go to the Azure Portal.
- Select Azure Active Directory, now select App Registrations.
- Find your Secure App Model application. You can search based on the Application ID.
- Go to API Permissions and select Add a permission.
- Choose "Microsoft Graph" and "Delegated permission" or "Application Permissions"
- Add the permission you need
- Finally, select "Grant Admin Consent" for Company Name.
Permissions
For full functionality, CIPP needs the following permissions for the Secure Application Model registration. You can remove any permissions if you don't want the application to be able to use that functionality. This may cause you to see errors in the application.
Duplicate Permissions
Some permissions may appear duplicated in the Delegated and Application permissions tables below. This is by design and you do need to add both permissions!
Delegated Permissions
List of delegated permissions used by CIPP:
API / Permissions name | Description |
---|---|
Application.Read.All | Read applications |
Application.ReadWrite.All | Read and write all applications |
AuditLog.Read.All | Read audit log data |
Channel.Create | Create channels |
Channel.ReadBasic.All | Read the names and descriptions of channels |
Channel.Delete.All | Delete Channels |
ChannelMember.Read.All | Read the members of channels |
ChannelMember.ReadWrite.All | Add and remove members from channels |
ChannelMessage.Edit | Edit users' channel messages |
ChannelMessage.Read.All | Read users' channel messages |
ChannelMessage.Send | Send channel messages |
ChannelSettings.Read.All | Read the names, descriptions, and settings of channels |
ChannelSettings.ReadWrite.All | Read and write the names, descriptions, and settings of channels |
ConsentRequest.Read.All | Read consent requests |
Device.Command | Communicate with user devices |
Device.Read | Read user devices |
Device.Read.All | Read all devices |
DeviceManagementApps.ReadWrite.All | Read and write Microsoft Intune apps |
DeviceManagementConfiguration.ReadWrite.All | Read and write Microsoft Intune Device Configuration and Policies |
DeviceManagementManagedDevices.ReadWrite.All | Read and write Microsoft Intune devices |
DeviceManagementRBAC.ReadWrite.All | Read and write Microsoft Intune RBAC settings |
DeviceManagementServiceConfig.ReadWrite.All | Read and write Microsoft Intune configuration |
Directory.AccessAsUser.All | Access directory as the signed in user |
Domain.Read.All | Read domain data |
Group.ReadWrite.All | Read and write all groups |
GroupMember.ReadWrite.All | Read and write group memberships |
Mail.Send | Send mail as a user |
Mail.Send.Shared | Send mail on behalf of others |
Member.Read.Hidden | Read hidden memberships |
Organization.ReadWrite.All | Read and write organization information |
Policy.Read.All | Read your organization's policies |
Policy.ReadWrite.AuthenticationFlows | Read and write authentication flow policies |
Policy.ReadWrite.AuthenticationMethod | Read and write authentication method policies |
Policy.ReadWrite.Authorization | Read and write your organization's authorization policy |
Policy.ReadWrite.ConditionalAccess | Read and write conditional access policy |
Policy.ReadWrite.ConsentRequest | Read and write consent request policy |
Policy.ReadWrite.DeviceConfiguration | Read and write your organization's device configuration policies |
PrivilegedAccess.Read.AzureResources | Read privileged access to Azure resources |
PrivilegedAccess.ReadWrite.AzureResources | Read and write privileged access to Azure resources |
profile | View users' basic profile |
Reports.Read.All | Read all usage reports |
RoleManagement.ReadWrite.Directory | Read and write directory RBAC settings |
SecurityActions.ReadWrite.All | Read and update your organization's security actions |
SecurityEvents.ReadWrite.All | Read and update your organization's security events |
ServiceHealth.Read.All | Read service health |
ServiceMessage.Read.All | Read service announcement messages |
Sites.ReadWrite.All | Edit or delete items in all site collections |
TeamMember.ReadWrite.All | Add and remove members from teams |
TeamMember.ReadWriteNonOwnerRole.All | Add and remove members with non-owner role for all teams |
TeamsActivity.Read | Read users' teamwork activity feed |
TeamsActivity.Send | Send a teamwork activity as the user |
TeamsAppInstallation.ReadForChat | Read installed Teams apps in chats |
TeamsAppInstallation.ReadForTeam | Read installed Teams apps in teams |
TeamsAppInstallation.ReadForUser | Read users' installed Teams apps |
TeamsAppInstallation.ReadWriteForChat | Manage installed Teams apps in chats |
TeamsAppInstallation.ReadWriteForTeam | Manage installed Teams apps in teams |
TeamsAppInstallation.ReadWriteForUser | Manage users' installed Teams apps |
TeamsAppInstallation.ReadWriteSelfForChat | Allow the Teams app to manage itself in chats |
TeamsAppInstallation.ReadWriteSelfForTeam | Allow the app to manage itself in teams |
TeamsAppInstallation.ReadWriteSelfForUser | Allow the Teams app to manage itself for a user |
TeamSettings.Read.All | Read teams' settings |
TeamSettings.ReadWrite.All | Read and change teams' settings |
TeamsTab.Create | Create tabs in Microsoft Teams |
TeamsTab.Read.All | Read tabs in Microsoft Teams |
TeamsTab.ReadWrite.All | Read and write tabs in Microsoft Teams |
TeamsTab.ReadWriteForChat | Allow the Teams app to manage all tabs in chats |
TeamsTab.ReadWriteForTeam | Allow the Teams app to manage all tabs in teams |
TeamsTab.ReadWriteForUser | Allow the Teams app to manage all tabs for a user |
Team.Create | Create teams |
Team.ReadBasic.All | Read the names and descriptions of teams |
ThreatAssessment.ReadWrite.All | Read and write threat assessment requests |
UnifiedGroupMember.Read.AsGuest | Read unified group memberships as guest |
User.ManageIdentities.All | Manage user identities |
User.Read | Sign in and read user profile |
User.ReadWrite.All | Read and write all users' full profiles |
UserAuthenticationMethod.Read.All | Read all users' authentication methods |
UserAuthenticationMethod.ReadWrite | Read and write user authentication methods |
UserAuthenticationMethod.ReadWrite.All | Read and write all users' authentication methods |
Application Permissions
List of application permissions used by CIPP:
API / Permissions name | Description |
---|---|
Channel.Create | Create channels |
Channel.ReadBasic.All | Read the names and descriptions of channels |
ChannelMember.Read.All | Read the members of channels |
ChannelMember.ReadWrite.All | Add and remove members from channels |
Device.ReadWrite.All | Read and write devices |
DeviceManagementApps.ReadWrite.All | Read and write Microsoft Intune apps |
DeviceManagementConfiguration.ReadWrite.All | Read and write Microsoft Intune Device Configuration and Policies |
DeviceManagementManagedDevices.PrivilegedOperations.All | Perform user-impacting remote actions on Microsoft Intune devices |
DeviceManagementManagedDevices.Read.All | Read Microsoft Intune devices |
DeviceManagementManagedDevices.ReadWrite.All | Read and write Microsoft Intune devices |
DeviceManagementRBAC.Read.All | Read Microsoft Intune RBAC settings |
DeviceManagementRBAC.ReadWrite.All | Read and write Microsoft Intune RBAC settings |
DeviceManagementServiceConfig.Read.All | Read Microsoft Intune configuration |
DeviceManagementServiceConfig.ReadWrite.All | Read and write Microsoft Intune configuration |
Directory.Read.All | Read directory data |
Group.Create | Create groups |
Group.Read.All | Read all groups |
Group.ReadWrite.All | Read and write all groups |
GroupMember.ReadWrite.All | Read and write group memberships |
Mail.Send | Send mail as a user |
Organization.ReadWrite.All | Read and write organization information |
Policy.Read.All | Read your organization's policies |
Policy.ReadWrite.AuthenticationFlows | Read and write authentication flow policies |
Policy.ReadWrite.AuthenticationMethod | Read and write authentication method policies |
Policy.ReadWrite.ConditionalAccess | Read and write conditional access policy |
Policy.ReadWrite.ConsentRequest | Read and write consent request policy |
PrivilegedAccess.ReadWrite.AzureADGroup | Read and write privileged access to Azure AD groups |
Reports.Read.All | Read all usage reports |
RoleManagement.ReadWrite.Directory | Read and write directory RBAC settings |
SecurityEvents.Read.All | Read your organization's security events |
Sites.FullControl.All | Have full control of all site collections |
Team.ReadBasic.All | Read the names and descriptions of teams |
TeamMember.ReadWrite.All | Add and remove members from teams |
TeamMember.ReadWriteNonOwnerRole.All | Add and remove members with non-owner role for all teams |
User.ReadWrite.All | Read and write all users' full profiles |
UserAuthenticationMethod.ReadWrite.All | Read and write all users' authentication methods |