API permissions for Azure AD - Saviynt integration

[KP18]

Hi,

We have a requirement where we need to integrate Saviynt with Azure AD just to reconcile Accounts and Groups to Saviynt. What are the API permissions we need to assign at Azure AD level while registering the application at Azure AD level just to provide Read-Only access?

[NM]

@KP18 read only permission to pull in users and groups will be fine.

[KP18]

@NM Assigning the user.read.all and groups.read.all API permissions at the Azure AD level should allow us to fetch account and group data or if we assign the Directory.Read.All permission instead, it should also fulfill these requirements. Can we proceed with this approach?

[Amit_Malik]

@KP18 , user.read.all and groups.read.all will work as well. Below is what we are using.

[rushikeshvartak]

Yes, your approach is correct in terms of API permissions needed to reconcile Accounts and Groups from Azure AD to Saviynt with read-only access.

Here are the necessary API permissions you should assign to the application in Azure AD when registering it for this purpose:

For Account Data:

1. User.Read.All: This permission allows the app to read user profiles without requiring the signed-in user's consent. It is necessary to fetch user details (accounts) from Azure AD.

For Group Data:

1. Group.Read.All: This permission enables the app to read all group properties and memberships without a signed-in user. It will be used to fetch groups and their memberships.

Alternatively (for both Accounts and Groups):

1. Directory.Read.All: This is a broader permission that includes access to all user profiles and group details. It can serve both purposes (reading users and groups) in a single permission.

Permission Types:

• Delegated permissions: Used when the app is accessing resources as the signed-in user.
• Application permissions: Used when the app needs to access resources independently, without a signed-in user.

In this case, you will need Application permissions for User.Read.All and Group.Read.All (or Directory.Read.All), since the reconciliation task doesn't require user interaction.

Steps to Assign Permissions:

1. Register your application in Azure AD.
2. Go to API permissions under your application settings.
3. Add the required Application permissions:
   • User.Read.All (or Directory.Read.All).
   • Group.Read.All (if not using Directory.Read.All).
4. Click Grant admin consent for your organization to give the required permissions.

Once this is done, Saviynt should be able to reconcile Accounts and Groups from Azure AD.