Azure AD Does Not Require "Directory.Read.All" Access Privileges
Last Updated:
Overview
Azure Active Directory (AD) is configured as part of an enterprise federation. The Auth0 documentation states that two levels of delegated permissions are supported:
| Users > User.Read | The app can sign in users and read the signed-in users' profiles |
| Directory > Directory.Read.All | The app can read directory data on the signed-in user's behalf. |
This article clarifies whether the permission Directory.Read.All is strictly necessary for the context of the application not using directory access.
Applies To
- Azure AD
- Graph API Permissions
Solution
The Directory.Read.All permission is not strictly required. The connection should work as expected with only the User.Read permission enabled.
In general, Auth0 only requires:
- User.Read if the extended profile is enabled.
- Directory.Read.All if groups are requested.
Related References
