Is Directory.Read.All permission sufficient to enable Group sync feature of AAD plugin?

Question

Is Directory.Read.All permission sufficient to enable Group sync feature of AAD plugin?

vsalunkhe1988 opened this issue 2 years ago · comments

vsalunkhe1988 commented 2 years ago

Hi, As per the documentation https://github.com/hkamel/sonar-auth-aad/wiki/Group-Sync to enable group sync we need to allow "Directory.AccessAsUser.All" for the application under the API permissions in AAD. Our Active directory architecture board is bit hesitant on allowing such permission as it has more privilege's than just reading groups and underlying members.
So is "Directory.Read.All" permission would be sufficient to enable Group sync feature of AAD plugin?

vsalunkhe1988 · Answer 1 · Tue Jun 21 2022 15:10:18 GMT+0800 (China Standard Time)

Also do we need to configure the plugin with Client ID and Client Secret in order to have group sync in place?

BevanG · Answer 2 · Wed Jun 22 2022 09:57:56 GMT+0800 (China Standard Time)

I've just configured mine and Directory.Read.All looks like it's sufficient. And yes you need ID and Secret otherwise the application has no way to authenticate to AzureAD

Michael Johnson · Answer 3 · Wed Aug 03 2022 05:51:04 GMT+0800 (China Standard Time)

I know MS has updated permissions for some of these calls, so I'll do some testing as soon as I have time to determine the best/lowest permissions for the calls we make.

For reference, we're using the /user/{id}/transitiveMemberOf call, which is documented along with needed permissions at https://docs.microsoft.com/en-us/graph/api/user-list-transitivememberof