Azure AD integration MS Graph permission

[CodeTwo]

Based on article: https://www.3cx.com/docs/manual/microsoft-365/ Azure AD integration require Directory.Read.All permission which allow 3CX app to read all directory properties. This is potential security issue as directory might contain sensitive information. Can I use User.ReadBasic.All instead? This permission allow access to following attributes:

• displayName
• givenName
• mail
• photo
• surname
• userPrincipalName

 

[Evolute IT]

I would use the correct permission. Security isn't a problem as long as it's readonly. Also, those fields aren't enough for the integration.

 

[CodeTwo]

Do you know what attributes are required to integrate with Azure AD? I know in most cases read-only isn’t problem however we have attributes that we don`t want to expose to external applications.

 

[Charles_3CX]

Regarding your question, the graph permission required is the ones from the guide: https://www.3cx.com/docs/manual/microsoft-365/

See this screenshot also for what they should look like:

 

[CodeTwo]

Regarding your question, the graph permission required is the ones from the guide: https://www.3cx.com/docs/manual/microsoft-365/

See this screenshot also for what they should look like:

View attachment 33408

Could you tell me what information/fields from Azure AD are readed by 3CX via Directory.Read.All permission? This is crucial for us from security perspective.

 

[Charles_3CX]

The Directory.Read.All permission allows the app to read data, such as users, groups, etc., and is essential for the 365 sync process.