Requested permissions
We use Microsoft Graph to read directory/profile data only (users, groups, and org structure) to power OneDirectory. We request only the permissions needed to import this data.
OneDirectory never writes back, and we do not access Microsoft 365 content like email, files, calendars, SharePoint/OneDrive, or Teams messages.
When you click Connect Microsoft 365, Microsoft will show the permissions it’s requesting for OneDirectory (read-only). Below is each permission and why OneDirectory requests it.
Sign in and read user profile
Used to sign in and identify the admin during setup
Read directory data
Used to import users and directory attributes for org structure
Read all groups
Used for group-based filtering rules (group names and membership)
Read all users' full profiles
Used to import profile fields like title, office, department, manager, contact info.
Read all users' relevant people lists
Used to improve people discovery/search relevance
You can manage or revoke access at any time in the Microsoft Entra admin center, under Enterprise applications.
