Graph permissions
What RingSync requests
RingSync uses application permissions (not delegated): the backend calls Microsoft Graph server-side with client_credentials, on behalf of the app rather than a signed-in user. All three require admin consent.
| Permission | Type | Used for |
|---|---|---|
User.Read.All | Application | Reading the user directory (/v1.0/users, /users/delta) to map directory fields onto native contacts. |
GroupMember.Read.All | Application | Resolving transitive membership of the Entra groups selected for sync (/groups/{id}/transitiveMembers). |
Application.Read.All | Application | Reading appRoleAssignedTo to know which users are authorized to use RingSync, and reading app metadata to validate the sign-in audience. |
These are tenant-wide application permissions. They let RingSync read the directory without an interactive user. The mobile login uses a separate identity app with only openid profile email and no Graph access.
Why each permission
User.Read.All
The core of the product: RingSync reads user objects to build contacts (given name, surname, mail, phones, job title, department, company, photo). Without it, no directory data can be read.
GroupMember.Read.All
When sync is scoped to specific Entra groups (a Pro and above feature), RingSync resolves the groups' members — including nested groups — to know which users to sync. It is also used to expand groups used for app assignment.
Application.Read.All
RingSync provisions access by pulling appRoleAssignedTo on its own service principal: this is the authoritative list of who is allowed to use the app. The same permission lets RingSync confirm the app's sign-in audience is multi-tenant during onboarding.
What RingSync does not request
RingSync requests read-only directory scopes. It does not request write permissions, mail, calendar, files, or any delegated user-impersonation scope for Graph access. Sync is strictly one-way and read-only against your directory.
Auditing the permissions
You can review exactly what was consented at any time:
- Azure portal → Enterprise applications → RingSync → Permissions.
- Review the list of granted application permissions — it should match the three above.
- For Custom mode, also check App registrations → your app → API permissions.
Reducing scope
The three permissions are the minimum RingSync needs to operate as designed. Group filtering relies on GroupMember.Read.All; provisioning relies on Application.Read.All. Removing any one of them breaks a corresponding feature. There is no narrower combination that preserves full functionality.
Revoking access
To disconnect RingSync from your tenant:
- Azure portal → Enterprise applications → RingSync → Properties → Delete, or revoke the consent under Permissions.
- In Custom mode, also delete the app registration and its client secret under App registrations.
- In the RingSync back office, remove the tenant so RingSync stops attempting Graph calls.
Once consent is revoked, RingSync can no longer read the directory and syncs fail. Contacts already on devices remain until a wipe is triggered or the app is removed.