Microsoft permissions
An Entra administrator or a security officer checks what RingSync can do in their Microsoft tenant before granting consent, and how to remove that access.
What RingSync requests
RingSync reads the users and groups of your directory to build the contacts on phones and to compute who has access to the app. It does not create, modify or delete any user, group or contact in your directory. The three permissions are of the application type and require admin consent: RingSync's servers call Microsoft Graph with the application's token, with no signed-in user.
| Permission | What it allows | Why RingSync needs it |
|---|---|---|
User.Read.All | Read the profiles of the tenant's users. | Build the contacts: first name, last name, email, phones, job title, department, company, account state and photo. |
GroupMember.Read.All | List groups and read their members, including those of nested groups. | Compute the seats of the groups assigned to the application, apply Sync scope and Groups to exclude, and fill the group lists in the dashboard. |
Application.Read.All | Read applications and their service principals, including the list of assigned people and groups. | Know who is assigned to the RingSync enterprise application, and therefore who has a seat. With manual entry, check that the registration is multi-tenant and read the expiry date of its client secret. |
These permissions cover the whole tenant, not only the assigned people: the scope of synced contacts is set in RingSync, see Select and exclude groups. The fields read and written to phones are listed in Synced information.
Employees sign in to the mobile app through another application, "RingSync Identity". It only requests openid profile email and has no access to Microsoft Graph.
What RingSync does not request
RingSync requests no write permission on users or groups, no access to emails, calendars or files, and no delegated permission that would let it act on behalf of a user. Sync is one-way: from the directory to the phones.
Audit the permissions
- In the Entra admin center, open the RingSync enterprise application: "RingSync Graph Access" with Sign in to Microsoft, the name you chose with Manual entry.
- Open the page listing its permissions.
- Check that the list of granted application permissions matches the three above.
- With manual entry, also check the API permissions in the app registration.
Reduce the scope
RingSync uses each of these three permissions. Without GroupMember.Read.All, it can no longer read group members: group-based seat assignment and group filtering stop working. Without Application.Read.All, it can no longer read the assignments, so it no longer knows who has a seat. Without User.Read.All, it can no longer read users. There is no narrower combination that keeps every feature.
Revoke access
Follow this order so that contacts are also removed from phones.
- In RingSync, open Settings → Danger zone, click Delete the directory, then confirm with Delete. Seats, syncs, settings and encrypted credentials are deleted, and phones purge the directory's contacts.
- In Entra, delete the RingSync enterprise application, or revoke its consent.
- With manual entry, also delete the app registration, or at least its client secret.
RingSync can no longer read the directory: syncs fail and the removal of a seat can no longer be detected. Contacts already on phones stay there. To remove them, delete the directory in RingSync (step 1). Each person can also tap Remove synced contacts in the app settings. The purge happens at the latest the next time the app is opened, and sooner if the app is in the foreground or a sync is running. See Security and data.
Technical details
- Reading users:
/v1.0/users/deltafor sync,/v1.0/users/{id}and/photo/$valuefor one user and their photo. - Reading groups:
/v1.0/groupsfor the lists,/v1.0/groups/{id}/transitiveMembersfor members, including nested ones. - Reading assignments:
/v1.0/servicePrincipals/{id}/appRoleAssignedTo. With manual entry, RingSync also reads the app registration (signInAudienceand the secrets' expiry dates, never their value). - One attempted setting: RingSync tries to set
appRoleAssignmentRequiredtotrueon the enterprise application's service principal, so that Entra refuses unassigned users. If Microsoft refuses this setting with these permissions, the connection still succeeds and you turn it on in Entra. See Microsoft Entra ID. - Call duration: each Graph call has a maximum timeout of 60 seconds on the server side.