--- title: Required Permissions Reference slug: required-permissions-reference docTags: createdAt: 2025-08-17T19:40:54.560Z --- # Introduction Activate integrates with Microsoft Entra ID, Microsoft 365, and Exchange Online to automate identity lifecycle, access provisioning, and collaboration services. To perform these functions securely, Activate requires specific delegated or application permissions within your tenant. This section outlines the **minimum permissions required for each Activate product**. Each permission is listed alongside a short explanation of **why it is needed** so administrators can validate scope, reduce unnecessary privilege, and meet least-privilege security principles. Permissions are grouped by product area, for example: - **Identity & Access Management** – user provisioning, group membership, lifecycle actions - **Data Access Management** – shared mailbox and distribution list management - **Collaboration Management** – Teams creation and channel management - **Service Desk and Catalogue** – device, service, and licence management Some products do not require any additional Azure or Microsoft 365 permissions; these are also noted explicitly for clarity. :::hint{type="info"} Note: Microsoft continues to deprecate legacy PowerShell modules (MSOnline, AzureAD) in favour of the Microsoft Graph API. Activate supports both where required, but organisations should plan to migrate to Graph permissions wherever possible. ::: ## How to Use This Section - **Review the products your organisation intends to deploy.** - **Request the listed permissions during App Registration in Entra ID.** This ensures Activate has exactly the access it needs — no more, no less. - **Audit regularly.** As Microsoft Graph evolves, check if permissions can be reduced or updated. # Identity Access Management ## Identity & Access Manager | **Permission** | **Why It's Needed** | | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | User.ReadWrite.All | Required to create, update, or disable user accounts during provisioning and deprovisioning. | | Group.ReadWrite.All | Needed to add or remove users from groups so access can be granted or revoked automatically. | | Directory.ReadWrite.All | Provides the ability to manage directory objects (users, groups, devices) — essential for lifecycle tasks like onboarding/offboarding. | | User-Phone.ReadWrite.All | Allows updating phone number attributes used for authentication or contact information. | | User Administrator | Grants administrative control to reset passwords, assign roles, and manage user identity lifecycle tasks. | | Exchange Administrator | Only required for mailbox creation and management in Exchange Online. | | MailboxSettings.ReadWrite | Enables Activate to read and configure Out of Office messages and mailbox preferences for users. | ## Role Manager | **Permission** | **Why It's Needed** | | -------------------------- | -------------------------------------------------------------------------------------------------------- | | GroupMember.ReadWrite.All | Required to add or remove members from groups. Not needed if **Group.ReadWrite.All** is already granted. | ## Self-service Password Reset Manager | **Permission** | **Why It's Needed** | | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | User.ReadWrite.All | Required to create, update, or disable user accounts during provisioning and deprovisioning. | | Helpdesk Administrator | Grants the ability to reset user passwords and invalidate refresh tokens, which is essential for self-service password reset workflows. | ## Privileged Access Manager | **Permission** | **Why It's Needed** | | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | User.ReadWrite.All | Required to create, update, or disable user accounts during provisioning and deprovisioning. | | Group.ReadWrite.All | Needed to add or remove users from groups so access can be granted or revoked automatically. | | Directory.ReadWrite.All | Provides the ability to manage directory objects (users, groups, devices) — essential for lifecycle tasks like onboarding/offboarding. | | User Administrator | Grants administrative control to reset passwords, assign roles, and manage user identity lifecycle tasks. | ## Security Group Compliance Manager No additional Azure permissions required ## Security Group Manager | **Permission** | **Why It's Needed** | | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | User.ReadWrite.All | Required to create, update, or disable user accounts during provisioning and deprovisioning. | | Group.ReadWrite.All | Needed to add or remove users from groups so access can be granted or revoked automatically. | | Directory.ReadWrite.All | Provides the ability to manage directory objects (users, groups, devices) — essential for lifecycle tasks like onboarding/offboarding. | | User Administrator | Grants administrative control to reset passwords, assign roles, and manage user identity lifecycle tasks. | ## ITSM Service Desk Integrations Manager No additional Azure permissions required # Data Access Management ## Shared Mailbox Manager | **Permission** | **Why It's Needed** | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | User.ReadWrite.All | Required to create, update, or disable user accounts during provisioning and deprovisioning. | | Directory.ReadWrite.All | Provides the ability to manage directory objects (users, groups, devices) — essential for lifecycle tasks like onboarding/offboarding. | | Exchange Administrator | Only required for mailbox creation and management in Exchange Online. | | Exchange.ManageAsApp | Allows Activate to manage Exchange Online mailboxes directly as an application, without needing a signed-in user. Required for automated shared mailbox management. | ## Distribution List Manager | **Permission** | **Why It's Needed** | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Exchange Administrator | Required to use **BypassSecurityGroupManagerCheck **flag on Add-DistributionGroupMember | | Exchange.ManageAsApp | Allows Activate to manage Exchange Online mailboxes directly as an application, without needing a signed-in user. Required for automated distribution list management. | **** ## Folder Manager No additional Azure permissions required ## Teams® Manager | **Permission** | **Why It's Needed** | | --------------------------------- | --------------------------------------------------------------------------------------------------------- | | Team.Create | Required to create new Microsoft Teams workspaces for users or groups. | | Channel.Create.Group | Needed to create channels within Teams, enabling structured collaboration. | | User Administrator | Grants rights to manage Teams membership through user account and role management. | | Skype for Business Administrator | Provides backward compatibility for managing legacy Skype for Business policies that still affect Teams. | | Teams Communication Administrator | Required to manage Teams calling and meeting settings, such as conferencing and voice policies. | # Hardware and Software Management ## Asset and License Manager No additional Azure permissions required ## Service Catalogue Manager | **Permission** | **Why It's Needed** | | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | User.ReadWrite.All | Required to create, update, or disable user accounts during provisioning and deprovisioning. | | Group.ReadWrite.All | Needed to add or remove users from groups so access can be granted or revoked automatically. | | Directory.ReadWrite.All | Provides the ability to manage directory objects (users, groups, devices) — essential for lifecycle tasks like onboarding/offboarding. | | Device.ReadWrite.All | Required to read and update device objects in Azure AD, allowing Activate to sync and manage devices for computer selection. | | full\_access\_as\_app | Required to access mailboxes if Email Approvals is in use. | | User Administrator | Grants administrative control to reset passwords, assign roles, and manage user identity lifecycle tasks. | ## Device Asset Manager No additional Azure permissions required ## License and Subscription Manager No additional Azure permissions required ## Extension & Mobile Connection Manager No additional Azure permissions required # Other General Permissions These are permissions that are required for functions other than direct product use. | **Permission** | **Why It's Needed** | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | full\_access\_as\_app | Required to access mailbox content when Email Approvals is in use, or other mailbox content access is required. Can't be delegated to an application. | | Organization.Read.All | this is for querying license counts/subscribed SKUs |