> ## Documentation Index
> Fetch the complete documentation index at: https://docs.langdock.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra

> Review the minimum OAuth scopes for every Microsoft Entra action.

Review the minimum standard delegated scope mapping for every Microsoft Entra action. The mapping covers directory users, groups, group members, manager lookup, application registrations, app roles, and delegated permission grants. App-registration actions that resolve a service principal keep `Application.Read.All` alongside the write scope. `Sites.Selected` does not apply.

## Minimal scopes per action

<Note>
  Each Microsoft Entra connection also requests `openid`, `offline_access`, and `User.Read`. These connection scopes apply in addition to the action scopes in the table.
</Note>

<div style={{overflowX: "auto"}}>
  <table style={{width: "100%", maxWidth: "100%", minWidth: 0, tableLayout: "fixed", whiteSpace: "normal", overflowWrap: "anywhere", wordBreak: "break-word"}}>
    <colgroup>
      <col style={{width: "20%"}} />

      <col style={{width: "25%"}} />

      <col style={{width: "55%"}} />
    </colgroup>

    <thead>
      <tr>
        <th style={{width: "20%"}}>Action</th>
        <th style={{width: "25%"}}>Description</th>
        <th style={{width: "55%"}}>Minimum scopes</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <td><strong>Add client secret</strong></td>
        <td>Adds a client secret to an application registration.</td>
        <td><code>Application.ReadWrite.All</code></td>
      </tr>

      <tr>
        <td><strong>Add redirect URI</strong></td>
        <td>Adds a redirect URI to an application registration.</td>
        <td><code>Application.ReadWrite.All</code></td>
      </tr>

      <tr>
        <td><strong>Assign app role</strong></td>
        <td>Assigns an application permission (app role) to an application or service principal.</td>
        <td><code>AppRoleAssignment.ReadWrite.All</code><br /><code>Application.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Create permission grant</strong></td>
        <td>Creates a delegated OAuth permission grant for a service principal.</td>
        <td><code>DelegatedPermissionGrant.ReadWrite.All</code><br /><code>Application.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Delete permission grant</strong></td>
        <td>Deletes a delegated OAuth permission grant.</td>
        <td><code>DelegatedPermissionGrant.ReadWrite.All</code><br /><code>Application.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Get application</strong></td>
        <td>Gets an application registration, including credentials and API permissions.</td>
        <td><code>Application.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Get manager</strong></td>
        <td>Gets the direct manager of a user.</td>
        <td><code>User.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Get permission grant</strong></td>
        <td>Gets a delegated OAuth permission grant by ID.</td>
        <td><code>Directory.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>List app role assignments</strong></td>
        <td>Lists application permissions granted to an application or service principal.</td>
        <td><code>Application.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>List expiring credentials</strong></td>
        <td>Lists application secrets and certificates that are expired or expiring soon.</td>
        <td><code>Application.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>List permission grants</strong></td>
        <td>Lists delegated OAuth permission grants for an application or service principal.</td>
        <td><code>Directory.Read.All</code><br /><code>Application.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Remove app role</strong></td>
        <td>Removes an application permission from an application or service principal.</td>
        <td><code>AppRoleAssignment.ReadWrite.All</code><br /><code>Application.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Remove client secret</strong></td>
        <td>Removes a client secret from an application registration.</td>
        <td><code>Application.ReadWrite.All</code></td>
      </tr>

      <tr>
        <td><strong>Remove redirect URI</strong></td>
        <td>Removes a redirect URI from an application registration.</td>
        <td><code>Application.ReadWrite.All</code></td>
      </tr>

      <tr>
        <td><strong>Resolve application</strong></td>
        <td>Resolves an application registration by ID or name.</td>
        <td><code>Application.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Resolve group</strong></td>
        <td>Resolves a group in the directory.</td>
        <td><code>GroupMember.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Search applications</strong></td>
        <td>Searches application registrations.</td>
        <td><code>Application.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Search group members</strong></td>
        <td>Lists user members of a group, including profile fields and optional manager.</td>
        <td><code>GroupMember.Read.All</code><br /><code>User.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Search groups</strong></td>
        <td>Searches groups in the directory.</td>
        <td><code>GroupMember.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Search users</strong></td>
        <td>Searches users in the directory.</td>
        <td><code>User.Read.All</code></td>
      </tr>

      <tr>
        <td><strong>Update permission grant</strong></td>
        <td>Updates scopes on an existing delegated OAuth permission grant.</td>
        <td><code>DelegatedPermissionGrant.ReadWrite.All</code><br /><code>Application.Read.All</code></td>
      </tr>
    </tbody>
  </table>
</div>

## Related pages

* [Microsoft Integration Scopes](/en/admin/manage-integrations/microsoft-integration-scopes)
* [Microsoft integrations: permissions and admin approval](/en/admin/manage-integrations/integration-setup-guides/microsoft)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.