> ## Documentation Index > Fetch the complete documentation index at: https://iru-kbee-63-enhance-rts-documentation.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Entra Id Permissions > Review the Microsoft Entra ID API permissions required for directory integration with Iru Endpoint. Understand required scopes for user and group sync. This guide applies to Mac computers and Windows devices ### Microsoft Entra ID Permissions Microsoft Entra ID Permissions in Iru Endpoint are the Graph API scopes Iru Endpoint requests for directory integration. With these scopes, Iru Endpoint can sync users and groups and authenticate directory users. ### How It Works #### Integration Overview The Microsoft Entra ID Integration in Iru Endpoint syncs Microsoft Entra ID user and group objects into the Iru Endpoint user directory, so administrators can assign devices to those users. Iru Endpoint uses these delegated permissions through the Microsoft Graph API to sync directory information. #### Permissions Overview The following permissions are automatically requested and required to successfully sync Microsoft Entra ID users and groups into Iru Endpoint. A Microsoft Entra ID Administrator needs to have sufficient permissions to delegate the following permissions to Iru Endpoint. | **Permission** | **Display Text** | **Justification** | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Group.Read.All` | Read all groups | Allows Iru Endpoint to list groups, and to read their properties and all group memberships on behalf of the signed-in user. | | `User.Read.All` | Read all users' full profiles | Synchronize all AD Users | | `User.Read` | Sign in and read user profile | Store integrating AD administrator's information | | `offline_access` | Maintain access to data you have given it access to | Allows long-term syncing | | `openid` | Allows users to sign in to the app with their work or school accounts and allows the app to see basic user profile information. | Used for legacy OpenID login for Microsoft Entra ID users into Iru Endpoint. (This is now handled by a new independent Microsoft Entra ID application record) |