Druva | Documentation

Permissions required for Microsoft Entra ID

This article provides the permissions that Druva needs to back up Microsoft Entra ID data.

Updated over 2 weeks ago

ℹ️ Info

Druva uses Read-Write permissions to create, read, or update data in Microsoft Entra ID.
Druva uses Read permissions to read data from Microsoft Entra ID.

Users

API permissions	Permission type	Usage
`User.ReadWrite.All` `User.Read.All`	Application	To backup and restore user objects

Groups

API permissions	Permission type	Usage
`Group.ReadWrite.All` `Group.Read.All` `GroupMember.ReadWrite.All`	Application	To backup and restore group objects and their members/owners

Applications

API permissions	Permission type	Usage
`Application.ReadWrite.All Application.Read.All`	Application	To backup and restore application objects and their members/owners

ServicePrincipals

API permissions	Permission type	Usage
`Application.ReadWrite.All Application.Read.All` `AppRoleAssignment.ReadWrite.All`	Application	To backup and restore enterprise applications objects and their members/owners

Devices

API permissions	Permission type	Usage
`Device.Read.All`	Application	To backup device objects and their owners

directoryRole

API permissions	Permission type	Usage
`RoleManagement.ReadWrite.Directory` `RoleManagement.Read.Directory` `RoleManagement.Read.All`	Application	To backup inbuilt directory roles and their assignments/members

Custom Roles

API permissions	Permission type	Usage
`RoleManagement.Read.Directory` `RoleManagement.ReadWrite.Directory`	Application	To backup and restore custom roles and their assignments/members (P2/E3/E5 license is required)

User Setting(Authorization Policy)

API permissions	Permission type	Usage
`Policy.Read.All` `Policy.ReadWrite.Authorization`	Application	To backup and update user settings

TenantSetting

API permissions	Permission type	Usage
`Directory.Read.All` `Directory.ReadWrite.All` `Policy.ReadWrite.SecurityDefaults`, `DeviceManagementServiceConfig.Read.All DeviceManagementServiceConfig.ReadWrite.All` `Organization.ReadWrite.All`	Application	To backup and update tenant settings, getting company branding, organization information

Administrative Unit

API permissions	Permission type	Usage
`AdministrativeUnit.ReadWrite.All` `AdministrativeUnit.Read.All`	Application	To backup and restore administrative units and manage membership (users/groups/devices) inside them.

Conditional Access policy

API permissions	Permission type	Usage
`Policy.ReadWrite.ConditionalAccess` `Policy.Read.ConditionalAccess`	Application	To backup and restore conditional access policies

Audit Logs

API permissions	Permission type	Usage
`AuditLog.Read.All`	Application	To back up audit log data

Privileged Identity Management (PIM)

API permissions	Permission type	Usage
`RoleManagementPolicy.ReadWrite.Directory RoleManagementPolicy.Read.Directory`	Application	To back up and restore PIM settings and role assignment policies

Related Articles