Microsoft Entra ID
StandardsEnable Scim Api
In brief
The permissions table now lists granular options for reading, creating, and updating users, plus creating groups and managing group memberships. Existing permission descriptions were also clarified.
What Entra admins need to know
Administrators configuring SCIM can align app consent more closely with the specific user and group operations required.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Permission | Description |
|---|---|
| [`User.ReadBasic.All`](/graph/permissions-reference#userreadbasicall) | Least privileged read-only access to users' basic profile properties. Filtering is limited to properties in the basic profile. | | `User.Read.AllAll` | Read-only access to all user properties supported by the SCIM API. | | [`User.Create`](/graph/permissions-reference#usercreate) | Create users without permission to update existing users. | | [`User.ReadUpdate.All`](/graph/permissions-reference#userreadupdateall) | Read and update users without permission to create or delete users. | |
User.ReadWrite.All| Read and write access to users. | | User-Mail.ReadWrite.All| Least privileged permission to update emails[type eq "other"].value that, which maps to the otherMails userpropertyproperty. | | User-Phone.ReadWrite.All| Least privileged permission to update phoneNumbers[type eq "mobile"].value and phoneNumbers[type eq "work"].value that, which map to the mobilePhone and businessPhones userproperties respectivelyproperties, respectively. | | User.EnableDisableAccount.All| Least privileged permission to update the active SCIM attribute thatattribute, which maps to the accountEnabled userpropertyproperty. | | Group.Read.All| Read-only access to groups. | | Group.Create| Create groups without permission to update existing groups. | |GroupMember.ReadWrite.All| Read and update group memberships without permission to update group properties. | |Group.ReadWrite.All| Read and write access to groups. | | CustomSecAttributeAssignment.Read.All| Read-only access to Custom Security Attributes on users. | | | CustomSecAttributeAssignment.ReadWrite.All| Read and write access to Custom Security Attributes on users.
@@ -5,7 +5,7 @@ manager: pmwongera ms.service: entra-id ms.subservice: app-provisioning ms.topic: how-to-ms.date: 03/31/2026+ms.date: 09/04/2026 ms.reviewer: chmutali ai-usage: ai-assisted @@ -76,12 +76,17 @@ Register an application in your Microsoft Entra tenant, grant the required appli | Permission | Description | |---|---|- | `User.Read.All` | Read-only access to users. |+ | [`User.ReadBasic.All`](/graph/permissions-reference#userreadbasicall) | Least privileged read-only access to users' basic profile properties. Filtering is limited to properties in the basic profile. |+ | `User.Read.All` | Read-only access to all user properties supported by the SCIM API. |+ | [`User.Create`](/graph/permissions-reference#usercreate) | Create users without permission to update existing users. |+ | [`User.ReadUpdate.All`](/graph/permissions-reference#userreadupdateall) | Read and update users without permission to create or delete users. | | `User.ReadWrite.All` | Read and write access to users. |- | `User-Mail.ReadWrite.All` | Least privileged permission to update **emails[type eq "other"].value** that maps to *otherMails* user property |- | `User-Phone.ReadWrite.All` | Least privileged permission to update **phoneNumbers[type eq "mobile"].value** and **phoneNumbers[type eq "work"].value** that map to *mobilePhone* and *businessPhones* user properties respectively |- | `User.EnableDisableAccount.All` | Least privileged permission to update **active** SCIM attribute that maps to *accountEnabled* user property |+ | `User-Mail.ReadWrite.All` | Least privileged permission to update **emails[type eq "other"].value**, which maps to the *otherMails* user property. |+ | `User-Phone.ReadWrite.All` | Least privileged permission to update **phoneNumbers[type eq "mobile"].value** and **phoneNumbers[type eq "work"].value**, which map to the *mobilePhone* and *businessPhones* user properties, respectively. |+ | `User.EnableDisableAccount.All` | Least privileged permission to update the **active** SCIM attribute, which maps to the *accountEnabled* user property. | | `Group.Read.All` | Read-only access to groups. |+ | [`Group.Create`](/graph/permissions-reference#groupcreate) | Create groups without permission to update existing groups. |+ | [`GroupMember.ReadWrite.All`](/graph/permissions-reference#groupmemberreadwriteall) | Read and update group memberships without permission to update group properties. | | `Group.ReadWrite.All` | Read and write access to groups. | | `CustomSecAttributeAssignment.Read.All` | Read-only access to Custom Security Attributes on users. | | `CustomSecAttributeAssignment.ReadWrite.All` | Read and write access to Custom Security Attributes on users. |