Microsoft Entra sync permissions
What each permission on Microsoft's consent screen allows, what Hook actually reads from your tenant, and what it never touches, including groups you don't select.
Microsoft writes the text on its consent screen, and it's the same for every app that asks for these permissions. That text describes the most a permission could allow. It doesn't describe what Hook does with it. This page covers what Hook reads from your tenant, when it reads it, and what it never reads.
To set up the connection itself, see Sync users from Microsoft Entra.
The short version
- Hook only reads. It never creates, changes, or deletes anything in your tenant.
- To fill the group picker, Hook reads the list of groups in your tenant: each group's name, description, email address, and type. It doesn't read who is in them.
- Hook reads members only for the groups you select. For those people it reads name, email address, sign-in name, job title, department, and manager.
- Hook never reads email, group conversations, files, calendars, Teams chats, passwords, or sign-in activity.
What each permission is for
The consent screen lists five permissions. Here is what Hook uses each one for.
| On the consent screen | What Hook does with it | What Hook reads |
|---|---|---|
| Sign in and read user profile | Lets the admin granting consent sign in to Microsoft to approve the request. | Nothing. When you approve, Microsoft only tells Hook your tenant ID and that consent was granted. |
| Read all groups | Lists your groups in the picker. On each sync, reads the current name of each group you selected. | Group name, description, email address, type, and visibility setting. |
| Read all group memberships | Reads who is in each group you selected. | Each member's name, email address, sign-in name, and Entra object ID. |
| Read organization information | Shows your tenant's name in Hook and finds your verified domains so domain review can list them first. | Your tenant's name, ID, and verified domains. |
| Read all users' full profiles | Reads work details for people in the groups you selected. | Job title, department, and the manager's email address or sign-in name. |
Every permission is read-only. Hook doesn't request any permission that can write to your directory.
What Hook can't access
These permissions don't cover any of the following, so Hook has no way to reach them:
- Mailboxes and email content
- OneDrive and SharePoint files
- Teams chats and channel messages
- Calendars
- Passwords, authentication methods, and sign-in logs
- Members of groups set to hidden membership. Microsoft requires an extra permission for those, which Hook doesn't request, so those groups don't appear in the picker.
Hook also can't change anything in Entra. It can't create or delete users, reset passwords, or add people to groups or remove them.
What Hook doesn't access, even though it could
Microsoft grants these permissions across the whole tenant. It doesn't offer a version limited to specific groups, so the consent screen says "all groups" and "all users". Hook limits its own reads.
Does Hook read the groups I don't select?
Only their names and descriptions, and only while the group picker is open. Hook reads the list one page at a time as you browse or search, so it can show you what's available. That list isn't saved anywhere. Hook doesn't read who is in an unselected group, how many people it has, or anything about those people.
When does Hook read a group's members?
Only after you tick that group. When you click Continue to preview, Hook reads the members of the groups you ticked so you can check them before saving. After you save, the nightly sync and Sync now read the members of your saved groups and no others.
If you untick a group and save, Hook stops reading it. People who are no longer in any selected group are deactivated in Hook.
Does Hook read group conversations?
No. Microsoft's description of Read all groups includes group conversations, but Hook doesn't request them. It reads group names and details, nothing posted in a group.
Does Hook read everyone's full profile?
No. Read all users' full profiles covers every field on every user, but Hook asks for three: job title, department, and manager. It asks for them only for members of the groups you selected. Hook doesn't read phone numbers, office locations, photos, or any other profile field.
Does Hook read our licenses or branding?
No. Microsoft's description of Read organization information mentions subscribed SKUs and tenant branding. Hook reads your tenant's name, ID, and verified domains only.
Do these permissions let Hook send phishing simulations into our mailboxes?
No. Microsoft direct delivery is a separate Hook app with its own consent prompt. You approve it separately, and only if you choose that delivery method. Directory sync can't reach mailboxes.
How do we revoke Hook's access?
Disconnecting in Hook stops syncing, but your consent stays in place in Microsoft. To remove Hook's access entirely, go to Enterprise applications in the Microsoft Entra admin center, find Hook's directory sync app, and delete it or remove its permissions. Hook then can't read anything from your tenant. See Disconnect a directory.