Jamf's enterprise SSO integration only uses read-only scopes, with no ability to write back to Entra. The data requested is minimized to what is absolutely necessary for the service to operate properly.
The following table lists the Entra permissions required by Jamf Security Cloud:
| Name | Entra Permission ID | Requires Admin Consent | Description |
|---|---|---|---|
Sign users in | openid | No | Required so that the authentication mechanism will work with Entra. Note: This is a default configuration for the Entra ID platform when using Open ID Connect (OIDC). |
Sign in and read user profile | User.Read | No | Authorizes Jamf Security Cloud to make calls from our infrastructure to Microsoft Graph to pull the basic end-user information required to populate user metadata when creating and updating device records in Jamf Security Cloud. It also validates that the user belongs to the company organization that is linked to WPA, or is otherwise an authorized contractor. This permission provides the information required to import user information into Jamf Security Cloud. |
Maintain access to data you have given it access to | offline_access | No | Required for modern authentication to work via the OIDC standard. At activation time, Entra issues the client an access and a refresh token. The access token issued by Entra expires after an admin-defined period of time, while the refresh token is used by Jamf Trust to request a new access token from Entra when this happens. If the user has been removed from Entra, or is no longer allowed to use WPA as per the Entra Conditional Access policy, the request for a new access token will fail, and the device will be unable to connect to WPA infrastructure until the issue is resolved. Note: This is a default configuration for the Entra ID platform when using OIDC. |
Read group memberships | GroupMember.Read.All | Yes | Allows Jamf Security Cloud to query the groups of which a given user is a member. This permission does not allow Jamf Security Cloud to enumerate all of the organization's groups, nor to alter groups or their members in any way. Note: Admin consent is required for this specific permission. |