Guides
  1. Integrations
  2. Azure Integration
  3. Azure Permission Scopes

Granting Permissions for PIM, Entitlement Management, Intune Compliance, and Backup Collectors

Use your same Entra app registration to grant additional permissions.

🚧

Prerequisites

To complete this configuration, ensure you have an administrator who holds the following roles:

  • Microsoft Graph Admin Consent: Global Administrator or Privileged Role Administrator.
  • Azure RBAC Assignment: Owner or User Access Administrator on the target Azure subscriptions.

Required Permissions Overview

All Microsoft Graph permissions must be granted as Application permissions (not Delegated), as Compyl authenticates via service credentials without an active user session.


Microsoft Graph Permissions (Entra App Registration)

PermissionTypePurpose
RoleManagement.Read.DirectoryApplicationPIM eligible and active role assignments
EntitlementManagement.Read.AllApplicationAccess packages and access package assignments
DeviceManagementConfiguration.Read.AllApplicationIntune compliance policies and device status

Azure Resource Manager Permissions (Subscription IAM)

Compyl requests the standard ARM scope https://management.azure.com/.default). Ensure data-plane read permissions are available for backup items:

Azure ActionPurpose
Microsoft.RecoveryServices/vaults/backupProtectedItems/readRecovery Services protected items
Microsoft.DataProtection/backupVaults/backupInstances/readData Protection backup instances

Both actions are included in standard subscription Reader or Backup Reader roles.


Add Microsoft Graph Permissions

  1. Navigate to the Azure Portal → Microsoft Entra ID.


  1. Expand Manage and select App registrations. Then click on the app registration corresponding to your Compyl integration (verify using the Application / Client ID).


  1. Go to API permissions → Add a permission.

  2. Select the Microsoft Graph API.


  1. Choose Application permissions (do not select Delegated permissions) and search for and select the following permissions:

    • RoleManagement.Read.Directory

    • EntitlementManagement.Read.All

    • DeviceManagementConfiguration.Read.All

  2. Click Add permissions.

  3. Click Grant admin consent.

  4. Verify that each permission displays a green status indicator showing Granted for YourBusinessName.


Upon completion, the configured API permissions should include the below:

API / Permission NameTypeStatus
RoleManagement.Read.DirectoryApplicationGranted for YourBusinessName
EntitlementManagement.Read.AllApplicationGranted for YourBusinessName
DeviceManagementConfiguration.Read.AllApplicationGranted for YourBusinessName
📘

Note

If any permission lists as Delegated, remove it and re-add it as Application. If consent status is missing, re-click Grant admin consent. Adding permissions without granting admin consent will prevent Compyl from acquiring these roles via its client token.


Confirm Azure RBAC for Backup Collectors

  1. Navigate to your Azure Portal and click on Subscriptions.

  2. Open each subscription integrated with Compyl.

  3. Go to Access control (IAM) → Role assignments. Then locate the service principal / enterprise application associated with your Compyl app.

  4. Confirm that either the Reader or Backup Reader role is assigned at the subscription level (or on targeted Recovery Services/Data Protection vaults).

  5. If assignment is missing: Click Add → Add role assignment → Select Reader (or Backup Reader) → Assign to the Compyl service principal → Review + assign.


📘

Note

No Graph permissions are required for ARM. This step ensures read authorization for protected items and backup instances across synced subscriptions.


Re-validate Integration in Compyl

Newly added collectors must be validated in the Compyl integration catalog:

  1. In Compyl, open your Azure integration and navigate to Endpoints. Make sure the new endpoints are selected and then click Validate.

  2. Confirm successful validation for the following endpoints (enable them if using a selected endpoint scope):

    • PIM Eligible Role Assignments
    • PIM Active Role Assignments
    • Access Packages
    • Access Package Assignments
    • Intune Compliance Policies
    • Intune Compliance Policy Device Statuses
    • Recovery Services Protected Items
    • Data Protection Backup Instances

  3. Save changes. The new tables will populate on the next scheduled sync.


📘

Note

Configurations set to explicit endpoint selection require manual enabling of new endpoints post-validation. Full catalog configurations automatically pick up new collectors on sync.

Updated about 1 month ago

Did this page help you?