Which permissions does ModernSync need?

A global admin approves the app once on Microsoft’s own consent page, which lists every permission before you accept.

The four permissions

• User.Read.All: reads users’ names, titles, phone numbers and status, so the contacts are correct and people who have left are removed.
• GroupMember.Read.All: reads who is in the groups you choose in your rules.
• Contacts.ReadWrite: writes the contacts into the recipients’ mailboxes and reads a shared contact folder if you use one as a source. The Microsoft permission covers all mailboxes in the organisation. ModernSync writes only to the mailboxes of the recipient group, and only to its own contacts.
• OrgContact.Read.All: reads external contacts: people outside the organisation who have been created as contacts in Microsoft 365 and are listed in your shared address book. They are only used in rules where you turn on Include external contacts that are members of the group. The permission is optional: without it, colleagues are still updated.

What the app cannot do

The contacts app cannot read email, calendars or files. The contacts app gives its own contacts a hidden tag and only edits contacts with that tag. Contacts your employees made themselves don’t have it.

The calendar add-on is a separate app

If you turn on calendar sync, a second app, ModernSync Calendar, asks for its own approval. The calendar app needs Calendars.ReadWrite to read the calendar of the shared mailbox you choose and to write the shared calendars, plus User.Read.All and GroupMember.Read.All. It creates its own calendars in each mailbox and writes only to those. The contacts app does not have the calendar permission.

Signing in to the portal

Administrators sign in with their own Microsoft account, so your own security rules apply, such as multi-factor authentication.

Removing access

Remove the app under Enterprise applications in Microsoft Entra ID. Microsoft then stops issuing access tokens to the app, but a run that is already in progress can continue for up to an hour. So cancel in the portal first, and wait for the run to finish before you delete the app. In an incident, first disable the app’s service principal (accountEnabled = false) and then wait an hour.

Stricter scoping

If your policy requires the contacts permission to be limited to certain mailboxes, write to us. It needs a separate set-up in Exchange Online.