Microsoft Entra ID User and Group Sync permissions in PaperCut Hive and Pocket

THE PAGE APPLIES TO:

Last updated September 10, 2026

This page describes the permissions that PaperCut Hive and Pocket require from the Microsoft Graph API to synchronize users and groups from Microsoft Entra ID.

For User and Group Sync, when connecting Microsoft Entra ID to PaperCut Hive or Pocket, PaperCut requests a set of Microsoft Graph permissions. After Microsoft Graph grants consent, Hive or Pocket can discover the users and groups, and you can choose which ones to synchronize and keep up to date.

PaperCut follows the principle of collecting and storing only the information required to provide the synchronization service. Below is an explanation of each permission and how it is used.

Microsoft Graph permissions

Permission	Why it is required
User.Read.All	Required to discover and synchronize user accounts. PaperCut retrieves only the user attributes configured in the attribute mapping, together with the Microsoft Entra Object ID required to track users across synchronizations.
Group.Read.All	Required to discover available groups, allow administrators to select which groups to synchronize, and retrieve group membership for synchronized users.
AdministrativeUnit.Read.All	Required to allow administrators to browse and select Administrative Units during a sync configuration. PaperCut Hive and Pocket request the permission, regardless of whether Administrative Units are configured, because PaperCut cannot determine this before consent is granted. If a tenant does not use Administrative Units, the permission is not actively used after consent.
User.Read (Delegated)	Used only during the Microsoft OAuth consent flow when connecting additional PaperCut Hive organizations to the same Microsoft Entra tenant. After the connection has been established, it is not used during ongoing synchronization.
AuditLog.Read.All	AuditLog.Read.All is not used by the User and Group Sync feature. It was originally included to support potential future operational enhancements. We are reviewing whether this permission can be removed from the required permission set in a future update if it is not needed.

What data is retrieved and stored during a sync?

PaperCut Hive and Pocket only store the information required to perform the synchronization.

For synchronized users, this includes:

the user attributes configured in the attribute mapping (for example, display name, email address, or username)
Microsoft Entra Object ID
Group membership
Group IDs.

Hive and Pocket do not cache or retain additional directory information beyond what is required for synchronization. No additional directory data unrelated to the synchronization process is stored.

What is the scope of directory access?

When administrators configure the User and Group Sync source in PaperCut Hive or Pocket, they select the users, groups, and Administrative Units (where applicable) that need to be synchronized from Microsoft Entra ID.

After the synchronization source has been configured, PaperCut Hive and Pocket:

only sync the users and groups selected for synchronization
continue to use the granted permissions to read Microsoft Entra ID during scheduled or manual synchronizations, to detect changes to those synchronized objects
do not import or persist unrelated directory objects simply because they are visible through Microsoft Graph.

What authentication model is used for syncing users and groups?

After the administrator authorizes (grants consent) to the requested permissions, PaperCut Hive and Pocket authenticate to Microsoft Graph using Microsoft Entra Workload Identity Federation.

Synchronization does not continue using the delegated identity of the administrator who authorized the connection. Instead, it uses a workload identity that operates independently of the administrator’s user account.

Microsoft provides further information on Workload Identity Federation in Workload identity federation concepts.

Can you reduce the number of permissions used for syncing users and groups (least privilege)?

User and Group Sync implementation requires the permissions listed above to support discovery, configuration, and ongoing synchronization.

A reduced Microsoft Graph permission set is not supported because it would impact functionality. For example:

removing User.Read.All prevents user discovery and synchronization
removing Group.Read.All prevents group discovery and membership synchronization
removing AdministrativeUnit.Read.All prevents Administrative Units from being available for selection where customers choose to use them.

PaperCut continuously reviews its permission requirements as the products evolve, and will reduce requested permissions where possible without impacting functionality.

Future support for customer-managed applications

The previous Microsoft Entra User Sync add-on allowed customers to register and manage their own Microsoft Entra ID application. The new User and Group Sync capability currently uses the PaperCut-managed application and does not yet support customer-managed app registrations.

We recognize that some organizations require more restrictive integration models to satisfy internal security policies or the principle of least privilege. We are actively evaluating additional integration approaches to support these scenarios in the future.

Syncing users from Microsoft Entra ID