Profile pictures and group-owner synchronization for department managers still require Microsoft Graph. SCIM only covers the profile manager used for the Sync approver with Microsoft Manager option.
Benefits of granting user synchronization permissions
Granting the User.Read.All permission to the absentify - Users Permission app provides multiple key benefits for your organization:- Automated manager-approver assignments: Managers defined in Microsoft are automatically synchronized as absence approvers in absentify, streamlining your approval workflows.
- Up-to-date profile information: Changes to user profiles in Microsoft, such as first name, last name, email, and profile picture, are automatically synchronized in absentify, ensuring consistent and current information across systems.
- Improved efficiency and performance: absentify stores profile information directly in its database. This ensures high application performance, avoids Microsoft Graph API throttling limits, and provides a smooth user experience.
Default functionality without permissions
If the User.Read.All permission is not granted, Microsoft Graph manager and profile synchronization are unavailable. As a result, the following limitations apply — unless profile managers are provisioned through SCIM:- Manual manager updates: HR teams must manually assign and update approvers within absentify, increasing workload and the risk of outdated information.
- Sign-in-based profile synchronization: User profiles are only updated in absentify when users sign out and sign back in. To avoid Microsoft Graph API throttling, profile updates are limited to one synchronization per user per hour.
How absentify uses the User.Read.All permission
To ensure transparency and build trust, here’s how absentify uses the User.Read.All permission in the absentify - Users Permission app:- Manager synchronization: This permission is used to pull manager information from Microsoft and assign managers as absence approvers in absentify.
- Profile synchronization: Changes in users’ first name, last name, email, and profile picture are automatically synchronized and stored in absentify’s database. This storage ensures that absentify functions with optimal performance while reducing reliance on frequent API requests.
- Secure storage: All profile data is stored GDPR-compliantly in our secure database hosted in Azure North Europe. No developers or members of other departments have access to the production database or stored data, which is limited exclusively to authorized personnel at absentify GmbH. Database access is restricted to the Azure environment with no external copies or unauthorized access.
Security and data protection
We prioritize security and data privacy, following rigorous standards to protect your organization’s information:- ISO 27001 certification: absentify is ISO 27001 certified, demonstrating compliance with international standards for information security management.
- Microsoft 365 App Certification: The absentify - Users Permission app has achieved Microsoft 365 App Certification, confirming compliance with Microsoft’s security, privacy, and compliance standards. This certification assures that absentify adheres to best practices for data handling and security.
- Secure key management: Access secrets required for synchronization are securely stored in an Azure Key Vault, restricted to authorized personnel at absentify GmbH. No unauthorized access is permitted, and access to all sensitive data is strictly limited to necessary personnel only.
Enabling manager and profile synchronization
Microsoft Graph: To activate automatic synchronization of managers as approvers and profile information updates, follow these steps:- Grant permissions: Start by granting the required permissions through the Microsoft 365 admin portal. Use the following link to initiate the consent process: Grant Permissions
- Activate synchronization in absentify: Go to Settings > Users in absentify and enable the manager and profile synchronization options to ensure alignment with Microsoft’s manager assignments and user profile information.
manager attribute as described in the SCIM provisioning guide. You do not need to grant User.Read.All for manager-based approvers.
Changing a user’s manager in Microsoft
To update a user’s manager directly in Microsoft:- Sign in to the Microsoft Admin Portal.
- Go to Users > Active users.
- Select the user, then select Edit manager or Add manager.
Revoking permissions
If you need to revoke the User.Read.All permission for the absentify - Users Permission app, follow these steps:- Access Azure Active Directory: Sign in to the Azure portal with your Microsoft 365 administrator account.
- Navigate to Enterprise applications: In the left-hand menu, go to Azure Active Directory > Enterprise applications.
- Find and select absentify - Users Permission: Locate the absentify - Users Permission app (App ID: b163cce9-74dc-48b3-a04f-7a35ea72c451) in your list of applications.
- Manage permissions: Go to the Permissions section and select User.Read.All to revoke absentify’s Microsoft Graph access to manager and profile information.