Configure permission classifications

In this article you'll learn how to configure permissions classifications in Azure Active Directory (Azure AD). Permission classifications allow you to identify the impact that different permissions have according to your organization's policies and risk evaluations. For example, you can use permission classifications in consent policies to identify the set of permissions that users are allowed to consent to.

Currently, only the "Low impact" permission classification is supported. Only delegated permissions that don't require admin consent can be classified as "Low impact".

The minimum permissions needed to do basic sign in are openid, profile, email, and offline_access, which are all delegated permissions on the Microsoft Graph. With these permissions an app can read details of the signed-in user's profile, and can maintain this access even when the user is no longer using the app.

Prerequisites

To configure permission classifications, you need:

• An Azure account with an active subscription. Create an account for free.
• One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.

Manage permission classifications

Portal

Follow these steps to classify permissions using the Azure portal:

1. Sign in to the Azure portal as a Global Administrator, Application Administrator, or Cloud Application Administrator
2. Select Azure Active Directory > Enterprise applications > Consent and permissions > Permission classifications.
3. Choose Add permissions to classify another permission as "Low impact".
4. Select the API and then select the delegated permission(s).

In this example, we've classified the minimum set of permission required for single sign-on:

PowerShell

You can use the latest Azure AD PowerShell Preview module, AzureADPreview, to classify permissions. Permission classifications are configured on the ServicePrincipal object of the API that publishes the permissions.

List the current permission classifications for an API

1. Retrieve the ServicePrincipal object for the API. Here we retrieve the ServicePrincipal object for the Microsoft Graph API:

   $api = Get-AzureADServicePrincipal `
       -Filter "servicePrincipalNames/any(n:n eq 'https://graph.microsoft.com')"
   

2. Read the delegated permission classifications for the API:

   Get-AzureADMSServicePrincipalDelegatedPermissionClassification `
       -ServicePrincipalId $api.ObjectId | Format-Table Id, PermissionName, Classification
   

Classify a permission as "Low impact"

1. Retrieve the ServicePrincipal object for the API. Here we retrieve the ServicePrincipal object for the Microsoft Graph API:

   $api = Get-AzureADServicePrincipal `
       -Filter "servicePrincipalNames/any(n:n eq 'https://graph.microsoft.com')"
   

2. Find the delegated permission you would like to classify:

   $delegatedPermission = $api.OAuth2Permissions | Where-Object { $_.Value -eq "User.ReadBasic.All" }
   

3. Set the permission classification using the permission name and ID:

   Add-AzureADMSServicePrincipalDelegatedPermissionClassification `
      -ServicePrincipalId $api.ObjectId `
      -PermissionId $delegatedPermission.Id `
      -PermissionName $delegatedPermission.Value `
      -Classification "low"
   

Remove a delegated permission classification

1. Retrieve the ServicePrincipal object for the API. Here we retrieve the ServicePrincipal object for the Microsoft Graph API:

   $api = Get-AzureADServicePrincipal `
       -Filter "servicePrincipalNames/any(n:n eq 'https://graph.microsoft.com')"
   

2. Find the delegated permission classification you wish to remove:

   $classifications = Get-AzureADMSServicePrincipalDelegatedPermissionClassification `
       -ServicePrincipalId $api.ObjectId
   $classificationToRemove = $classifications | Where-Object {$_.PermissionName -eq "User.ReadBasic.All"}
   

3. Delete the permission classification:

   Remove-AzureADMSServicePrincipalDelegatedPermissionClassification `
       -ServicePrincipalId $api.ObjectId `
       -Id $classificationToRemove.Id
   

Next steps

To learn more:

• Go to Permissions and consent in the Microsoft identity platform