TenRise

Permissions & consent

For IT administrators. Someone in your organisation — or a partner who manages your tenant — wants to use TenRise to activate their PIM roles. This page explains what TenRise is allowed to do once you approve it, and how to approve or withdraw that.

What you're approving

  • One app, published by Cloudtrees. TenRise appears in your tenant as an enterprise application named TenRise. There's nothing to register on your side.
  • Delegated permissions only. TenRise always acts as the signed-in user and can never do more than that user already can. It has no application permissions and no access when nobody is signed in.
  • Your PIM policies still apply. TenRise activates assignments the user is already eligible for, through Microsoft's official PIM APIs. Duration limits, required reasons and tickets, MFA and approvals are enforced by Entra, not by TenRise.
  • No TenRise server. Sign-in tokens stay inside the browser extension on the user's own device. There is no back end that receives them.
  • Never requested: RoleManagement.ReadWrite.Directory and Directory.AccessAsUser.All.

Permissions in a customer tenant

Requested when a user signs in with their own account in your tenant. Admin consent is needed once.

PermissionUsed for
openid, profile, offline_access, User.ReadSigning the user in, keeping them signed in for the session, and checking it's the account they meant.
PrivilegedEligibilitySchedule.Read.AzureADGroupListing the PIM-enabled groups the user is eligible for.
PrivilegedAssignmentSchedule.ReadWrite.AzureADGroupActivating and deactivating the user's own eligible group membership.
RoleManagementPolicy.Read.AzureADGroupReading the group's PIM policy (maximum duration, reason, ticket, approval).
RoleEligibilitySchedule.Read.DirectoryListing the Microsoft Entra roles the user is eligible for.
RoleAssignmentSchedule.ReadWrite.DirectoryActivating and deactivating the user's own eligible Entra role.
RoleManagementPolicy.Read.DirectoryReading the Entra role's PIM policy.
Organization.Read.AllShowing your organisation's name and initial domain, so the user can tell customers apart and open the right SharePoint admin center.
Azure Service Management user_impersonationListing, activating and deactivating the user's eligible Azure resource roles.

If you only manage your tenant through a partner's GDAP relationship, nothing needs to be approved in your tenant: GDAP access is activated in the partner's own tenant.

Permissions in a partner tenant (CSP)

Requested when a partner connects their own account in their partner tenant (Partner plan). Admin consent is needed once, in the partner tenant.

PermissionUsed for
The group permissions aboveListing and activating the partner's own eligible PIM groups — GDAP and Lighthouse access groups live in the partner tenant.
DelegatedAdminRelationship.Read.AllFinding the customers the partner has GDAP relationships with, and which groups map to which customer.
Directory.Read.AllReading the partner's customer contracts to show each GDAP customer's name and domain. This is the least-privileged permission Microsoft offers for that call; it's only requested in the partner tenant, never in a customer's.
Azure Service Management user_impersonationFinding Azure Lighthouse delegations and the roles they grant.

How to grant consent

The easiest way: when a user hits Admin consent needed, TenRise shows a link. They can send it to you.

  1. Open the link and sign in with an account that can grant admin consent, for example a Cloud Application Administrator or Global Administrator.
  2. Review the permissions. They match the tables above.
  3. Click Accept. The user can now sign in to TenRise.

When TenRise asks for an additional permission in a later version, the user sees Admin consent needed again and you approve only the new permission the same way. The release notes will say why it's needed.

How to withdraw consent

  1. Open the Microsoft Entra admin center and go to Enterprise applications.
  2. Find TenRise.
  3. To block it: under Properties, set Enabled for users to sign-in? to No. To remove it completely: Delete.

Active PIM activations aren't affected by this; they run until they expire or are deactivated.

Questions