Synchronization.ReadWrite.All

Allows the app to configure the Azure AD synchronization service, on behalf of the signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the Synchronization.ReadWrite.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	9b50c33d-700f-43b1-b2eb-87e89b703581	7bb27fa3-ea8f-4d67-a916-87715b6188bd
DisplayText	Read and write all Azure AD synchronization data.	Read and write all Azure AD synchronization data
Description	Allows the application to configure the Azure AD synchronization service, without a signed-in user.	Allows the app to configure the Azure AD synchronization service, on behalf of the signed-in user.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /applications/{id}/synchronization/templates/{templateId}/schema
	DELETE /servicePrincipals/{id}/synchronization/jobs/{jobId}/
	DELETE /servicePrincipals/{id}/synchronization/jobs/{jobId}/schema
	GET /applications/{id}/synchronization/templates/{templateId}/schema
	GET /applications/{id}/synchronization/templates/{templateId}/schema/filterOperators
	GET /applications/{id}/synchronization/templates/{templateId}/schema/functions
	GET /servicePrincipals/{id}/synchronization/jobs/
	GET /servicePrincipals/{id}/synchronization/jobs/{jobId}/
	GET /servicePrincipals/{id}/synchronization/jobs/{jobId}/schema
	GET /servicePrincipals/{id}/synchronization/jobs/{jobId}/schema/filterOperators
	GET /servicePrincipals/{id}/synchronization/jobs/{jobId}/schema/functions
	GET /servicePrincipals/{id}/synchronization/templates/{templateId}/schema
	GET /servicePrincipals/{id}/synchronization/templates/{templateId}/schema/filterOperators
	GET /servicePrincipals/{id}/synchronization/templates/{templateId}/schema/functions
	GET applications/{id}/synchronization/templates
	GET applications/{id}/synchronization/templates/{templateId}
	GET servicePrincipals/{id}/synchronization/templates
	GET servicePrincipals/{id}/synchronization/templates/{templateId}
	PATCH applications/{id}/synchronization/templates/{templateId}
	POST /applications/{applicationsId}/synchronization/acquireAccessToken
	POST /servicePrincipals(appId='{appId}')/synchronization/jobs/{jobId}/restart
	POST /servicePrincipals/{id}/synchronization/jobs/
	POST /servicePrincipals/{id}/synchronization/jobs/{id}/schema/parseExpression
	POST /servicePrincipals/{id}/synchronization/jobs/{id}/validateCredentials
	POST /servicePrincipals/{id}/synchronization/jobs/{jobId}/pause
	POST /servicePrincipals/{id}/synchronization/jobs/{jobId}/start
	POST /servicePrincipals/{id}/synchronization/templates/{id}/schema/parseExpression
	POST /servicePrincipals/{servicePrincipalId}/synchronization/jobs/{jobId}/restart
	POST /servicePrincipals/{servicePrincipalsId}/synchronization/acquireAccessToken
	POST /servicePrincipals/{servicePrincipalsId}/synchronization/jobs/{synchronizationJobId}/provisionOnDemand
	PUT /applications/{id}/synchronization/templates/{templateId}/schema
	PUT /servicePrincipals/{id}/synchronization/jobs/{jobId}/schema
	PUT /servicePrincipals/{id}/synchronization/secrets

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /applications/{id}/synchronization/templates/{templateId}/schema
	DELETE /servicePrincipals/{id}/synchronization/jobs/{jobId}/
	DELETE /servicePrincipals/{id}/synchronization/jobs/{jobId}/schema
	GET /applications/{id}/synchronization/templates
	GET /applications/{id}/synchronization/templates/{templateId}
	GET /applications/{id}/synchronization/templates/{templateId}/schema
	GET /applications/{id}/synchronization/templates/{templateId}/schema/filterOperators
	GET /applications/{id}/synchronization/templates/{templateId}/schema/functions
	GET /servicePrincipals/{id}/synchronization/jobs/
	GET /servicePrincipals/{id}/synchronization/jobs/{jobId}/
	GET /servicePrincipals/{id}/synchronization/jobs/{jobId}/schema
	GET /servicePrincipals/{id}/synchronization/jobs/{jobId}/schema/filterOperators
	GET /servicePrincipals/{id}/synchronization/jobs/{jobId}/schema/functions
	GET /servicePrincipals/{id}/synchronization/templates
	GET /servicePrincipals/{id}/synchronization/templates/{templateId}
	GET /servicePrincipals/{id}/synchronization/templates/{templateId}/schema
	GET /servicePrincipals/{id}/synchronization/templates/{templateId}/schema/filterOperators
	GET /servicePrincipals/{id}/synchronization/templates/{templateId}/schema/functions
	PATCH /applications/{id}/synchronization/templates/{templateId}
	POST /applications/{applicationsId}/synchronization/acquireAccessToken
	POST /servicePrincipals(appId='{appId}')/synchronization/jobs/{jobId}/restart
	POST /servicePrincipals/{id}/synchronization/jobs/
	POST /servicePrincipals/{id}/synchronization/jobs/{id}/schema/parseExpression
	POST /servicePrincipals/{id}/synchronization/jobs/{id}/validateCredentials
	POST /servicePrincipals/{id}/synchronization/jobs/{jobId}/pause
	POST /servicePrincipals/{id}/synchronization/jobs/{jobId}/start
	POST /servicePrincipals/{id}/synchronization/templates/{id}/schema/parseExpression
	POST /servicePrincipals/{servicePrincipalId}/synchronization/jobs/{jobId}/restart
	POST /servicePrincipals/{servicePrincipalsId}/synchronization/acquireAccessToken
	POST /servicePrincipals/{servicePrincipalsId}/synchronization/jobs/{synchronizationJobId}/provisionOnDemand
	PUT /applications/{id}/synchronization/templates/{templateId}/schema
	PUT /servicePrincipals/{id}/synchronization/jobs/{jobId}/schema
	PUT /servicePrincipals/{id}/synchronization/secrets

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgApplicationSynchronizationAccessToken
	Get-MgApplicationSynchronizationTemplate
	Get-MgServicePrincipalSynchronizationJob
	Get-MgServicePrincipalSynchronizationJobSchema
	Get-MgServicePrincipalSynchronizationTemplate
	Invoke-MgFilterServicePrincipalSynchronizationJobSchemaOperator
	Invoke-MgFunctionServicePrincipalSynchronizationJobSchema
	Invoke-MgParseApplicationSynchronizationJobSchemaExpression
	Invoke-MgParseApplicationSynchronizationTemplateSchemaExpression
	Invoke-MgParseServicePrincipalSynchronizationJobSchemaExpression
	Invoke-MgParseServicePrincipalSynchronizationTemplateSchemaExpression
	New-MgServicePrincipalSynchronizationJob
	New-MgServicePrincipalSynchronizationJobOnDemand
	Remove-MgApplicationSynchronizationTemplateSchema
	Remove-MgServicePrincipalSynchronizationJob
	Remove-MgServicePrincipalSynchronizationJobSchema
	Restart-MgServicePrincipalSynchronizationJob
	Set-MgServicePrincipalSynchronizationSecret
	Start-MgServicePrincipalSynchronizationJob
	Suspend-MgServicePrincipalSynchronizationJob
	Test-MgApplicationSynchronizationJobCredential
	Test-MgServicePrincipalSynchronizationJobCredential
	Update-MgApplicationSynchronizationTemplate
	Update-MgServicePrincipalSynchronizationJobSchema

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaApplicationSynchronizationAccessToken
	Get-MgBetaApplicationSynchronizationTemplate
	Get-MgBetaServicePrincipalSynchronizationJob
	Get-MgBetaServicePrincipalSynchronizationJobSchema
	Get-MgBetaServicePrincipalSynchronizationTemplate
	Invoke-MgBetaFilterServicePrincipalSynchronizationJobSchemaOperator
	Invoke-MgBetaFunctionServicePrincipalSynchronizationJobSchema
	Invoke-MgBetaParseApplicationSynchronizationJobSchemaExpression
	Invoke-MgBetaParseApplicationSynchronizationTemplateSchemaExpression
	Invoke-MgBetaParseServicePrincipalSynchronizationJobSchemaExpression
	Invoke-MgBetaParseServicePrincipalSynchronizationTemplateSchemaExpression
	New-MgBetaServicePrincipalSynchronizationJob
	New-MgBetaServicePrincipalSynchronizationJobOnDemand
	Remove-MgBetaApplicationSynchronizationTemplateSchema
	Remove-MgBetaServicePrincipalSynchronizationJob
	Remove-MgBetaServicePrincipalSynchronizationJobSchema
	Restart-MgBetaServicePrincipalSynchronizationJob
	Set-MgBetaServicePrincipalSynchronizationSecret
	Start-MgBetaServicePrincipalSynchronizationJob
	Suspend-MgBetaServicePrincipalSynchronizationJob
	Test-MgBetaServicePrincipalSynchronizationJobCredential
	Update-MgBetaApplicationSynchronizationTemplate
	Update-MgBetaServicePrincipalSynchronizationJobSchema

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: attributeDefinition

Property	Type	Description
anchor	Boolean	`true` if the attribute should be used as the anchor for the object. Anchor attributes must have a unique value identifying an object, and must be immutable. Default is `false`. One, and only one, of the object's attributes must be designated as the anchor to support synchronization.
caseExact	Boolean	`true` if value of this attribute should be treated as case-sensitive. This setting affects how the synchronization engine detects changes for the attribute.
defaultValue	String	The default value of the attribute.
flowNullValues	Boolean	'true' to allow null values for attributes.
metadata	attributeDefinitionMetadataEntry collection	Metadata for the given object.
multivalued	Boolean	`true` if an attribute can have multiple values. Default is `false`.
mutability	mutability	An attribute's mutability. Possible values are: `ReadWrite`, `ReadOnly`, `Immutable`, `WriteOnly`. Default is `ReadWrite`.
name	String	Name of the attribute. Must be unique within the object definition. Not nullable.
required	Boolean	`true` if attribute is required. Object can not be created if any of the required attributes are missing. If during synchronization, the required attribute has no value, the default value will be used. If default the value was not set, synchronization will record an error.
referencedObjects	referencedObject collection	For attributes with `reference` type, lists referenced objects (for example, the `manager` attribute would list `User` as the referenced object).
type	attributeType	Attribute value type. Possible values are: `String`, `Integer`, `Reference`, `Binary`, `Boolean`,`DateTime`. Default is `String`.

Graph reference: attributeMappingFunctionSchema

Property	Type	Description
id	String	Key. Read-only.
parameters	attributeMappingParameterSchema collection	Collection of function parameters.

Graph reference: attributeMappingSource

Property	Type	Description
expression	String	Equivalent expression representation of this attributeMappingSource object.
name	String	Name parameter of the mapping source. Depending on the type property value, this can be the name of the function, the name of the source attribute, or a constant value to be used.
parameters	stringKeyAttributeMappingSourceValuePair collection	If this object represents a function, lists function parameters. Parameters consist of attributeMappingSource objects themselves, allowing for complex expressions. If type isn't `Function`, this property is null/empty array.
type	attributeMappingSourceType	The type of this attribute mapping source. Possible values are: `Attribute`, `Constant`, `Function`. Default is `Attribute`.

Graph reference: expressionInputObject

Property	Type	Description
definition	objectDefinition	Definition of the test object.
properties	stringKeyObjectValuePair collection	Property values of the test object.

Graph reference: filter

Property	Type	Description
categoryFilterGroups	filterGroup collection	`Experimental` Filter group set used to decide whether given object belongs and should be processed as part of this object mapping. An object is considered in scope if ANY of the groups in the collection is evaluated to `true`.
groups	filterGroup collection	Filter group set used to decide whether given object is in scope for provisioning. This is the filter which should be used in most cases. If an object used to satisfy this filter at a given moment, and then the object or the filter was changed so that filter isn't satisfied any longer, such object will get deprovisioned". An object is considered in scope if ANY of the groups in the collection is evaluated to `true`*.
inputFilterGroups	filterGroup collection	`Experimental` Filter group set used to filter out objects at the early stage of reading them from the directory. If an object doesn't satisfy this filter, then it will not be processed further. Important to understand is that if an object used to satisfy this filter at a given moment, and then the object or the filter was changed so that filter is no longer satisfied, such object *w

Graph reference: filterOperatorSchema

Property	Type	Description
arity	scopeOperatorType	Arity of the operator. Possible values are: `Binary`, `Unary`. The default is `Binary`.
multivaluedComparisonType	scopeOperatorMultiValuedComparisonType	Possible values are: `All`, `Any`. Applies only to multivalued attributes. `All` means that all values must satisfy the condition. `Any` means that at least one value has to satisfy the condition. The default is `All`.
name	String	Operator name.
supportedAttributeTypes	attributeType collection	Attribute types supported by the operator. Possible values are: `Boolean`, `Binary`, `Reference`, `Integer`, `String`.

Graph reference: parseExpressionResponse

Property	Type	Description
error	publicError	Error details, if expression evaluation resulted in an error.
evaluationResult	String collection	A collection of values produced by the evaluation of the expression.
evaluationSucceeded	Boolean	`true` if the evaluation was successful.
parsedExpression	attributeMappingSource	An attributeMappingSource object representing the parsed expression.
parsingSucceeded	Boolean	`true` if the expression was parsed successfully.

Graph reference: synchronizationJob

Property	Type	Description
id	String	Unique synchronization job identifier. Read-only.
schedule	synchronizationSchedule	Schedule used to run the job. Read-only.
status	synchronizationStatus	Status of the job, which includes when the job was last run, current job state, and errors.
synchronizationJobSettings	keyValuePair	Settings associated with the job. Some settings are inherited from the template.
templateId	String	Identifier of the synchronization template this job is based on.

Graph reference: synchronizationJobApplicationParameters

Property	Type	Description
ruleId	String	The identifier of the synchronizationRule to be applied. This rule ID is defined in the schema for a given synchronization job or template.
subjects	synchronizationJobSubject collection	The identifiers of one or more objects to which a synchronizationJob is to be applied.

Graph reference: synchronizationJobRestartCriteria

Property	Type	Description
resetScope	synchronizationJobRestartScope	Comma-separated combination of the following values: `None`, `ConnectorDataStore`, `Escrows`, `Watermark`, `QuarantineState`, `Full`, `ForceDeletes`. The property can also be empty. `None`: Starts a paused or quarantined provisioning job. **D

Graph reference: synchronizationSchema

Property	Type	Description
id	String	Unique identifier for the schema.
synchronizationRules	synchronizationRule collection	A collection of synchronization rules configured for the synchronizationJob or synchronizationTemplate.
version	String	The version of the schema, updated automatically with every schema change.

Graph reference: synchronizationSecretKeyStringValuePair

Property	Type	Description
key	synchronizationSecret	Possible values are: `None`, `UserName`, `Password`, `SecretToken`, `AppKey`, `BaseAddress`, `ClientIdentifier`, `ClientSecret`, `SingleSignOnType`, `Sandbox`, `Url`, `Domain`, `ConsumerKey`, `ConsumerSecret`, `TokenKey`, `TokenExpiration`, `Oauth2AccessToken`, `Oauth2AccessTokenCreationTime`, `Oauth2RefreshToken`, `SyncAll`, `InstanceName`, `Oauth2ClientId`, `Oauth2ClientSecret`, `CompanyId`, `UpdateKeyOnSoftDelete`, `SynchronizationSchedule`, `SystemOfRecord`, `SandboxName`, `EnforceDomain`, `SyncNotificationSettings`, `SkipOutOfScopeDeletions`, `Oauth2AuthorizationCode`, `Oauth2RedirectUri`, `ApplicationTemplateIdentifier`, `Oauth2TokenExchangeUri`, `Oauth2AuthorizationUri`, `AuthenticationType`, `Server`, `PerformInboundEntitlementGrants`, `HardDeletesEnabled`, `SyncAgentCompatibilityKey`, `SyncAgentADContainer`, `ValidateDomain`, `TestReferences`, `ConnectionString`.
value	String	The value of the secret.

Graph reference: synchronizationTemplate

Property	Type	Description
id	String	Unique template identifier.
applicationId	String	Identifier of the application this template belongs to.
default	Boolean	`true` if this template is recommended to be the default for the application.
description	String	Description of the template.
discoverable	String	`true` if this template should appear in the collection of templates available for the application instance (service principal).
factoryTag	String	One of the well-known factory tags supported by the synchronization engine. The factoryTag tells the synchronization engine which implementation to use when processing jobs based on this template.
metadata	synchronizationMetadataEntry collection	Additional extension properties. Unless mentioned explicitly, metadata values should not be changed.

Table of Contents

Synchronization.ReadWrite.All

Graph Methods

Resources