What data can OneDirectory access?
OneDirectory has read-only access and accesses only user profile information. It cannot edit or modify any data in your environment.
We do not access:
• Emails
• Documents
• Audit logs
• Teams messages
• Calendar data
• Any other user-generated content
How does authentication work?
• Sign-in uses Microsoft Authentication.
• Credentials are never seen or stored by OneDirectory.
• All authentication is controlled by your organization.
• No passwords are stored and no forms-based authentication is used.
Where is OneDirectory accessed?
• At your organization subdomain: https://{your-organization-subdomain}.onedirectory.com
Automatic sign-in (SSO): an optional deep-link URL automatically signs users in if they are already authenticated with Microsoft — ideal for intranets or internal portals.
How is data accessed and what permissions are requested?
• Data is accessed via the Microsoft Graph API.
• Permissions are visible and manageable in Entra ID.
• Only read-only access to user profile fields is requested.
1. Full Microsoft Graph user property reference: docs.microsoft.com — user resource
What is the least-privilege model?
• Only required read-only permissions are requested.
• No write access is granted by default.
• Write access, if ever required, follows a separate approval process.
How is access controlled and revoked?
Role-based access control uses two role types — Users and Admins — and access and actions are controlled by assigned roles.
1. To revoke access: remove OneDirectory from Entra ID → Enterprise Applications. Access can be revoked at any time.
How is data secured in transit?
• SSL-only API access.
• Requests are tenant-isolated.
• All data in transit is encrypted using SSL.
Need a deeper review? OneDirectory can walk through this guide with you, help define a pilot scope, and review permissions with your security team. |