Direct Connections
Microsoft Entra ID (former Azure Active Directory) is the organizational directory offered by Microsoft as part of Microsoft 365.
How Worklytics Collects and Uses Microsoft Entra ID Data
Worklytics supports connecting to Entra ID, to federate authentication and to import organizational information into Worklytics. The former allows your Entra ID users to use their Microsoft 365 credentials to sign-in to Worklytics, rather than managing separate username/passwords specific to Worklytics. The latter includes data such as:
Users and associated information, such as name, email addresses, avatars, timezone settings, etc
Groups, including Administrative Units, which are used to understand org structure and provide filters/aggregation options in various reports in Worklytics
To support this, Worklytics Entra ID connectors request the following permissions grants:
Directory.Read.All includes users and groups within the organization, needed to link users across data sources, analyze org structure, and provide aggregation/filtering options in Worklytics' reports.
AdministrativeUnit.Read.All administrative units are another type of group that inform organization structure, and provide aggregation/filtering options for Worklytics' reports.
Group.Read.All provides groups that inform organization structure, and provide aggregation/filtering options for Worklytics' reports. Implied by Directory.Read.All, but we ask for it explicitly for clarity.
MailboxSettings.Read provides user timezone preferences, working hours, etc that are used in Worklytics' analysis.
User.Read.All list of users in the organization. required to link users in Entra ID to other data sources, as well as iterate groups, mailbox settings, etc per-user. Implied by Directory.Read.All, but we ask for it explicitly for clarity.
openid / User.Read allows users of Entra ID organization to sign-in to Worklytics, using their Entra ID credentials. (eg, "Login with Microsoft 365").
NOTE: in the Microsoft Credentials prompt, some permissions, such as "Directory.Read.All" may be listed twice. This is because Microsoft offers two APIs (Azure Directory, and Microsoft Graph). The former is a legacy API but offers richer data, so we use that to import users. The latter is the "new" API and offers more data types, so we use it to iterate other data about users (such as Group memberships). Underneath, these are two distinct permission scopes, although the data they grant access to is equivalent. However, in the customer facing UX the copy shown by Microsoft is very similar for both, and there is no way to readily distinguish them. Hence, you will likely see "Read Directory Data" listed twice when you grant permissions to Worklytics.
Further reading: Microsoft Graph Permissions Reference
Connecting Worklytics to Entra ID
NOTE: If you don't have a Worklytics account, you can sign up here or contact our support team to get information on how to proceed.
A Global Administrator of your Entra ID instance must complete the following steps:
Visit the Data Connections screen inside Worklytics, and find the "Microsoft Entra ID" connector. Click "Connect".
After authenticating with the Entra ID organization that you wish to connect, you'll be presented with a permissions screens that looks as follows. Click "Accept".
You'll be redirected back to Worklytics.
Last updated
