Home

Defining Azure Active Directory User Permissions

%3CLINGO-SUB%20id%3D%22lingo-sub-429508%22%20slang%3D%22de-DE%22%3EDefining%20Azure%20Active%20Directory%20User%20Permissions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-429508%22%20slang%3D%22de-DE%22%3E%3CP%3EHi!%3C%2FP%3E%3CP%3EFor%20security%20reasons%20I've%20disabled%20the%20default%20permission%20to%20read%20user%20profiles%20in%20azure%20active%20directory%20by%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESet%20MsolCompanySettings-UserPermissionToReadOtherUsers-Enabled%20%24false%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHow%20can%20I%20return%20this%20permission%20only%20to%20a%20specific%20user%20or%20group%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-429508%22%20slang%3D%22de-DE%22%3E%3CLINGO-LABEL%3EAccess%20Management%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-431071%22%20slang%3D%22en-US%22%3ERe%3A%20Defining%20Azure%20Active%20Directory%20User%20Permissions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-431071%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20cannot%2C%20it's%20all%20or%20nothing.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-431466%22%20slang%3D%22en-US%22%3ERe%3A%20Defining%20Azure%20Active%20Directory%20User%20Permissions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-431466%22%20slang%3D%22en-US%22%3E%3CP%3ESo%2C%20if%20I%20set%20the%20default%20permission%20back%20to%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3ESet-MsolCompanySettings%20-UsersPermissionToReadOtherUsersEnabled%20%24true%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EHow%20can%20I%20prevent%20normal%20users%20from%20reading%20other%20user%20profiles%20in%20the%20Azure%20AD%3F%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-434700%22%20slang%3D%22en-US%22%3ERe%3A%20Defining%20Azure%20Active%20Directory%20User%20Permissions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-434700%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20cannot%2C%20those%20properties%20are%20%22public%22%20and%20you%20can%20also%20see%20them%20from%20the%20GAL%20in%20Outlook%2FOWA%2C%20Delve%2C%20etc.%20There%20are%20some%20settings%20like%20the%20above%20mentioned%20or%20the%20equivalent%20for%20the%20Azure%20portal%2C%20but%20those%20only%20apply%20to%20the%20corresponding%20endpoints.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-434806%22%20slang%3D%22en-US%22%3ERe%3A%20Defining%20Azure%20Active%20Directory%20User%20Permissions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-434806%22%20slang%3D%22en-US%22%3E%3CP%3EHi!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHm%20...%20would%20it%20be%20possible%20to%20use%20role%20based%20access%20control%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
indima
New Contributor

Hi!

For security reasons I've disabled the default permission to read user profiles in azure active directory by 

 

Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $false

 

How can I return this permission only to a specific user or group?

5 Replies

You cannot, it's all or nothing.

So, if I set the default permission back to 

 

Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $true

 

How can I prevent normal users from reading other user profiles in the Azure AD?

You cannot, those properties are "public" and you can also see them from the GAL in Outlook/OWA, Delve, etc. There are some settings like the above mentioned or the equivalent for the Azure portal, but those only apply to the corresponding endpoints.

Hi!

 

Hm ... would it be possible to use role based access control?

Highlighted

RBAC wont help you with this. Plus we don't have proper RBAC controls for Azure AD just yet.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies