Permissions reference

One read permission to start. Write only where you are migrating to.

This page is the answer to the first question an IAM team asks. It lists every permission TenantFlex can use, what each one reads, and which feature needs it, so you can grant the minimum and add the rest only if you use the feature.

How to set it up Security and deployment
Permissions by provider

Every permission, what it reads, and which feature needs it.

Microsoft Entra ID

Step 1 · read applications Application.Read.All

Lists applications and service principals with their sign-on configuration, redirect URIs, assignments, certificates and secret expiry. The inventory, discovery reports and credential expiry run on this alone.

Only for the features you use optional
  • Claims on SAML enterprise applicationsPolicy.Read.All

    Without it, a SAML application's claims are reported as unknown rather than as standard.

  • Conditional access that applies to an applicationPolicy.Read.ConditionalAccess
  • SCIM provisioning statusSynchronization.Read.All
  • When an application was last signed in toReports.Read.All
  • Privileged access reviewRoleManagement.Read.DirectoryRoleAssignmentSchedule.Read.Directory

    Reads directory role holders, active and PIM-eligible. Azure RBAC is read through a separate read-only role at the root management group.

  • Migrating into this tenantApplication.ReadWrite.All

    Destination only: create the applications and their claims configuration. A source tenant never needs it.

Okta

Step 1 · read applications okta.apps.read

Lists applications with their sign-on mode, SAML and OIDC configuration, assignments and signing certificates. The API client also needs an administrator role that can read applications.

Only for the features you use optional
  • The sign-on policy governing an applicationokta.policies.read
  • API scopes granted to OAuth applicationsokta.appGrants.read

    Without it, an OAuth application's API permissions are reported as unknown.

  • When an application was last authenticated tookta.logs.read

    Also needs an administrator role that can read the System Log.

  • Admin role reviewokta.roles.readokta.users.readokta.groups.read

    Reads who holds admin roles, directly or through a group. The API client also needs an administrator role that can read role assignments.

  • Migrating into this orgokta.apps.manage

    Destination only. A source org never needs it.

PingOne

Step 1 · read applications Configuration Read Only

PingOne gives a worker application a role rather than scopes. This role lists applications and reads their attribute mappings, which are PingOne's claim configuration, and cannot change anything.

Only for the features you use optional
  • Migrating into this environment, or restoring a backupClient Application Developer

    Creates applications and writes their configuration back. A source environment never needs it.

Roadmap

Where the platform goes next.

Today we migrate SSO. Each step widens what a tenant move can carry with it, in the order customers have asked for it.

In production

SSO migration

Pre-discovery and migration of SAML and OAuth/OIDC applications between Entra ID, Okta and PingOne, running in customer environments today.

Next

Close the gap

SCIM discovery is in production: pre-discovery shows which applications provision users and how. SCIM migration is next, so provisioning moves with the app, not after it.

In progress

Security lifecycle

Certificate and secret expiry tracking across tenants is in production. Rotation follows, so a credential is renewed before it expires.

Planned

Governance

App consent and OAuth grant governance, so what was approved in the source is understood in the target.

Setting it up

Ten minutes per tenant, in your own admin console.

You create the credential in the provider's console and paste it into TenantFlex. TenantFlex never asks for an administrator's own login, and the credential can be revoked from your side at any time.

Microsoft Entra ID

  1. Create an app registration in the tenant you are connecting.
  2. Under API permissions, add Application.Read.All as an application permission (not delegated), and any optional reads you want.
  3. Grant admin consent. The consent is recorded in the tenant's audit log.
  4. Create a client secret or upload a certificate and paste the tenant ID, client ID and secret into TenantFlex.
  5. Destination only: add Application.ReadWrite.All when you are ready to migrate into this tenant.

Okta

  1. Create an API Services application in the org (OAuth 2.0 client credentials).
  2. Grant the scope okta.apps.read, plus any optional reads you want (okta.orgs.read shows the org name).
  3. Assign the application the Application Administrator role, which is the documented minimum, or a custom role limited to application read on a resource set. Super Administrator is not required.
  4. Register a public key on the application (client authentication is private key JWT) and paste the org URL, client ID and private key into TenantFlex.
  5. Destination only: grant okta.apps.manage and a role that can create applications when you are ready to migrate into this org.

PingOne

  1. Create a worker application in the environment you are connecting.
  2. Give it the Configuration Read Only role for that environment.
  3. Paste the environment ID, client ID and secret into TenantFlex.
  4. Destination only: add the Client Application Developer role when you are ready to migrate into, or restore a backup into, this environment.

What TenantFlex never asks for

No permission that reads or changes users, groups, passwords or sign-in sessions is needed for a migration, and none is requested. In particular:

Directory.ReadWrite.All
Entra ID: not requested. Applications are created through the application permission above, nothing else in the directory is written.
User.ReadWrite.All · Group.ReadWrite.All
Entra ID: not requested. Assignments are read, not changed, and users are never created or edited.
okta.users.manage · okta.groups.manage
Okta: not requested. The admin role review reads role holders with .read scopes only.
Global Administrator · Super Admin
Never required on any provider. A read-only administrator role is sufficient for a source tenant.
An administrator's own credentials
Never requested. Every connection uses a dedicated application identity you create and can revoke.

Revoking access

Delete the app registration, API Services application or worker application in your console, or remove its roles. TenantFlex's connection fails on the next call and is marked as disconnected. Data already captured stays in your workspace until you delete the connection or the workspace.

Verifying what was granted

Entra ID records consent grants in the audit log and shows them under Enterprise applications → Permissions. Okta shows the scopes and roles on the API Services application. PingOne shows the worker application's roles under its environment. The same list appears on the connection page in TenantFlex, read back from the provider, so what you see in both places should match.

TenantFlex Get started

Bring your least-privilege policy.

If your policy needs a different split of permissions, tell us. We will show you what works with the minimum you can grant.

[email protected] · www.tenantflex.com
Tell us about your reviewWe reply within one business day.

Goes straight to [email protected]. If the form can't reach us, it opens your email app with the request prefilled instead.

Click image to zoom · ← → to browse · Esc to close