Application and delegated permissions

Also known as: application permission, App-Only permission, delegated permission

Application and delegated permissions are the two kinds of Microsoft permissions Rencore Governance asks for. Application permissions read your tenant without a signed-in user, and delegated permissions act for a signed-in user.

An application permission is also called app-only. A delegated permission reaches only data the signed-in user can access. Almost every connector uses application permissions.

Power Platform is the exception. Microsoft does not let third parties connect to Power Apps and Power Automate with application permissions, so that consent is delegated. Rencore Governance then signs in as the account that gave the consent during every scan, so that account must be able to reach the data. Connecting to the tenant itself uses the delegated User Impersonation permission and works with any ordinary user account.

For example, the Archive or unarchive a Team action needs the application permission to read and change all teams’ settings without a signed-in user.

Each connector page lists the Microsoft permissions it uses, and the permissions reference describes every one. You revoke either kind in the Microsoft Entra admin center.