Required permissions

This article shows the permissions that Rencore Governance needs.

Rencore Governance needs permissions to your Microsoft 365 tenant in order to operate and collect the data of the connectors that you would like to govern.

Connect to the tenant

First, you need to connect to your Microsoft 365 tenant to allow Rencore Governance to retrieve the metadata and the current consent status.

You can use any ordinary user account with access to the tenant. No admin permissions are required.

Required permissions

• User Impersonation (Delegated).

You can learn more about the security of Rencore Governance security overview article.

To get a detailed description of the underlying technical architecture, infrastructure security analysis results from Azure as well as a current application vulnerability assessment report (AVR) generated by a 3rd party (Veracode) please reach out to our sales team.

Consent

To allow Rencore Governance to scan your tenant, you need to consent to give it access first.

The app allows you to consent either globally via a single Azure App, or individually per connector to delegate the consent to various service administrators.

You can give consent with a different account than the one you used to connect the tenant.

Connecting a service needs an admin of that service. Give consent with an account that holds the admin role for it, for example a Power Platform Administrator for Power Apps and Power Automate, or a Fabric Administrator for Power BI.

• Global Consent
• Consent per Service

Ask admin for consent

You can request consent to give Rencore Governance access to your tenant from an admin by clicking the link “Ask Admin for consent”.

This will open your default email client with an email template containing an anonymous consent link

Hi admin,

Could you please approve Rencore Governance to analyze ‘Rencore Governance’ of ‘rencore.com’?

Kindly review the permission requirements and give consent here: https://<region>.app.rencore.com/consent/<id>

Thanks!

When the link is clicked, the admin will be redirected to a consent dialog.

The admin does not gain access to Rencore Governance by giving consent to the service in Microsoft 365.

Consent links will expire after 5 days.

Permissions

To access the data in your tenant, Rencore Governance needs several permissions.
You can learn more about Microsoft Graph permissions here.

Rencore Governance uses several apps to allow global or granular permissions.

The permissions are detailed in following article.

Anthropic

The Claude Enterprise connector does not use a Microsoft 365 consent. Instead, an owner of your Claude Enterprise organization creates API keys in claude.ai, and you enter them in Rencore Governance. See Anthropic consent for the keys, scopes and steps.