Security notes

What Lleverage can do in your directory, what it keeps, and what happens to it. This is the feature-specific security detail for directory access.

Permissions

Microsoft Entra ID

The Lleverage Directory application is granted two application permissions by a Global Administrator of your tenant:

Permission	Used for
GroupMember.Read.All	Listing groups, and reading the members, including transitive members, of the groups you map
User.Read.All	Reading profile fields for members of mapped groups, and for the whole tenant if you create an Everyone grant

Both are read-only. The application has no write permission, no access to mail, files, calendars, Teams, sign-in logs or Conditional Access, and cannot act as any user. Lleverage authenticates to Microsoft Graph with a client secret held in Lleverage's secret storage; no credential is shown to or stored by your organisation.

You can review or remove the grant at any time under Enterprise applications in the Entra admin centre. Removing it stops the sync at the next run; it does not remove access on the Lleverage side.

SCIM

No permission is granted in your tenant. Your identity provider authenticates to WorkOS with a bearer token that your administrator creates in the WorkOS portal and can rotate or revoke there. Lleverage receives the pushed records from WorkOS and reads nothing else.

What Lleverage stores

For each connection Lleverage keeps the tenant identifier and display name for Entra, or the WorkOS directory identifier for SCIM, which permissions were granted, who consented and when, the sync settings, and delta cursors so that each sync reads only what changed.

Lleverage keeps the identifier and name of every group it can see so that you can search for one to map. For Entra ID that is every group in the tenant; for SCIM, only the groups your IT team assigned.

For each member of a mapped group Lleverage keeps a catalogue record: the directory's identifier for the record, display name, email address and user principal name, whether the account is enabled, whether the account is a guest, and which Lleverage account it was linked to. Members of unmapped groups are not stored. For an Everyone grant the same fields are kept for every enabled member of the tenant; over SCIM, for every assigned user.

Lleverage does not store passwords, group descriptions, manager relationships, job titles, phone numbers, photos or custom attributes through this directory feature.

When a member leaves every mapped group or is deleted from the directory, their catalogue record is marked as gone and their link to a Lleverage account is kept for the audit trail.

What Lleverage does with it

• Creates Lleverage accounts for mapped members who have none, when the setting allows.

• Grants and removes Project and organisation roles according to your mappings.

• Ends sessions when the directory disables an account, if the setting is on. Without SSO, access is removed but an existing session can retain cached permissions for up to five minutes before further requests are refused.

• Emails Organisation Owners about sync failures and, unless turned off, a digest of access changes. Welcome messages can also be sent to provisioned members if enabled.

Lleverage never writes to your directory.

Who can do what in Lleverage

Action	Who
Connect or disconnect a directory, change sync settings	Organisation Owner
Map, change or remove a group mapping; set an Everyone grant	Organisation Owner
Map a group to the organisation Owner role	Organisation Owner, with the group's name typed to confirm
Suspend a directory member in a group	Organisation Owner
See sync activity and members without access	Organisation Owner

Every connect, disconnect, mapping change, role change and suspension is recorded under Organisation Settings → Activity → Access activity with who did it, or which sync run did. Events are kept for 400 days.

Consent links

An Entra consent link is signed by Lleverage, is bound to your organisation, expires 15 minutes after it is generated and is accepted once. A link that has expired, has been used, or was not issued by Lleverage is refused. Only a Global Administrator of the tenant can complete the consent; Microsoft enforces that.

A WorkOS setup link is short-lived and opens the setup portal for your WorkOS organisation only.

Rate limits and failure

When Microsoft Graph throttles a read, Lleverage waits the Retry-After it is given and records the run as throttled rather than retrying at once. A sync that runs out of its time budget is marked partial and continues on the next tick. A failure emails Organisation Owners and is shown on the Directory page; the previous access state stands until a sync succeeds again.

Disconnecting

Disconnect on the Directory page, after confirmation:

• removes every role that the directory granted, through group mappings and Everyone grants;

• archives the mirror groups;

• removes members whose organisation membership itself came from the directory when they hold nothing else;

• keeps every role granted directly, by invitation or by SSO;

• clears the delta cursors, so a reconnection starts with a full read;

• for SCIM, discards any pushed events not yet processed.

The connection record and catalogue stay, marked disconnected, so the audit trail keeps its context. The first full sync after reconnection replaces the catalogue, and switching provider removes it at once. Consent in your Entra tenant is not touched; remove the enterprise application there if you want it gone.

Deleting a SCIM directory in WorkOS has the same effect as Disconnect. Deactivating it, or revoking the bearer token, does not: the connection reports an error and access stays as it was.

Data location and retention

Directory data is stored with the rest of your organisation's data and is deleted with the organisation. Audit events are retained for 400 days. Ask your Lleverage contact for the data-processing terms that apply to your agreement.