> For the complete documentation index, see [llms.txt](https://docs.lleverage.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lleverage.ai/administer-and-govern/control/members/directory-access/security-notes.md). # Security notes What Lleverage can do in your directory, what it keeps, and what happens to it. This is the feature-specific security detail for directory access. ## Permissions ### Microsoft Entra ID The **Lleverage Directory** application is granted two application permissions by a Global Administrator of your tenant: | Permission | Used for | | ---------------------- | ------------------------------------------------------------------------------------------------------------- | | `GroupMember.Read.All` | Listing groups, and reading the members, including transitive members, of the groups you map | | `User.Read.All` | Reading profile fields for members of mapped groups, and for the whole tenant if you create an Everyone grant | Both are read-only. The application has no write permission, no access to mail, files, calendars, Teams, sign-in logs or Conditional Access, and cannot act as any user. Lleverage authenticates to Microsoft Graph with a client secret held in Lleverage's secret storage; no credential is shown to or stored by your organisation. You can review or remove the grant at any time under **Enterprise applications** in the Entra admin centre. Removing it stops the sync at the next run; it does not remove access on the Lleverage side. ### SCIM No permission is granted in your tenant. Your identity provider authenticates to WorkOS with a bearer token that your administrator creates in the WorkOS portal and can rotate or revoke there. Lleverage receives the pushed records from WorkOS and reads nothing else. ## What Lleverage stores For each connection Lleverage keeps the tenant identifier and display name for Entra, or the WorkOS directory identifier for SCIM, which permissions were granted, who consented and when, the sync settings, and delta cursors so that each sync reads only what changed. Lleverage keeps the identifier and name of every group it can see so that you can search for one to map. For Entra ID that is every group in the tenant; for SCIM, only the groups your IT team assigned. For each member of a mapped group Lleverage keeps a catalogue record: the directory's identifier for the record, display name, email address and user principal name, whether the account is enabled, whether the account is a guest, and which Lleverage account it was linked to. Members of unmapped groups are not stored. For an Everyone grant the same fields are kept for every enabled member of the tenant; over SCIM, for every assigned user. Lleverage does not store passwords, group descriptions, manager relationships, job titles, phone numbers, photos or custom attributes through this directory feature. When a member leaves every mapped group or is deleted from the directory, their catalogue record is marked as gone and their link to a Lleverage account is kept for the audit trail. ## What Lleverage does with it * Creates Lleverage accounts for mapped members who have none, when the setting allows. * Grants and removes Project and organisation roles according to your mappings. * Ends sessions when the directory disables an account, if the setting is on. Without SSO, access is removed but an existing session can retain cached permissions for up to five minutes before further requests are refused. * Emails Organisation Owners about sync failures and, unless turned off, a digest of access changes. Welcome messages can also be sent to provisioned members if enabled. Lleverage never writes to your directory. ## Who can do what in Lleverage | Action | Who | | ------------------------------------------------------------ | ---------------------------------------------------------- | | Connect or disconnect a directory, change sync settings | Organisation Owner | | Map, change or remove a group mapping; set an Everyone grant | Organisation Owner | | Map a group to the organisation Owner role | Organisation Owner, with the group's name typed to confirm | | Suspend a directory member in a group | Organisation Owner | | See sync activity and members without access | Organisation Owner | Every connect, disconnect, mapping change, role change and suspension is recorded under **Organisation Settings → Activity → Access activity** with who did it, or which sync run did. Events are kept for 400 days. ## Consent links An Entra consent link is signed by Lleverage, is bound to your organisation, expires 15 minutes after it is generated and is accepted once. A link that has expired, has been used, or was not issued by Lleverage is refused. Only a Global Administrator of the tenant can complete the consent; Microsoft enforces that. A WorkOS setup link is short-lived and opens the setup portal for your WorkOS organisation only. ## Rate limits and failure When Microsoft Graph throttles a read, Lleverage waits the `Retry-After` it is given and records the run as throttled rather than retrying at once. A sync that runs out of its time budget is marked partial and continues on the next tick. A failure emails Organisation Owners and is shown on the Directory page; the previous access state stands until a sync succeeds again. ## Disconnecting **Disconnect** on the Directory page, after confirmation: * removes every role that the directory granted, through group mappings and Everyone grants; * archives the mirror groups; * removes members whose organisation membership itself came from the directory when they hold nothing else; * keeps every role granted directly, by invitation or by SSO; * clears the delta cursors, so a reconnection starts with a full read; * for SCIM, discards any pushed events not yet processed. The connection record and catalogue stay, marked disconnected, so the audit trail keeps its context. The first full sync after reconnection replaces the catalogue, and switching provider removes it at once. Consent in your Entra tenant is not touched; remove the enterprise application there if you want it gone. Deleting a SCIM directory in WorkOS has the same effect as Disconnect. Deactivating it, or revoking the bearer token, does not: the connection reports an error and access stays as it was. ## Data location and retention Directory data is stored with the rest of your organisation's data and is deleted with the organisation. Audit events are retained for 400 days. Ask your Lleverage contact for the data-processing terms that apply to your agreement. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.lleverage.ai/administer-and-govern/control/members/directory-access/security-notes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.