Which permissions does a Microsoft 365 account need to be able to read the directory contacts?

In order to programmatically retrieve directory contacts from Microsoft 365, certain permissions must be assigned to the respective account or the application used via Microsoft Graph. 

Specifically, the following OAuth scopes are required:

• Directory.Read.All: Allows user and group data to be read in the directory.
• offline_access: Allows the client to retrieve refresh tokens in order to be able to access the data without further user interaction.
• User.Read: Allows access to basic user information of the currently logged in user.

Only with these scopes does sync.blue® receive the necessary access to be able to read directory contacts.