Directory Permission Changes – Required Action

Microsoft has recently updated their Graph API documentation for user updates. As part of this update, certain profile fields (aboutMe, schools, skills, etc.)  can now only be updated using delegated permissions instead of application permissions.

This change affects how Directory interacts with Azure Active Directory (AAD) to update user profile data.

Notes: Hybrid configurations required version 4.2.39.

Permission Usage

• User.ReadWrite.All is required to update the following profile fields:
  aboutMe, birthday, employeeHireDate, interests, mySite, pastProjects, responsibilities, schools, and skills.

  • Administrator role required: SharePoint Administrator.

• User-Phone.ReadWrite.All is required to update the following profile fields:
  mobilePhone and businessPhones.

  • Administrator role required: User Administrator.

Required Action

1. Go to the Azure Portal -> go to Enterprise applications find "Hyperfish" and re-consent permissions for Hyperfish.

2. Ensure that the person approving the consent has administrative rights in the Azure tenant.

3. Confirm that "Hyperfish" is granted the delegated permissions listed above.

⚠️ Important Note:
Users who are administrators in the directory must also hold administrator rights in their Azure tenant in order to approve changes on the affected profile fields ( aboutMe, birthday, employeeHireDate, interests, mySite, pastProjects, responsibilities, schools, skills, mobilePhone and businessPhones).

Conclusion

These permission changes are introduced by Microsoft to enhance security and align with modern Graph API standards. By re-consenting to Hyperfish, organizations can ensure that profile updates continue without interruption.

Permissions list in Directory:

If you have questions about LiveTiles Directory security, please email support@livetilesglobal.com