Permissions

ConnectActive only reads a client’s directory. It writes to your ConnectWise.

Microsoft 365 / Entra ID

Microsoft Graph application permissions, granted by a Global Administrator or Privileged Role Administrator of the client’s tenant (Connect Microsoft 365):

Permission	Purpose
Directory.Read.All	Read users and directory data to sync contacts with ConnectWise
Group.Read.All	Read groups, for group-to-addition mappings
Member.Read.Hidden	Include hidden group memberships, so group counts are accurate
AuditLog.Read.All	Read users’ last sign-in date, so inactive accounts can be identified

All are read-only. ConnectActive syncs with its own application credentials and never uses the account that granted consent. The client can review or remove ConnectActive under Enterprise applications in Entra ID. The panel shows the Application ID in use; a tenant in Microsoft’s US government cloud uses a different ConnectActive application, and the panel lists that one’s permissions.

Microsoft Partner Center

Your authorization is given by a user of your CSP partner tenant with the Admin agent role. When you add a customer, ConnectActive grants its application the same read permissions in the customer’s tenant through Partner Center and reads the tenant like a Microsoft 365 source.

Google Workspace

Domain-wide delegation for Client ID 112731746857857481915, with these read-only scopes (Connect Google Workspace):

• admin.directory.user.readonly, admin.directory.group.readonly, admin.directory.group.member.readonly
• admin.directory.orgunit.readonly, admin.directory.customer.readonly, admin.directory.domain.readonly
• admin.reports.audit.readonly

Active Directory

The PowerShell script runs on the client’s network with the rights of the account that runs it, reads enabled users, groups and OUs, and uploads them to ConnectActive. It makes no change to Active Directory (Connect Active Directory).

ConnectWise

ConnectActive works through your account’s ConnectWise API member. What it writes:

Feature	ConnectWise records written
Contact sync	Contacts: created, updated, deactivated; their sites, Contact Types and custom fields
Agreement mappings	Agreement additions: count, invoice description, unit price and cost, serial number, taxable flag; new additions; prorated additions
Configuration Contacts	Configurations’ contact. Needs Companies and Contacts → Configurations → Edit set to All.
Inactive Contact Cleanup	Contacts merged and deleted, after you commit the plan

The product description on an invoice comes from the ConnectWise product catalog. If the API member cannot read the catalog, ConnectActive uses the addition’s own description.