> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/cipp/advanced/authentication/sam-app-permissions.md). # SAM App Permissions This page controls the permission set requested for the CIPP-SAM application when consent is granted on customer tenants through CPV. It is where additional Graph or other API permissions are added when a CIPP feature, custom script, or integration needs access beyond what CIPP ships with. {% hint style="danger" %} This is an advanced configuration of CIPP currently in beta. Please proceed with caution. Removing permissions from the CIPP-SAM app is not advised. {% endhint %} ## How Permissions Are Applied CIPP's own default permissions are always applied and cannot be removed. Anything you configure here is layered on top of them, so this page adds permissions rather than replacing the set. Saving stores the permission set. It does not grant anything on its own. To apply the change you need to run a permissions repair from [Permissions](/user-documentation/cipp/settings/permissions.md), then complete a CPV refresh so that consent is updated in each customer tenant. {% hint style="warning" %} Permissions added here are requested in every tenant CIPP manages, not just the one you need them for. Add only what is genuinely required, and be prepared to justify the resulting consent scope to your customers. {% endhint %} ## Editing Permissions Permissions are grouped by the API they belong to, each shown as a service principal card with its display name, application ID, and a count of the application and delegated permissions currently assigned. Expanding a card reveals two tabs. | Tab | Description | | ----------- | ---------------------------------------------------------------------------------------------------------- | | Application | Permissions the CIPP-SAM application holds in its own right, used when CIPP acts without a signed-in user. | | Delegated | Permissions exercised on behalf of the signed-in service account. | On each tab, choose a permission from the picker and select the add button to include it. Existing permissions are listed below with the option to remove them. {% hint style="info" %} Saving happens in two stages. **Save Changes** within a service principal card commits your edits to that API's permission set on screen. **Save** at the bottom of the page submits the whole set to CIPP. Changes are not stored until you use the second one. {% endhint %} ## Toolbar Actions | Control | Description | | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Add a Service Principal (optional) | Adds an API not already listed, so its permissions can be configured. Choose from the available service principals, or enter an application ID directly if the one you need is not listed. | | Reset to Current Defaults | Discards unsaved changes and returns the builder to the currently saved permission set. This affects the screen only, not what is stored. | | Download Manifest | Exports the current permission set as an application manifest, which is useful for review or for reproducing the configuration elsewhere. | | Import Manifest | Loads a permission set from a manifest rather than building it by hand. | {% hint style="info" %} Not every permission can be represented in an application manifest. Where the export encounters any that cannot, you are offered a separate `AdditionalPermissions.json` download containing them, so nothing is silently lost. {% endhint %} Individual service principals can be removed from the list, with confirmation. Removing one drops the additional permissions configured against it, but has no effect on CIPP's defaults for that API. ## Reset to CIPP Defaults **Reset to CIPP Defaults** removes every additional permission layered on top of the defaults and returns the saved permission set to the built-in CIPP manifest. The default permissions themselves are unaffected. As with any other change here, the reset only alters what CIPP stores. Run a permissions repair followed by a CPV refresh to apply it to your tenants. {% hint style="warning" %} Consent already granted in a customer tenant is not withdrawn by resetting here. Permissions the CIPP-SAM application has already been consented to remain in place until they are removed in the tenant. {% endhint %} Directory role assignments for the same application are configured separately on [SAM App Roles](/user-documentation/cipp/advanced/authentication/sam-app-roles.md). *** ## Feature Requests / Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cipp.app/user-documentation/cipp/advanced/authentication/sam-app-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.