> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/tenant/administration/applications/permission-sets.md).

# Permission Sets

Permission sets are named collections of API permissions stored in CIPP rather than in any tenant. They are the reusable building block behind application deployment: an application template references a permission set and deploying that template grants the permissions in the set to the application in the target tenant. Defining the permissions once here keeps every deployment of an application consistent.

Sets are created by hand from this page, and also automatically by the **Create Template from App** action on [Enterprise Applications](/user-documentation/tenant/administration/applications/enterprise-apps.md) and [App Registrations](/user-documentation/tenant/administration/applications/app-registrations.md), which saves the source application's permissions as a set named after the application, suffixed with "(Auto-created)".

## Page Actions

**Add Permission Set** opens a drawer for building a new set. Give the set a name, then use the permission builder to choose the permissions it should contain. Microsoft Graph is added as the default service principal, and further service principals can be added as needed. Some service principals publish no permissions at all, and so offer nothing to select.

## Table Details

| Column        | Description                                                                                                                                             |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Template Name | The name given to the permission set, used when selecting it during application deployment.                                                             |
| Permissions   | The permissions held in the set. The cell is a button showing how many entries are stored; selecting it opens the stored permission data in a dialogue. |
| Updated By    | The CIPP user who last saved the set. Sets written by CIPP itself rather than by a person show as `CIPP-API`.                                           |
| Timestamp     | When the set was last saved.                                                                                                                            |

## Table Actions

<table><thead><tr><th>Action</th><th>Description</th><th data-type="checkbox">Bulk Action Available</th></tr></thead><tbody><tr><td>Edit Permission Set</td><td>Opens the selected permission set in a drawer so its name and permissions can be changed.</td><td>true</td></tr><tr><td>Copy Permission Set</td><td>Opens the Add Permission Set page with the selected set's name and permissions pre-filled, ready to be saved under a new name.</td><td>false</td></tr><tr><td>Delete Permission Set</td><td>Deletes the selected permission set(s), after a confirmation prompt naming the set.</td><td>true</td></tr><tr><td>More Info</td><td>Opens the Extended Info flyout with the full details for the selected row.</td><td>false</td></tr></tbody></table>

{% hint style="warning" %}
Editing a permission set changes it for every application template that references it. The change does not reach tenants on its own: applications already deployed keep the permissions they were granted until the template is deployed again. Deleting a set leaves any template referencing it without its permissions.
{% endhint %}

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cipp.app/user-documentation/tenant/administration/applications/permission-sets.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.