Works with no permission. Better with three read-only ones.

Before you approve

• Requesting is not granting. DirectoryPoint works on the Basic tier with no Microsoft Graph permission, and checks each time it opens which permissions are approved.
• Who approves. A Global Administrator approves each permission in the SharePoint admin center, under Advanced, API access. The requests appear there only after the DirectoryPoint package is added to your tenant app catalog.
• Shared by SharePoint Framework solutions. SharePoint Framework permissions are granted to Microsoft's shared "SharePoint Online Web Client Extensibility" principal, so an approved permission can be used by every SharePoint Framework solution in your tenant, not only by DirectoryPoint.
• As the signed-in person. Every Microsoft Graph permission DirectoryPoint requests is delegated and read-only: it acts as the person using it and can read only what that person could read.
• Words for your administrator. DirectoryPoint shows site owners each permission's status and a justification to hand to the Global Administrator, under Settings, Permissions and consent.

Never requested, by decision

• Anything that writes or changes, such as User.ReadWrite.All. Change requests never write to Microsoft Entra ID: a site owner approves a correction and DirectoryPoint gives IT a summary of the exact field and value to change where the account is managed.
• ProfilePhoto.Read.All: User.Read.All already lets DirectoryPoint read other people's photos.
• Directory.Read.All, Group.Read.All and GroupMember.Read.All. A who-is-listed rule based on an Entra group needs group membership; when it cannot be read with the permissions approved, DirectoryPoint tells site owners the rule could not be checked and does not apply it. In the same way, external contacts meant for particular Entra groups are shown only when the person's own groups can be read; otherwise DirectoryPoint shows only the contacts meant for everyone.

Other access, with no extra permission

• SharePoint, as the signed-in person. DirectoryPoint reads and writes its own lists on the site where it is set up, with that person's own SharePoint rights. Site owners set it up and manage its settings; each person edits only their own rows: profile options, About you and their name recording, skills, favourites and collections, the copies of collections they share, their change requests, their kudos and their Who's Who scoreboard row. People who can add items to the site's lists also add to the daily usage counts while a site owner leaves counting on; SharePoint gives them no narrower right, so they can also change or remove a count (the Usage page says the numbers are a guide, not a record).
• The Viva Connections cards. The four cards in the same package use exactly the same access as the web part: the same three read-only Microsoft Graph permissions when approved (and the Basic tier without them), and SharePoint as the signed-in person on the DirectoryPoint site. They request nothing of their own.
• The licence check-in. At most once a day from each browser, DirectoryPoint sends Apps 365 your tenant ID, the addresses of the site and its site collection, the app version, the licence state and plan, and the licence ID. It never sends names, profiles, directory data or keys. A site owner can switch it off in Settings, Licence.

The microphone, only when someone records their name

• Optional and personal. Only when a person chooses to record how they say their name (Settings, About you) does the browser ask for the microphone, with its own prompt. Nothing is recorded before they press Record, and the recording is saved only when they press Save, as an attachment of their own DirectoryPoint row.
• In Microsoft Teams. The Teams app package declares the device permission "media" (camera, microphone and speakers, as Teams defines it) so Teams on a computer or the web can ask for the microphone; DirectoryPoint uses only the microphone. The Teams mobile app does not offer it, so recording is not offered there.
• Not an API permission. It gives no access to any data.

Kudos keys, in the browser

The browser's own Web Crypto API makes each person's kudos key pair and seals waiting kudos; nothing is sent anywhere but the DirectoryPoint lists on the site. How kudos are sealed.