At a glance
| Can Waystone… | Answer | Why |
|---|---|---|
| Read users, their managers and groups | Yes | For People sync: your org chart, departments and assignment rules. |
| Change anything in your directory | No | Waystone asks for no write permission of any kind. |
| Read any mailbox, calendar or file | No | No Mail, Calendars, Files or Sites permission. |
| Send email as people in your organization | No | No Mail.Send permission in Entra ID. |
| Send from your own address | Only if you choose | One mailbox, scoped by Exchange. See the sending guide. |
| Act without a signed-in person | No | App-only tokens are refused on every request. |
Signing in
People sign in with their Microsoft work account through Microsoft Entra ID. Waystone never sees or stores a password, and your sign-in policies (MFA, Conditional Access, sign-in risk) apply exactly as they do for Microsoft 365. When you disable someone in Entra ID, they can no longer sign in to Waystone.
The two permissions we ask for
When your organization signs up, a Microsoft 365 administrator approves the Waystone Learn API app once. Its consent screen lists two application permissions, both read-only:
User.Read.All: read user profiles and their manager.GroupMember.Read.All: read groups and who is in them.
Why not something smaller? Microsoft's narrower User.ReadBasic.All doesn't include department, job title or manager, and those are what managers' reports and compliance by department are built on. Why application permissions? People sync runs on a schedule in the background, so new starters and leavers are picked up without an administrator having to sign in each time.
Exactly what People sync reads
Waystone asks Microsoft Graph for these fields and nothing else. No photos, no sign-in activity, no licences.
| User fields | Used for |
|---|---|
id | Links the person to their Waystone records |
displayName, mail, userPrincipalName | Who they are, and where reminders go |
department, jobTitle, officeLocation | Reports, compliance by department, assignment rules |
employeeHireDate | Rules like "assign onboarding to new starters" |
accountEnabled, userType | Telling leavers and guest accounts apart from current staff |
manager (id only) | So managers see their own team |
Groups: id, displayName, securityEnabled, mailEnabled | Assigning training by group |
Check it yourself
- Open the Entra admin center and go to Enterprise applications.
- Search for Waystone Learn API and open Permissions.
- You should see
User.Read.AllandGroupMember.Read.All, and no Mail permission.
Turning it off
You're in control. In Enterprise applications → Waystone Learn API, either revoke the permissions or delete the app. Sign-ins and People sync stop straight away. Waystone keeps no secrets or tokens for your tenant, so there is nothing left behind to clean up on our side. Your Waystone data is deleted as described in deletion.
Have a security questionnaire?
Send it over. An engineer who builds Waystone answers it, not a sales team.