Admin Consent Details
Why do we need all these permissions?
These permissions are delegated permissions that Altus needs to function while the user is present, and it acts as a filter for what Altus and the end-user can do together interactively. A more detailed description of the use case for each requested permission is included below.
Sign in and read user profile
Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users.
- Authenticates users when signing into the Altus Hub administration portal and the Altus Desktop Add-in for Microsoft Project.
- Reads the signed-in user's display name, email address, and basic profile to personalise the Altus experience.
- Establishes the user identity context required by all other Altus services to perform actions on behalf of the user.
Access Common Data Service as organization users
Allows the application to access Common Data Service acting as users in the organization.
Why we need this:
- Enables all Dynamics 365 plugin operations including project creation, task management, financial tracking, and status updates.
- Allows the schedule integration assembly to synchronise project plans between Microsoft Project (MPP) files and Dynamics 365.
- Supports the data ingestion assembly for bulk importing and processing project data into Dataverse.
- Enables the Altus Desktop Add-in to connect to Dynamics 365 instances for reading and writing project schedule data.
- Powers the Altus Hub backend to manage tenant configurations, partner associations, and Dynamics instance operations.
Have full access to user files
Allows the app to read, create, update and delete the signed-in user's files.
Why we need this:
- Allows the Team Project Documents control to create files and folders stored in a project's SharePoint document library or Teams channel.
- Enables the Altus Desktop Add-in to read and upload Microsoft Project files from the user's OneDrive for schedule synchronisation.
- Allows retrieval of file metadata (timestamps, size) when managing project documents through the desktop experience.
Read and write all groups
Allows the app to create groups and read all group properties and memberships on behalf of the signed-in user. Additionally allows group owners to manage their groups and allows group members to update group content.
Why we need this:
- Allows Altus to create Microsoft 365 Groups for projects, with naming policy validation against the organisation's directory policies.
- Enables adding and removing members and owners from a project's Microsoft 365 Group via the Entity Group Owner control.
- Supports creating Microsoft Planner plans linked to a project's Microsoft 365 Group for task management integration.
- Provides the group search and auto-suggest functionality when associating an existing Microsoft 365 Group with a project.
- Enables reading group metadata (display name, visibility, classification) used to display group information on project forms.
Read all users' full profiles
Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.
Why we need this:
- Retrieves the reporting manager for resources to support organisational hierarchy display in the Resource Plan control.
- Enables searching for users by name or email to add as Global Admins or Partner Admins in the Altus Hub administration portal.
- Allows reading of user properties such as job title and business phones when displaying group member details on project forms.
Read reports
Allows reading reports on the user’s behalf.
Why we need this:
- Powers the embedded Power BI reporting experience inside the Altus PowerApp, allowing reading the list of reports accessible to the user.
Access the PowerApps Service API
Accesses all routes in the PowerApps Service API.
Why we need this:
- Supports integration with Power Automate flows that automate business processes triggered by Altus project events.
- Enables the Altus Hub to interact with the Power Platform for managing environment configurations and solution deployment operations.
Have full access to all files user can access
Allows the app to read, create, update and delete all files the signed-in user can access.
Why we need this:
- Powers the Team Project Documents control to browse and display files stored in a project's SharePoint document library or Teams channel.
- Enables uploading project documents directly to SharePoint or OneDrive folders from within the Dynamics 365 project form.
- Supports creating folder structures and applying custom folder tags to organise project documents by category.
- Allows navigating SharePoint subsites and resolving SharePoint URLs to access document libraries linked to projects.
- Enables browsing Microsoft Teams channel file folders to view and manage documents shared within a project's team.
Read all users' basic profiles
Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo.
Why we need this:
- Displays user profile photos as avatars for assigned resources in the Timesheet, Schedule, and Resource Plan grids.
- Shows profile pictures for team members listed in the Entity Group Owner control on project forms.
- Enables the people picker search to find and display users by name or email when assigning resources or team members.
Read group memberships
Allows the app to list groups, read basic group properties and read membership of all groups the signed-in user has access to.
Why we need this:
- Determines user access levels (Global Admin, Partner Admin, Partner User) in the Altus Hub by checking membership against configured security groups.
- Lists the Microsoft 365 Groups a user is a member of or owns, used when selecting a group to associate with a project.
- Supports searching and selecting security groups for permission assignment in the Altus Hub administration pages.
- Caches group membership results to minimise API calls during repeated authorisation checks within a user session.
Enterprise Application Details
The combined consents will create the following Enterprise Applications and grant them necessary permissions. Optional direct consent links are also provided for advanced use cases:
| Source Directory | Application | Purpose | Optional Direct Consent |
|---|---|---|---|
| Altus |  Altus |
Parent Principal | |
| Altus |  Altus Deployment |
Deployment and update delivery | Altus Deployment - Admin Consent |
| Altus |  Altus Applications |
Altus for Teams and Altus Power App | Altus Applications - Admin Consent |
| Altus |  Altus for Project |
Altus for Project, Project Desktop add-in | Altus for Project - Admin Consent |
| Altus |  Altus for Word |
Altus for Word, Word add-in | Altus for Word - Admin Consent |
| Altus |  Altus for Excel (Preview) |
Altus for Excel (preview) add-in | Altus for Excel - Admin Consent |
| Altus |  Altus Hub |
SSO for self-service update deployment control | Altus Hub - Admin Consent |
| Sensei (Legacy) | Altus (Sensei) |
Parent Principal | |
| Sensei (Legacy) | Altus Applications |
Altus for Teams and Altus Power App | Altus Applications - Admin Consent |
| Sensei (Legacy) | Altus for Project |
Altus for Project, Project Desktop add-in | Altus for Project - Admin Consent |
| Sensei (Legacy) | Altus for Word |
Altus for Word, Word add-in | Altus for Word - Admin Consent |