Permissions and Consent

MungePoint signs in through the Microsoft identity platform (Entra ID) using standard OAuth 2.0 with MSAL. This page explains which permissions are requested, which ones Microsoft classifies as needing admin consent, and how your organization stays in control. For deployment detail, ask us for the IT Security & Deployment Guide.

How authentication works

When you click Sign in with Microsoft, your default browser opens the standard Entra ID sign-in page. MFA, Conditional Access and session controls all apply. MungePoint never sees your password.

• By default MungePoint uses Anadak’s multi-tenant public client (application ID 98ac0ad1-9824-492b-89d2-9dc3dde6464a). The first consent in your tenant creates the usual enterprise-application entry for it, which you can find, restrict or remove under Enterprise applications.
• Organizations that prefer to own the registration can register their own public client and point MungePoint at it by machine policy. Your app, your consent, your Conditional Access targeting.
• Permissions are delegated: MungePoint acts only as the signed-in user and can only reach content that user can already reach.

Permissions requested by MungePoint File Manager

Permission	When	Purpose	Admin consent required (Microsoft classification)
User.Read	Sign-in	Show who is signed in	No
Files.Read.All	Sign-in	Browse and search files and libraries you can access	No
Files.ReadWrite.All	Sign-in	Upload, rename, move, copy and delete files when you ask it to	No
SharePoint (delegated)	When used	Recycle bin and SharePoint search	Depends on the SharePoint permission

Other MungePoint editions request additional permissions for their features; each edition’s IT guide lists them.

Note

“No” means Microsoft lets users consent to the permission themselves. Your tenant’s consent policy can still require an administrator, for example when user consent is turned off or limited to verified publishers and low-impact permissions.

Admin consent

An administrator may need to consent when:

1. Your tenant restricts user consent. Users then see a “Need admin approval” screen and can request approval if your admin consent workflow is enabled.
2. You require user assignment on the enterprise application. Microsoft requires admin consent for apps with assignment required.

How to grant admin consent

1. Open the Entra admin center at entra.microsoft.com.

2. Check Identity > Applications > Enterprise applications > Admin consent requests for a pending request from MungePoint.

3. Or sign in to MungePoint as an administrator and, at the consent prompt, select Consent on behalf of your organization.

4. Optional: under the MungePoint enterprise application’s Properties, set Assignment required to Yes and assign the users or groups who may use it.

Service-account sign-in

MungePoint can also sign in with an app registration you create and a client secret (application permissions you grant), for unattended or administrative use. This mode is optional. Administrators can disable it by machine policy.

Token handling

• Sign-in tokens are cached in a file encrypted with Windows DPAPI for the signed-in Windows user (macOS: Keychain).
• Tokens are never stored in plain text, in configuration files, or in MungePoint’s local database.
• To revoke access, remove the consent grant or disable the MungePoint enterprise application in Entra ID. MungePoint can then no longer obtain new tokens; tokens already issued expire on their own, typically within about an hour.
• Signing out of MungePoint removes the signed-in account’s tokens from that device. Other saved accounts stay cached until you sign out of them.