--- title: Required Admin Consent for CyberGate slug: required-admin-consent-for-cybergate createdAt: 2026-06-18T08:08:51.284Z --- CyberGate is a Software as a Service (SaaS) solution that sets up calls between Microsoft Teams users and connected Session Initiation Protocol (SIP) devices. It can only do this after an administrator has granted **Admin Consent** for the permissions CyberGate needs in your tenant. This page lists those permissions, what each one does, and why CyberGate requires it. ### Permissions requested by CyberGate For CyberGate to be able to call users, the following permissions must be granted to CyberGate. Each one maps to a specific CyberGate capability; without it, the related feature cannot function. | Permission | Display name | Description | Reason | | ----------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | Calls.AccessMedia.All | Access media streams in a call as an app | Allows the app to get direct access to media streams in a call, without a signed-in user. | Access to the media of the Teams call is required to send it to the SIP device and vice-versa. | | Calls.Initiate.All | Initiate outgoing 1 to 1 calls from the app | Allows the app to place outbound calls to a single user and transfer calls to users in your organization's directory, without a signed-in user. | Enables CyberGate to set up a call to a Teams user. | | Calls.JoinGroupCall.All | Join group calls and meetings as an app | Allows the app to join group calls and scheduled meetings in your organization, without a signed-in user. The app will be joined with the privileges of a directory user to meetings in your organization. | The CyberGate 'Meeting' feature needs to be able to join an existing meeting. | | GroupMember.Read.All | Read all group memberships | Allows the app to read memberships and basic group properties for all groups without a signed-in user. | Log in to the portal based on group membership. | | User.ReadBasic.All | Read all users' basic profiles | Allows the app to read a basic set of profile properties of other users in your organization without a signed-in user. Includes display name, first and last name, email address, open extensions, and photo. | CyberGate needs to look up users in the tenant Microsoft Entra ID (formerly Azure Active Directory) to find the matching Teams user to call. | *** ### Why the portal asks you to update consent CyberTwice reviews the permissions CyberGate asks for and removes any that are no longer needed. Over time this has made the required set smaller than it used to be. Microsoft Entra ID, however, stores the permissions your organization consented to **at the moment consent was given**. When CyberTwice stops asking for a permission, that does not shrink a grant that already exists in your tenant. The older, broader set stays in place until an administrator grants consent again. For that reason CyberGate compares the permissions actually granted in your tenant against the set it needs today. If your tenant still holds permissions CyberGate no longer uses, the **'Consent'** tab under **Basic** → **Global** in the CyberGate Management Portal shows a warning instead of the usual 'Admin consent has been provided for this tenant' message. For example: :::hint{type="warning"} *The permissions that CyberGate service requires have been reduced since your organization gave consent. The 'User.Read.All' permission has been replaced with the new and much more restricted 'User.ReadBasic.All' permission. CyberTwice strongly recommends consenting to this reduced set of permissions.* ::: This is not an error, and nothing is broken: CyberGate keeps working normally. The warning is a request to bring your tenant's grant back in line with what CyberGate actually needs. **Why you should act on it** - **Least privilege.** A permission that is granted can be used. Keeping a permission that CyberGate does not use gives the CyberGate service principal access to data and actions it has no reason to touch. - **Smaller impact if something goes wrong.** If the CyberGate application were ever compromised, the damage is bounded by what your tenant granted it — not by what CyberGate uses. Trimming the grant shrinks that boundary. - **Cleaner security reviews and audits.** Broad application permissions such as `User.Read.All` and `Domain.Read.All` are routinely flagged in Entra ID permission reviews, CIS/ISO audits and customer security questionnaires. Removing them takes the finding away instead of having to justify it. - **Nothing is lost.** The permissions being dropped are ones the CyberGate service no longer needs, either because a narrower permission replaced them or because the information is now read on behalf of the administrator who is signed in. Updating consent does not disable any CyberGate feature. *** ### Permissions CyberGate no longer needs If your organization consented to CyberGate some time ago, your tenant may still hold one or more of the permissions below. These are the permissions the warning refers to. | Permission | What changed | | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **User.Read.All** | Replaced by the much more restricted **User.ReadBasic.All**. CyberGate only needs a user's basic profile to find the matching Teams user to call; `User.Read.All` additionally exposes the full profile of every user in the tenant. | | **Domain.Read.All** | Still needed information, obtained a different way. CyberGate needs to know which domains are verified in your tenant, but the CyberGate service no longer looks them up itself. The Management Portal now reads them while an administrator is signed in, using that administrator's own sign-in permissions, and passes them on to CyberGate. The CyberGate service therefore no longer needs standing permission to read your tenant's domain configuration, and nothing reads it when nobody is signed in to the portal. | *** ### How to update the admin consent Updating consent replaces the existing grant with the current, smaller set of permissions. It requires a **global administrator** of your organization. 1. Sign in to the CyberGate Management Portal as a global administrator. 2. Go to **Basic** → **Global** and open the **'Consent'** tab. 3. Click **'Update admin consent'**. You are redirected to Microsoft to grant the access rights. 4. Review the requested permissions, this is the reduced set listed in 'Permissions requested by CyberGate' above, and approve them on behalf of your organization. 5. You are returned to the CyberGate Management Portal. The **'Consent'** tab now shows *'Admin consent has been provided for this tenant'* and the warning is gone.