You will need an Azure app (Microsoft Entra ID) to assign these permissions. How you create one depends on your deployment method:
All permissions on this page must be configured as Application Permissions.
Moveworks creates an offline index of all users so that we can message end users proactively. We use the Microsoft Graph API to get this information. If you are using Microsoft Teams as the chat platform, the same app ID can be used for all the permissions listed below.
User.Read.All — Allows Moveworks to read all user attributes such as email and Microsoft Entra IDTeamsAppInstallation.ReadWriteSelfForUser.All — Allows Moveworks to install itself for all usersIf you use Microsoft 365 to manage email groups, Moveworks creates an offline index of all groups using the Microsoft Graph API so that all “Add users to distribution list” operations are done instantaneously. If a user creates a distribution list in the bot, Moveworks creates that list and immediately appends it to the day’s index, so users can add members to it right away.
Group.ReadWrite.All — Allows Moveworks to add users to existing Microsoft 365 groups and create new groupsUser.Read.All — Allows Moveworks to read all user attributes such as email and Microsoft Entra IDIf you have an InTune company portal where users can access endpoints to push applications to their devices, Moveworks can serve these links.
DeviceManagementApps.Read.All — Allows Moveworks to read application data for InTune appsSites.Read.All — Allows Moveworks to read pages from SharePoint Online sitesSites.Selected — Allows Moveworks to read pages from selected SharePoint Online sites. See here for more details on how to grant access using Sites.Selected.