Prepare NIM connector permissions

Integration preparation

Give each NIM connector only the access it needs, then prove the connection and one safe operation before automating at scale.

At a glance

NIM connector permissions are specific to the connected system and the operations your workflow performs. There is no single service account or permission list that is safe for every connector. Use the selected connector's configuration guide as the source of truth, grant the least access that supports the required collection and target operations, test the connection, collect data, and verify one limited change before scheduling a job.

Identify the connector's required access

Before creating credentials, write down what NIM must do in the connected system:

• collect users, groups, devices, licenses, or other source data;
• create, update, disable, delete, or restore target records;
• manage group membership, licenses, or other entitlements; and
• use a certificate, service account, application registration, API key, or delegated authorization method.

The connector's guide defines the supported operations and its exact setup requirements. Do not grant a broad administrative role merely to make an initial test succeed when a narrower documented permission set is available.

Prepare the account or application

Use a connector-specific identity that can be reviewed and rotated independently of an administrator's personal account. Store certificates, keys, and secrets using your organization's approved process. Record the account or application owner, the connector it supports, its required permissions, and its renewal or rotation date.

When a connector uses an application registration or domain-wide delegation, confirm that an authorized administrator has completed the required consent. When it uses a Windows service account, confirm that the NIM Service is assigned to that account and that the account has the required delegated rights in the target scope.

Validate in a safe order

1. Follow the selected connector's connection guide exactly, including certificates, application IDs, tenant IDs, scopes, or delegated rights.
2. Run Test Connection in the NIM system configuration.
3. Collect the system and inspect the tables and attributes required by the workflow.
4. Test a single non-production or otherwise safe record through the required mapping or role operation.
5. Review the job result and the target-system result before scheduling recurring automation.

If collection succeeds but a target operation fails, the connector may have enough read access but not the write permission required for that operation. Review the failed operation, the target scope, and the connector-specific permissions rather than increasing access across the whole tenant or directory.

Connector-specific guides

• Microsoft Entra ID — app registration, Microsoft Graph application permissions, certificate authentication, and administrator consent.
• Microsoft Active Directory — managed service account preparation and delegated Active Directory access.
• Google Workspace — service account, domain-wide delegation, OAuth scopes, and administrator roles.
• All integrations — select the connected system to find its own connection guide and supported operations.

When a permission error occurs

Keep the connector identity unchanged while you diagnose the issue. First confirm the failing operation, then check its NIM job result and target-system error. Verify that the connector identity has the documented access for that exact operation and target scope. Retest a single safe record after the correction. For an end-to-end diagnostic path, see Troubleshoot NIM provisioning failures.