Use tenant-approved Microsoft Graph application permissions to discover users and groups, preview eligibility and create controlled invitations.
Varajen Time connects collection, policy, coverage, review and deployment controls so teams can understand both the metric and the evidence behind it.
The customer creates a single-tenant Entra application, grants User.Read.All and Group.Read.All application permissions, provides admin consent and stores the credential in approved secret storage.
Connection and discovery remain separate. Administrators review eligible directory records before creating Varajen invitations.
Existing members match by normalized email; existing members, pending invitations, disabled accounts and users without a valid email are skipped.
Imported roles are restricted to employee or manager. Directory import cannot assign or overwrite owner or administrator access.
A missing or disabled directory record does not automatically delete historical Varajen time or telemetry.
Configuration, connection tests, previews and imports produce tenant-scoped audit evidence and synchronization results.
