contacts.read in oauth scope

Technical assistance
1

I want my customers to be able to log in to Zammad with their own Microsoft company account. To do this, I have created a Microsoft app registration “any Entra ID client and personal Microsoft accounts”. It works so far with Zammad, but I don’t understand why “Contacts.Read” is in the scope of the login request. This is an absolute no-go for some customers and I don’t see the need for it. Can I influence the scope?

Infos:

  • Used Zammad version:
  • Used Zammad installation type: docker-compose
  • Operating system: Ubuntu 24.04.2 LTS
  • Browser + version: Chrome 137.0.7151.6

Expected behavior:

No contacts.read in oauth scope

Actual behavior:

I cant influence the scope, contacts.read is always set

Steps to reproduce the behavior:

Just login with microsoft account

2025-06-08_18h06_13
2025-06-08_18h06_13531×700 41 KB

2

Currently, the default scope of the used omniauth-microsoft gem is used.

We could check if, for our authorization use case, this scope is really needed. However, we currently have limited time, and to date, there have been no real complaints about the scope.