Sign in and permissions

Sign in

DockCrate by BufferSol signs you in with a Microsoft work account through Entra. Personal Microsoft accounts are not accepted. Sign in with Microsoft is the intended primary method and is on the roadmap where it is not yet enabled on your account.

Until then you can sign in with an email magic link. The link works once and expires after 10 minutes. You can also add a passkey or an authenticator app for two factor under Settings, then Security.

The 3 Graph permissions

Connecting a tenant asks for 3 application permissions. Here is what each one allows, and what it does not.

DeviceManagementApps.ReadWrite.All: create and update Win32 apps and their assignments in Intune, and read install status. It does not allow changes to device configuration, compliance or policies.

DeviceManagementManagedDevices.Read.All: read managed devices so we can count them for the device meter. It is read only. It does not allow wipe, retire or any other device action.

Group.Read.All: read Entra groups so you can pick your Pilot and Broad groups. It does not allow creating, changing or deleting groups or members.

Roles

Each organization has owner, admin, member and viewer roles. Owners manage billing. Owners and admins manage API keys and webhooks and read the audit log. Members can read them. Viewers have read access to data only.

API keys

Server to server requests use API keys. Create and revoke them in Settings, then API keys. Send the key in the x-api-key header. The full key is shown once. Never put a key in browser code or a public repository. If a key leaks, revoke it and create a new one.

curl https://dockcrate.buffersoltech.com/api/v1/me \
  -H "x-api-key: YOUR_API_KEY"