Security & privacy
Permissions reference by module
Every application permission and directory role each module requests, with the reason, plus the delegated scopes used during onboarding and sign-in.
- Who can do this
- Everyone
- Plan
- All plans
- Time
- Reference
Module apps (application permissions)
Each module is a separate multi-tenant app with no secrets or certificates. Open a module to see its permissions.
Core (M365 Assessment – Core) · 23 read-only permissions
| Permission | Resource | Why we need it |
|---|---|---|
Directory.Read.All | Microsoft Graph | Users, groups, organization, SKUs, domains, directory roles, apps and service principals; the directory-role check for every module |
Organization.Read.All | Microsoft Graph | Organization, branding, subscriptions |
AuditLog.Read.All | Microsoft Graph | Sign-in activity, sign-in logs, MFA registration details |
SecurityEvents.Read.All | Microsoft Graph | Secure Score (report cover) |
Policy.Read.All | Microsoft Graph | Conditional Access, authentication methods, security defaults, cross-tenant access |
RoleManagement.Read.Directory | Microsoft Graph | PIM eligibility / assignment schedules, role definitions |
IdentityRiskyUser.Read.All | Microsoft Graph | Risky users |
IdentityRiskEvent.Read.All | Microsoft Graph | Risk detections |
IdentityRiskyServicePrincipal.Read.All | Microsoft Graph | Risky service principals |
Agreement.Read.All | Microsoft Graph | Terms of use |
AccessReview.Read.All | Microsoft Graph | Access review definitions |
DirectoryRecommendations.Read.All | Microsoft Graph | Entra recommendations |
OnPremDirectorySynchronization.Read.All | Microsoft Graph | Entra Connect sync configuration |
CrossTenantInformation.ReadBasic.All | Microsoft Graph | Partner tenant names in cross-tenant access |
Synchronization.Read.All | Microsoft Graph | SCIM provisioning jobs |
DeviceManagementManagedDevices.Read.All | Microsoft Graph | Intune managed devices |
DeviceManagementConfiguration.Read.All | Microsoft Graph | Compliance / configuration profiles, update rings |
DeviceManagementApps.Read.All | Microsoft Graph | Intune apps and app protection policies |
DeviceManagementServiceConfig.Read.All | Microsoft Graph | Autopilot, connectors, APNs certificate |
DeviceManagementRBAC.Read.All | Microsoft Graph | Intune multi-admin approval |
DeviceManagementScripts.Read.All | Microsoft Graph | Platform scripts and remediations |
Reports.Read.All | Microsoft Graph | Microsoft 365 usage reports (active users, Copilot usage) |
ReportSettings.Read.All | Microsoft Graph | Whether usage reports conceal user names |
Exchange & Security (M365 Assessment – Exchange & Security) · read-only + Global Reader
| Permission | Resource | Why we need it |
|---|---|---|
Exchange.ManageAsApp | Office 365 Exchange Online | App-only sign-in to Exchange Online / Security & Compliance PowerShell. Grants no rights by itself: the Global Reader role limits it to view-only Get-* cmdlets |
SecurityEvents.Read.All | Microsoft Graph | Secure Score and Secure Score control profiles (Defender chapter) |
SecurityIdentitiesSensors.Read.All | Microsoft Graph | Defender for Identity sensor deployment and health |
Organization.Read.All | Microsoft Graph | Organization and subscribed SKUs (Defender licensing) |
Domain.Read.All | Microsoft Graph | Domain list for DKIM / SPF / DMARC checks |
RoleManagement.Read.Directory | Microsoft Graph | Admin role members (prioritizes admin mailboxes in the inbox-rule scan) |
Plus the built-in Global Reader directory role (view-only), assigned in the wizard’s final step.
SharePoint & OneDrive (M365 Assessment – SharePoint) · read-only
| Permission | Resource | Why we need it |
|---|---|---|
SharePointTenantSettings.Read.All | Microsoft Graph | Tenant sharing settings |
Sites.Read.All | Microsoft Graph | Site inventory and group sites (read-only) |
Reports.Read.All | Microsoft Graph | SharePoint site usage and OneDrive usage reports |
ReportSettings.Read.All | Microsoft Graph | Whether usage reports conceal user names |
GroupMember.Read.All | Microsoft Graph | Microsoft 365 groups and their owners (group-connected sites) |
Microsoft Teams (M365 Assessment – Teams) · read-only + Global Reader
| Permission | Resource | Why we need it |
|---|---|---|
Organization.Read.All | Microsoft Graph | Tenant lookup by Teams PowerShell app-only sign-in |
TeamSettings.Read.All | Microsoft Graph | Team settings (team inventory) |
TeamworkDevice.Read.All | Microsoft Graph | Teams Rooms / phones and device health |
GroupMember.Read.All | Microsoft Graph | Member / owner / guest counts per team |
Channel.ReadBasic.All | Microsoft Graph | Channel counts per team (names only, never messages) |
Plus the built-in Global Reader directory role (view-only).
Power Platform (opt-in) · NOT read-only
| Permission | Resource | Why we need it |
|---|---|---|
Organization.Read.All | Microsoft Graph | Tenant identity check before Power Platform collection |
Plus registration as a Power Platform management application in the wizard’s final step. Microsoft gives management applications Power Platform administrator-level API access and offers no read-only option; M365Assessments only sends read (GET) requests.
SharePoint Advanced (opt-in) · NOT read-only
| Permission | Resource | Why we need it |
|---|---|---|
Sites.FullControl.All | Office 365 SharePoint Online | Write-capable: full control of all site collections. Required by Microsoft for the SharePoint tenant admin settings API. M365Assessments only issues read calls with it |
The onboarding app (delegated only)
M365 Assessment – Onboarding is used only in the wizard's final step, in the administrator's own browser. It has no application permissions, no secret and no certificate, and acts only as the signed-in administrator while they're signed in:
openid,profile,User.Read: sign-in.RoleManagement.ReadWrite.Directory: create the Global Reader assignment as the signed-in admin.Application.Read.All: find the module apps in the tenant.- PowerApps Service
User: register the Power Platform module app (requested only when that module is selected).
Signing in to the portal
Signing in to M365Assessments itself asks only for your basic profile: openid, profile, email and User.Read.
Good to know
Tenants connected before modules existed use one read-only app, M365Assessments Collector, until they upgrade (Legacy tenants).
What we never request
- Any ReadWrite permission or write directory role in the read-only modules.
- Access to email, files, chats, calendars or document contents.
- Global Administrator. The engine warns if a module app holds it; it is never needed.
Last updated