AccessReview.Read.All | Read all access reviews | 2: E5 Value Realisation, Access Review Health |
AdministrativeUnit.Read.All | Read all administrative units | 1: Custom Roles & Administrative Units |
AgentIdentity.Read.All | Read all agent identities | 2: AI Agent Identity Inventory, AI Agent Inventory |
AgentIdentityBlueprint.Read.All | Read all agent identity blueprints | No report lists it (used by the app or optional) |
Agreement.Read.All | Read all terms of use agreements | 1: Terms of Use Acceptance |
AgreementAcceptance.Read.All | Read all terms of use acceptance statuses | 1: Terms of Use Acceptance |
Application.Read.All | Read all applications | 24: AI Agent Identity Inventory, App Credential Restriction Policies, Privilege Escalation through App Ownership, App Proxy Apps Published without Pre-authentication, Enterprise Apps Open to Every User, Workload Identity Federation Trusts, … |
AttackSimulation.Read.All | Read attack simulation data of an organization | 2: E5 Value Realisation, Phishing Simulation Results |
AuditLog.Read.All | Read all audit log data | 44: AI Agent Identity Inventory, PIM Activation Patterns (30 days), Azure Management Sign-ins after Mandatory MFA, Conditional Access Change History with Diff (30 days), Movers: Access Kept after a Department Change, Partner (CSP / GDAP) Admin Sign-ins (30 days), … |
AuditLogsQuery.Read.All | Read audit logs data from all services | 3: Inactive SharePoint Users (90 days), Admin Actions Outside Business Hours (7 days), Mass Download & Deletion Activity (7 days) |
BackupRestore-Configuration.Read.All | Read all backup configuration policies | 1: Microsoft 365 Backup Coverage |
BackupRestore-Configuration.ReadWrite.All | Read and edit all backup configuration policies | 1: Microsoft 365 Backup Coverage |
BitlockerKey.ReadBasic.All | Read all BitLocker keys basic information | 2: Devices with uploaded Bitlocker Keys, Windows LAPS & BitLocker Escrow Gaps |
Bookings.Read.All | Read all Bookings related resources | 1: Bookings Pages Exposure |
Calendars.ReadBasic.All | Read basic details of calendars in all mailboxes | 1: Meeting Room Utilisation (30 days) |
CallRecords.Read.All | Read all call records | 2: Teams Phone Numbers & Calling Licence Usage, PSTN Usage & Direct Routing Failures (30 days) |
Channel.ReadBasic.All | Read the names and descriptions of all channels | 2: Teams App Inventory, Shared Channels with External Members |
ChannelMember.Read.All | Read the members of all channels | 2: Teams App Inventory, Shared Channels with External Members |
CloudApp-Discovery.Read.All | Read all discovered cloud applications data | 1: Shadow SaaS from Defender for Cloud Apps (30 days) |
CloudPC.Read.All | Read Cloud PCs | 2: Windows 365 Connection Quality (7 days), Windows 365 Cloud PC Inventory |
ConfigurationMonitoring.Read.All | Read all Configuration Monitoring entities | 1: Tenant Configuration Drift |
ConsentRequest.Read.All | Read all consent requests | 1: Pending Admin Consent Requests |
CopilotPackages.Read.All | Read all packages information | 2: AI Agent Inventory, Copilot Agents & Apps Catalogue |
CrossTenantInformation.ReadBasic.All | Read cross-tenant basic information | 3: Cross-tenant Synchronisation & Multi-tenant Organisation, Partner (CSP / GDAP) Admin Sign-ins (30 days), Cross-tenant Access & B2B Trust |
Device.Read.All | Read all devices | 10: All Devices, Devices with uploaded Bitlocker Keys, All Devices by User, Disabled Entra Devices - PREVIEW, Duplicate Devices Entra ID - PREVIEW, Duplicate Devices Entra ID by Device Name - PREVIEW, … |
DeviceLocalCredential.ReadBasic.All | Read device local credential properties | 1: Windows LAPS & BitLocker Escrow Gaps |
DeviceManagementApps.Read.All | Read Microsoft Intune apps | 12: Group Usage Finder - Is This Group Used Anywhere?, All Intune Apps, All Intune Apps for Android, All Intune Apps for iOS, All Intune Apps for Linux, All Intune Apps for MacOS, … |
DeviceManagementConfiguration.Read.All | Read Microsoft Intune device configuration and policies | 17: Group Usage Finder - Is This Group Used Anywhere?, Windows Update Compliance, All Endpoint Security Policies, Compliance Failures by Setting, Configuration Profile Deployment Errors, Remediation & Platform Script Failures, … |
DeviceManagementManagedDevices.Read.All | Read Microsoft Intune devices | 38: Intune Licence Compliance, Leaver Clean-up Completeness, New-starter Onboarding Completeness, All Intune Devices, Intune Devices - Android, Intune Compliance Posture, … |
DeviceManagementRBAC.Read.All | Read Microsoft Intune RBAC settings | 2: Intune Multi Admin Approval Coverage, Intune RBAC & Scope |
DeviceManagementScripts.Read.All | Read Microsoft Intune Scripts | 2: Remediation & Platform Script Failures, Secure Boot Certificate Update Readiness |
DeviceManagementServiceConfig.Read.All | Read Microsoft Intune configuration | 5: Apple ADE Devices Never Enrolled, Intune Connector & Integration Health, Apple MDM Certificate & Token Expiry, Intune Tenant Hygiene, Match Devices From Entra to Intune to Autopilot |
Directory.Read.All | Read directory data | 10: Enterprise Apps Open to Every User, Password Protection & Smart Lockout Settings, Microsoft 365 Group Governance Settings, Azure Management Sign-ins after Mandatory MFA, Licence Reclamation Candidates, OAuth Consent Grants, … |
DirectoryRecommendations.Read.All | Read all Azure AD recommendations | 1: Microsoft Entra Recommendations |
Domain.Read.All | Read domains | 4: UPN, E-mail & Proxy Address Mismatches, Domain Federation & Trust Audit, Exchange Online Transport Rules With External Recipients, External Forwarding Rules On Mailbox Level |
EntitlementManagement.Read.All | Read all entitlement management resources | 3: Access Package Assignment Health, Contractors & Externals without an End Date, Group Usage Finder - Is This Group Used Anywhere? |
Files.Read.All | Read files in all site collections | 1: Recently Modified SharePoint Files (search: ‘Documents’) |
Group.Read.All | Read all groups | 37: Multi-geo Data Location, PIM for Groups - Standing & Eligible Access, Entra ID Roles - Privileged Role Members, Deleted Sites & Groups Nearing Permanent Purge, Group Usage Finder - Is This Group Used Anywhere?, Entra ID Groups, … |
GroupMember.Read.All | Read all group memberships | 4: User Access 360, Movers: Access Kept after a Department Change, User Excessive Group Membership (10), Entra User Licence Assignment Direct vs. Inherited |
IdentityProvider.Read.All | Read identity providers | 1: B2B Identity Providers & One-time Passcode |
IdentityRiskEvent.Read.All | Read all identity risk event information | 2: Risk Detections, Risky Users & Risk Detections |
IdentityRiskyServicePrincipal.Read.All | Read all identity risky service principal information | 1: Risky Workload Identities |
IdentityRiskyUser.Read.All | Read all identity risky user information | 2: Risky Users & Risk Detections, Users Restricted from Sending |
InformationProtectionPolicy.Read.All | Read all published labels and label policies for an organization | 1: E5 Value Realisation |
LifecycleWorkflows.Read.All | Read all lifecycle workflows resources | 1: Lifecycle Workflow Failures (30 days) |
Mail.Read | Read mail in all mailboxes | 1: Emails With Large Attachments (over 10 MB) - PREVIEW |
MultiTenantOrganization.Read.All | Read all multi-tenant organization details and tenants | 1: Cross-tenant Synchronisation & Multi-tenant Organisation |
NetworkAccess.Read.All | Read all network access information | 1: Global Secure Access Health |
NetworkAccessPolicy.Read.All | Read all security and routing policies for network access | 1: Global Secure Access Health |
OnPremDirectorySynchronization.Read.All | Read all on-premises directory synchronization information | 1: Hybrid Sync Health |
OnPremisesPublishingProfiles.ReadWrite.All | Manage on-premises published resources | 2: App Proxy Apps Published without Pre-authentication, Application Proxy Connector Health |
Organization.Read.All | Read organization information | 24: Certificate-based Authentication - Trusted CAs, Entra ID Groups with Licences containing disabled products (plans), Entra ID Groups with Licences, Add-on Licences with No Product Sign-in (30 days), Microsoft 365 Apps Activations & Desktop Right-sizing, Copilot Licence Candidates, … |
Place.Read.All | Read all company places | 1: Meeting Room Utilisation (30 days) |
Policy.Read.All | Read your organization’s policies | 23: Named Locations & Trusted IP Audit, CA Policies, App Credential Restriction Policies, Authentication Strengths - What They Really Allow, B2B Identity Providers & One-time Passcode, Cross-tenant Synchronisation & Multi-tenant Organisation, … |
Policy.Read.ConditionalAccess | Read your organization’s conditional access policies | 1: Authentication Contexts - Are They Enforced? |
Policy.Read.DeviceConfiguration | Read your organization’s device configuration policies | 1: Device Registration & Join Settings |
PrivilegedAssignmentSchedule.Read.AzureADGroup | Read assignment schedules for access to Azure AD groups | 1: PIM for Groups - Standing & Eligible Access |
PrivilegedEligibilitySchedule.Read.AzureADGroup | Read eligibility schedules for access to Azure AD groups | 1: PIM for Groups - Standing & Eligible Access |
PublicKeyInfrastructure.Read.All | Read all certificate based authentication configurations | 1: Certificate-based Authentication - Trusted CAs |
Reports.Read.All | Read all usage reports | 8: Microsoft 365 Apps Activations & Desktop Right-sizing, Copilot Licence Adoption, Copilot Licence Candidates, Microsoft 365 Adoption by Department, Frontline Licence Entitlement Breaches, Licence vs Actual Service Usage, … |
RoleManagement.Read.Directory | Read all directory RBAC settings | 18: Privilege Escalation through App Ownership, Authentication Contexts - Are They Enforced?, PIM Role Settings Audit, Entra ID Roles, Entra ID Roles - Privileged Role Members, Custom Roles & Administrative Units, … |
RoleManagementPolicy.Read.Directory | Read all policies for privileged role assignments of your company’s directory | 2: Authentication Contexts - Are They Enforced?, PIM Role Settings Audit |
SecurityAlert.Read.All | Read all security alerts | 1: Defender Alerts |
SecurityEvents.Read.All | Read your organization’s security events | 1: Secure Score & Top Improvement Actions |
SecurityIdentitiesHealth.Read.All | Read all identity security health issues | 1: Defender for Identity Sensor Health |
SecurityIdentitiesSensors.Read.All | Read all identity security sensors | 1: E5 Value Realisation |
SecurityIncident.Read.All | Read all security incidents | 1: Security Alerts & Incidents |
ServiceHealth.Read.All | Read service health | 2: Service Health & Message Centre, Service Status |
ServiceMessage.Read.All | Read service messages | 1: Message Centre |
Sites.FullControl.All | Have full control of all site collections | No report lists it (used by the app or optional) |
Sites.Read.All | Read items in all site collections | 2: All Document Libraries, Recently Modified SharePoint Files (search: ‘Documents’) |
SubjectRightsRequest.Read.All | Read all subject rights requests | 1: Data Subject Requests Due (Priva) |
Synchronization.Read.All | Read all Azure AD synchronization data | 1: App Provisioning (SCIM) Job Health |
TeamsAppInstallation.ReadForTeam.All | Read installed Teams apps for all teams | 2: Teams App Inventory, Shared Channels with External Members |
TeamworkDevice.Read.All | Read Teams devices | 1: Teams Rooms & Teams Devices Health |
ThreatHunting.Read.All | Run hunting queries and read shared saved hunting queries | 6: E5 Value Realisation, Browser Extensions & Their Permissions, Device Hardening Gaps (Secure Configuration Assessment), Malicious-link Clicks & Mail ZAP Did Not Remove (30 days), Removable Storage (USB) Activity (30 days), Exposed Devices & Exploitable Vulnerabilities |
ThreatSubmission.Read.All | Read all of the organization’s threat submissions | 1: User-reported Phishing Backlog |
User-LifeCycleInfo.Read.All | Read all users’ lifecycle information | 61: CA Policies, Contractors & Externals without an End Date, Joiners & Leavers Trend (12 months), Entra ID Groups with Disabled Members, Entra ID Groups with Left / Expired Members, Entra ID Groups Containing Guests, … |
User.Read.All | Read all users’ full profiles | 89: CA Policies, UPN, E-mail & Proxy Address Mismatches, B2B Identity Providers & One-time Passcode, Domain Federation & Trust Audit, Manager Chain Integrity, Multi-geo Data Location, … |
UserAuthenticationMethod.Read.All | Read all users’ authentication methods | 5: New-starter Onboarding Completeness, Service Accounts Disguised as Users, Security Defaults & Per-user MFA Leftovers, Security Key & Passkey Inventory, Phone Numbers Shared Across MFA Registrations |
WindowsUpdates.Read.All | Read all Windows update deployment settings | 1: Windows Known Issues Affecting Our Builds |
eDiscovery.Read.All | Read all eDiscovery objects | 2: E5 Value Realisation, Open eDiscovery Cases & Legal Holds |
