Every permission, and why we need it.
The Agentscopic app in your tenant can only read. It asks for no permission that can create, change or delete anything, and our tests stop any release that would. Here is what it reads and what for.
For every customer
| Permission | What it reads | Why |
|---|---|---|
| Directory.Read.All | Users, groups, roles, devices, organisation | Almost every identity and agent check |
| Policy.Read.All | Conditional Access and authentication policies | Checks that your sign-in rules match who has access |
| AuditLog.Read.All | Sign-in activity and audit logs | Dormant accounts and inactive agents |
| RoleManagement.Read.All | Admin role definitions and assignments | Who holds admin rights |
| RoleEligibilitySchedule.Read.Directory | Who can activate an admin role | Standing versus eligible admin rights |
| RoleManagementAlert.Read.Directory | Privileged Identity Management alerts | Admin-role warnings |
| Application.Read.All | App registrations, enterprise apps, owners, credentials | Apps and agents nobody owns, hidden admin paths |
| AccessReview.Read.All | Access reviews and decisions | Whether access is re-certified |
| User-LifeCycleInfo.Read.All | Hire and leave dates | People whose leave date has passed |
| EntitlementManagement.Read.All | Access packages and policies | Microsoft 365 governance checks |
| OnPremDirectorySynchronization.Read.All | Entra Connect sync settings | Hybrid identity checks |
| DirectoryRecommendations.Read.All | Microsoft's own Entra recommendations | Microsoft 365 checks |
| OrgSettings-AppsAndServices.Read.All, OrgSettings-Forms.Read.All | Microsoft 365 app and Forms settings | Microsoft 365 checks |
| ReportSettings.Read.All, Reports.Read.All | Usage report settings and usage reports | Licence and Exchange checks |
| IdentityRiskEvent.Read.All | Risk notification settings | One Microsoft 365 check |
| AgentIdentity.Read.All, AgentIdentityBlueprint.Read.All, AgentIdentityBlueprintPrincipal.Read.All, IdentityRiskyAgent.Read.All | AI agents, their blueprints and risk | The agent register. Left out if you don't want agent checks. |
- Directory.Read.All
- Users, groups, roles, devices, organisation
- Almost every identity and agent check
- Policy.Read.All
- Conditional Access and authentication policies
- Checks that your sign-in rules match who has access
- AuditLog.Read.All
- Sign-in activity and audit logs
- Dormant accounts and inactive agents
- RoleManagement.Read.All
- Admin role definitions and assignments
- Who holds admin rights
- RoleEligibilitySchedule.Read.Directory
- Who can activate an admin role
- Standing versus eligible admin rights
- RoleManagementAlert.Read.Directory
- Privileged Identity Management alerts
- Admin-role warnings
- Application.Read.All
- App registrations, enterprise apps, owners, credentials
- Apps and agents nobody owns, hidden admin paths
- AccessReview.Read.All
- Access reviews and decisions
- Whether access is re-certified
- User-LifeCycleInfo.Read.All
- Hire and leave dates
- People whose leave date has passed
- EntitlementManagement.Read.All
- Access packages and policies
- Microsoft 365 governance checks
- OnPremDirectorySynchronization.Read.All
- Entra Connect sync settings
- Hybrid identity checks
- DirectoryRecommendations.Read.All
- Microsoft's own Entra recommendations
- Microsoft 365 checks
- OrgSettings-AppsAndServices.Read.All, OrgSettings-Forms.Read.All
- Microsoft 365 app and Forms settings
- Microsoft 365 checks
- ReportSettings.Read.All, Reports.Read.All
- Usage report settings and usage reports
- Licence and Exchange checks
- IdentityRiskEvent.Read.All
- Risk notification settings
- One Microsoft 365 check
- AgentIdentity.Read.All, AgentIdentityBlueprint.Read.All, AgentIdentityBlueprintPrincipal.Read.All, IdentityRiskyAgent.Read.All
- AI agents, their blueprints and risk
- The agent register. Left out if you don't want agent checks.
Only if you use these products
| Group | Permissions | Why |
|---|---|---|
| Intune | Four DeviceManagement read permissions | Intune configuration and compliance checks |
| Global Secure Access | NetworkAccess.Read.All | Global Secure Access settings |
| Defender for Identity | SecurityIdentitiesHealth.Read.All | Sensor health |
| Defender XDR | ThreatHunting.Read.All | Advanced checks that need Defender XDR |
- Intune
- Four DeviceManagement read permissions
- Intune configuration and compliance checks
- Global Secure Access
- NetworkAccess.Read.All
- Global Secure Access settings
- Defender for Identity
- SecurityIdentitiesHealth.Read.All
- Sensor health
- Defender XDR
- ThreatHunting.Read.All
- Advanced checks that need Defender XDR