Required Permissions & Roles
Optimize365 uses two Microsoft 365 app registrations — one for read-only scanning and one for remediation. Each app requires a specific set of API permissions and Microsoft Entra roles.
Read-Only App (Optimize365-ReadOnly)
Used for security scanning and compliance analysis.
API Permissions
| Permission | API | Permission type |
|---|---|---|
| Directory.Read.All | Microsoft Graph | Application |
| Application.Read.All | Microsoft Graph | Application |
| AppCatalog.Read.All | Microsoft Graph | Application |
| AuditLog.Read.All | Microsoft Graph | Application |
| AuditLogsQuery-Exchange.Read.All | Microsoft Graph | Application |
| AuditLogsQuery-SharePoint.Read.All | Microsoft Graph | Application |
| Reports.Read.All | Microsoft Graph | Application |
| Policy.Read.All | Microsoft Graph | Application |
| Domain.Read.All | Microsoft Graph | Application |
| Group.Read.All | Microsoft Graph | Application |
| Organization.Read.All | Microsoft Graph | Application |
| User.Read.All | Microsoft Graph | Application |
| User.ReadBasic.All | Microsoft Graph | Application |
| UserAuthenticationMethod.Read.All | Microsoft Graph | Application |
| UserAuthMethod-Passkey.Read.All | Microsoft Graph | Application |
| RoleManagement.Read.All | Microsoft Graph | Application |
| RoleManagement.Read.Exchange | Microsoft Graph | Application |
| PrivilegedAccess.Read.AzureAD | Microsoft Graph | Application |
| PrivilegedAccess.Read.AzureADGroup | Microsoft Graph | Application |
| PrivilegedAccess.Read.AzureResources | Microsoft Graph | Application |
| SecurityEvents.Read.All | Microsoft Graph | Application |
| SecurityActions.Read.All | Microsoft Graph | Application |
| ThreatAssessment.Read.All | Microsoft Graph | Application |
| InformationProtectionPolicy.Read.All | Microsoft Graph | Application |
| SharePointTenantSettings.Read.All | Microsoft Graph | Application |
| Sites.Read.All | Microsoft Graph | Application |
| TermStore.Read.All | Microsoft Graph | Application |
| TeamSettings.Read.All | Microsoft Graph | Application |
| MailboxSettings.Read | Microsoft Graph | Application |
| Device.Read.All | Microsoft Graph | Application |
| DeviceManagementManagedDevices.Read.All | Microsoft Graph | Application |
| DeviceManagementApps.Read.All | Microsoft Graph | Application |
| DeviceManagementConfiguration.Read.All | Microsoft Graph | Application |
| DeviceManagementServiceConfig.Read.All | Microsoft Graph | Application |
| ServiceHealth.Read.All | Microsoft Graph | Application |
| ServiceMessage.Read.All | Microsoft Graph | Application |
| ServiceActivity-Exchange.Read.All | Microsoft Graph | Application |
| OrgSettings-AppsAndServices.Read.All | Microsoft Graph | Application |
| OrgSettings-Forms.Read.All | Microsoft Graph | Application |
| MultiTenantOrganization.Read.All | Microsoft Graph | Application |
| Sites.FullControl.All | SharePoint Online | Application |
| Exchange.ManageAsApp | Exchange Online | Application |
| EopPolicySync.AccessAsApp | Exchange Online Protection | Application |
Entra Roles
| Role |
|---|
| Global Reader |
Write App (Optimize365-Write)
Used for automated remediation.
API Permissions
| Permission | API | Permission type |
|---|---|---|
| Directory.Read.All | Microsoft Graph | Application |
| Application.Read.All | Microsoft Graph | Application |
| AppCatalog.Read.All | Microsoft Graph | Application |
| AuditLog.Read.All | Microsoft Graph | Application |
| AuditLogsQuery-Exchange.Read.All | Microsoft Graph | Application |
| AuditLogsQuery-SharePoint.Read.All | Microsoft Graph | Application |
| Reports.Read.All | Microsoft Graph | Application |
| Policy.Read.All | Microsoft Graph | Application |
| Domain.Read.All | Microsoft Graph | Application |
| Group.Read.All | Microsoft Graph | Application |
| Organization.Read.All | Microsoft Graph | Application |
| User.Read.All | Microsoft Graph | Application |
| User.ReadBasic.All | Microsoft Graph | Application |
| UserAuthenticationMethod.Read.All | Microsoft Graph | Application |
| UserAuthMethod-Passkey.Read.All | Microsoft Graph | Application |
| RoleManagement.Read.All | Microsoft Graph | Application |
| RoleManagement.Read.Exchange | Microsoft Graph | Application |
| PrivilegedAccess.Read.AzureAD | Microsoft Graph | Application |
| PrivilegedAccess.Read.AzureADGroup | Microsoft Graph | Application |
| PrivilegedAccess.Read.AzureResources | Microsoft Graph | Application |
| SecurityEvents.Read.All | Microsoft Graph | Application |
| SecurityActions.Read.All | Microsoft Graph | Application |
| ThreatAssessment.Read.All | Microsoft Graph | Application |
| InformationProtectionPolicy.Read.All | Microsoft Graph | Application |
| SharePointTenantSettings.Read.All | Microsoft Graph | Application |
| Sites.Read.All | Microsoft Graph | Application |
| TermStore.Read.All | Microsoft Graph | Application |
| TeamSettings.Read.All | Microsoft Graph | Application |
| MailboxSettings.Read | Microsoft Graph | Application |
| Device.Read.All | Microsoft Graph | Application |
| DeviceManagementManagedDevices.Read.All | Microsoft Graph | Application |
| DeviceManagementApps.Read.All | Microsoft Graph | Application |
| DeviceManagementConfiguration.Read.All | Microsoft Graph | Application |
| DeviceManagementServiceConfig.Read.All | Microsoft Graph | Application |
| ServiceHealth.Read.All | Microsoft Graph | Application |
| ServiceMessage.Read.All | Microsoft Graph | Application |
| ServiceActivity-Exchange.Read.All | Microsoft Graph | Application |
| OrgSettings-AppsAndServices.Read.All | Microsoft Graph | Application |
| OrgSettings-Forms.Read.All | Microsoft Graph | Application |
| MultiTenantOrganization.Read.All | Microsoft Graph | Application |
| Sites.FullControl.All | SharePoint Online | Application |
| Exchange.ManageAsApp | Exchange Online | Application |
| EopPolicySync.AccessAsApp | Exchange Online Protection | Application |
| Directory.ReadWrite.All | Microsoft Graph | Application |
| Application.ReadWrite.All | Microsoft Graph | Application |
| Group.ReadWrite.All | Microsoft Graph | Application |
| Organization.ReadWrite.All | Microsoft Graph | Application |
| Policy.ReadWrite.ConditionalAccess | Microsoft Graph | Application |
| Policy.ReadWrite.AccessReview | Microsoft Graph | Application |
| Policy.ReadWrite.ApplicationConfiguration | Microsoft Graph | Application |
| Policy.ReadWrite.Authorization | Microsoft Graph | Application |
| Policy.ReadWrite.SecurityDefaults | Microsoft Graph | Application |
| AccessReview.ReadWrite.All | Microsoft Graph | Application |
| User.ReadWrite.All | Microsoft Graph | Application |
| UserAuthenticationMethod.ReadWrite.All | Microsoft Graph | Application |
| TeamSettings.ReadWrite.All | Microsoft Graph | Application |
| TermStore.ReadWrite.All | Microsoft Graph | Application |
| Sites.Manage.All | Microsoft Graph | Application |
| Sites.Archive.All | Microsoft Graph | Application |
| Sites.FullControl.All | Microsoft Graph | Application |
| Sites.ReadWrite.All | Microsoft Graph | Application |
| Sites.Selected | Microsoft Graph | Application |
| DeviceManagementApps.ReadWrite.All | Microsoft Graph | Application |
| DeviceManagementConfiguration.ReadWrite.All | Microsoft Graph | Application |
| DeviceManagementRBAC.ReadWrite.All | Microsoft Graph | Application |
| DeviceManagementServiceConfig.ReadWrite.All | Microsoft Graph | Application |
| DeviceManagementCloudCA.ReadWrite.All | Microsoft Graph | Application |
| full_access_as_app | Exchange Online | Application |
Entra Roles
| Role |
|---|
| Exchange Administrator |
| Security Administrator |
| Compliance Administrator |
| Conditional Access Administrator |
| Authentication Administrator |
| SharePoint Administrator |
| Teams Administrator |
| User Administrator |
| Application Administrator |
| Privileged Role Administrator |
| Authentication Policy Administrator |
| Cloud Application Administrator |
| Groups Administrator |
| Privileged Authentication Administrator |
| Security Operator |
| Azure Information Protection Administrator |
| Cloud Device Administrator |
| Global Secure Access Administrator |
| Compliance Data Administrator |
Last updated on