Read-scoped, and honest about the edges
.Write, .ReadWrite, or .Send scopes anywhere in the scanner’s request set, and no Mail.Read: the scanner holds no permission that can read message content. Two Microsoft services offer no read-only option for the settings ScanPosture assesses. Rather than quietly accepting broad access, each is contained: Exchange’s Exchange.ManageAsApp is pinned to the read-only Global Reader role, and the SharePoint tenant-sharing permission lives on a separate, certificate-backed collector app that the scanner never holds. Both are documented in full below.How to read this page
ScanPosture groups its permission requests into batches. Each batch unlocks a related family of checks and is itemised on the Microsoft admin-consent screen, so your Global Administrator sees exactly what is being granted and why. A tenant scans on the core admin consent alone; the role assignments and the optional evidence collector below add enhanced coverage, and any check whose access you decline is surfaced as skipped with a documented reason, never as failed.
Batch A, Core Entra ID & directory
The base permission set. Powers identity, access, conditional-access, application, and risk checks.
Directory.Read.AllWhat it lets us read
Users, groups, applications, service principals, organisation, domains, directory roles.What it does NOT grant
Cannot create, modify, or delete any directory object.AuditLog.Read.AllWhat it lets us read
Sign-in logs and directory audit logs (used for "has any admin signed in via legacy auth in 30 days" style checks).What it does NOT grant
No access to mailbox content, document content, or message content.IdentityRiskyUser.Read.AllWhat it lets us read
Microsoft-flagged risky users and risk events.What it does NOT grant
Cannot dismiss or remediate risk; read-only.Policy.Read.AllWhat it lets us read
Conditional access policies, authentication methods policy.What it does NOT grant
Cannot edit policies; read-only.RoleManagement.Read.DirectoryWhat it lets us read
Directory role assignments, who has Global Admin, who has PIM eligibility, etc.What it does NOT grant
Cannot grant, modify, or remove role assignments.IdentityProvider.Read.AllWhat it lets us read
External identity provider configuration (B2B / B2C federated providers).What it does NOT grant
Cannot add or remove identity providers.SecurityEvents.Read.AllWhat it lets us read
Microsoft Defender / security alert metadata.What it does NOT grant
Cannot dismiss, action, or modify alerts.
Batch C, SharePoint, Teams & Exchange posture
Checks covering email security, collaboration settings, and data sharing.
Sites.Read.AllWhat it lets us read
SharePoint and OneDrive site metadata, sharing settings.What it does NOT grant
Cannot read document content. Cannot modify sharing.TeamSettings.Read.AllWhat it lets us read
Microsoft Teams team settings (guest access, member roles).What it does NOT grant
Cannot read messages or files.Channel.ReadBasic.AllWhat it lets us read
Channel names, IDs, membership type per team.What it does NOT grant
No channel message content.TeamsAppInstallation.ReadForTeam.AllWhat it lets us read
Which Teams apps are installed where (used for app-governance checks).What it does NOT grant
Cannot install, remove, or update any app.MailboxSettings.ReadWhat it lets us read
Mailbox-level settings: forwarding state, automatic replies, delegation, language.What it does NOT grant
No message bodies, subjects, or attachments. No write of any setting.
Mail.Read was removed in May 2026
Mail.Read to evaluate inbox forwarding rules. That permission was removed from the request set in May 2026: forwarding-rule and delegation checks now run on MailboxSettings.Read alone. The scanner holds no permission capable of reading message content, and this page reflects the manifest the production app reads at consent time.Batch D, Usage reports
Activity-based checks (inactive Teams, dormant app registrations) that otherwise silently skip.
Reports.Read.AllWhat it lets us read
Microsoft 365 usage reports, Teams activity, app sign-in activity.What it does NOT grant
No mailbox content; aggregate usage only.
Batch E, Exchange Online admin REST
Six checks that read Exchange configuration through the REST admin API: mailbox auditing state, transport rules bypassing spam filtering, shared-mailbox delegate audit, distribution lists accepting external mail, outbound spam auto-forwarding state, and Purview audit coverage for privileged users.
Exchange.ManageAsAppWhat it lets us read
Run Exchange admin cmdlets as the application identity. ScanPosture only invokes read (Get-) cmdlets: Get-Mailbox, Get-TransportRule, Get-DistributionGroup and similar.What it does NOT grant
Grants no cmdlet access by itself. What the app can actually run is set entirely by the paired directory role, and ScanPosture asks for the read-only Global Reader role, so write cmdlets are rejected by Exchange itself.
A Microsoft limitation, contained twice
Exchange.ManageAsApp is the only application permission Exchange Online has. It is inert on its own; the paired directory role decides what it can do. ScanPosture’s manual setup step asks you to assign the read-only Global Reader role (Microsoft Entra admin center → Identity → Roles & admins → Global Reader → Add assignments), which covers every Get- cmdlet these checks run and nothing more. So the containment is double: the role you assign is read-only, and the scan engine’s Exchange code path only issues Get- commands. Without the role, Exchange rejects every call and ScanPosture surfaces the affected checks as skipped, never as failed.Batch F, Azure Resource Manager (optional)
Two checks that read Entra ID diagnostic-settings under the Microsoft.aadiam provider.
No API permissions, RBAC only
Batch H, Microsoft Intune device security
Device-security checks: compliance policy coverage, MDM enrolment posture, jailbreak and encryption signals.
DeviceManagementConfiguration.Read.AllWhat it lets us read
Intune device compliance policies and configuration profiles.What it does NOT grant
Cannot create, assign, or modify any policy.DeviceManagementManagedDevices.Read.AllWhat it lets us read
Managed-device enrolment and compliance state.What it does NOT grant
Cannot wipe, retire, or act on any device.
Batches I and K, Identity Protection and PIM alerts (Entra ID P2)
Five checks that only function on tenants licensed for Entra ID P2. ScanPosture licence-gates them upfront: unlicensed tenants are never asked to grant scopes that cannot help them.
IdentityRiskEvent.Read.AllWhat it lets us read
Risk detections: impossible travel, anonymous-IP sign-ins, unreviewed high-risk events, risk-policy enforcement state.What it does NOT grant
Cannot dismiss, confirm, or remediate any risk event.RoleManagementAlert.Read.DirectoryWhat it lets us read
Built-in PIM security-alert configuration: too many Global Admins, roles assigned outside PIM, eligible roles never activated.What it does NOT grant
Directory-role alert configuration only; no user content, mail, or files. Cannot change any alert setting.
Batches L to P, Governance and coverage scopes
Narrow, single-purpose read scopes, each promoted to the request set only after being proven necessary on a live tenant. Each unlocks the check named beside it.
Agreement.Read.AllWhat it lets us read
Terms of Use agreements (whether an active agreement exists).What it does NOT grant
Terms-of-use agreements only; no broader directory data.AccessReview.Read.AllWhat it lets us read
Access-review definitions: do recurring reviews cover guests and privileged roles.What it does NOT grant
Cannot create, start, or decide any review.SharePointTenantSettings.Read.AllWhat it lets us read
SharePoint and OneDrive tenant-level settings (unmanaged-device sync restriction).What it does NOT grant
Settings only; no site content, no files, no write.SecurityAlert.Read.AllWhat it lets us read
Unified security-alerts service reachability (Defender-licensed tenants).What it does NOT grant
Cannot dismiss or modify alerts.DeviceManagementApps.Read.AllWhat it lets us read
Intune app-protection (MAM) policy state for BYOD checks.What it does NOT grant
App-management configuration only; cannot change any policy.
Enhanced SharePoint Evidence (optional, isolated app)
Two checks read tenant-wide sharing settings (default sharing-link type, guest-link expiry) that Microsoft exposes through no read-only permission: the SharePoint tenant-admin endpoint requires Sites.FullControl.Alland a certificate-backed app identity. ScanPosture’s answer is isolation, not acceptance:
- The scanner never holds
Sites.FullControl.All. It is deliberately excluded from the scanner’s manifest. - A separate, dedicated, certificate-backed app, the ScanPosture SharePoint Evidence Collector, holds it and calls exactly one read endpoint (
GET _api/SPO.Tenant). Its code path cannot issue writes. - Consent is optional and separate. Decline it and the two sharing checks are marked out of assessment scope with a documented reason; nothing else is affected.
Why not a read-only scope?
Sites.Read.Alland every intermediate scope fail against the tenant-admin endpoint). Where Microsoft leaves no read-only path, ScanPosture’s policy is to quarantine the broad permission in a single-purpose app rather than widen the scanner, so the blast radius of the scanner itself never grows.Granting consent
Admin consent for every batch is granted via the standard Microsoft /adminconsent flow. ScanPosture redirects your Global Administrator to the Microsoft consent page at the start of onboarding. You’ll see ScanPosture listed as a Microsoft-verified publisher, that’s the verified badge on the consent screen. Consent is recorded against the tenant, not against an individual user.
Delegating consent to a Global Admin
Revoking access
You can revoke ScanPosture’s access at any time:
- Microsoft Entra admin center → Identity → Applications → Enterprise applications → ScanPosture → Permissions → remove the granted permissions, OR
- Microsoft Entra admin center → Identity → Applications → Enterprise applications → ScanPosture → delete the application registration outright.
Revocation is immediate and total, every subsequent Graph call from ScanPosture will return 401 and the affected checks will surface as skipped on the next scan attempt. ScanPosture also exposes a one-click Disconnect tenant button inside the app itself for the same effect.
Want the full source? The list above is generated from the same permission manifest the production app reads at consent time, so this page reflects the running configuration, and the consent screen your administrator sees is the final authority.