| AWS · Connector · baseSecurityAudit | Selected AWS account | Read security configuration and audit metadata.Base CloudFormation and manual profile; no unrestricted service-data reading. |
| AWS · Connector · basece:GetCostAndUsage | Cost Explorer API | Read cost-and-usage data for cost analysis.Included by the CloudFormation stack as one inline read action. |
| AWS · Connector · optionalAmazonEC2ContainerRegistryReadOnly | Approved ECR resources/account | Read ECR evidence where required.Manual guide option; not in the base CloudFormation template. Includes image-pull permissions; review data exposure. |
| Azure · Azure RBACReader | Selected subscriptions or management group | Inventory Azure resources and read their control-plane configuration without changing them.Scoped to the customer-approved installation boundary. |
| Azure · Azure RBACSecurity Reader | Selected subscriptions or management group | Read Defender for Cloud recommendations, alerts, security policies, and security state.Scoped to the customer-approved installation boundary. |
| Azure · Azure RBACMonitoring Reader | Selected subscriptions or management group | Read Azure Monitor metrics, logs, alerts, and diagnostic settings.Scoped to the customer-approved installation boundary. |
| Azure · Azure RBACBackup Reader | Selected subscriptions or management group | Read backup vaults, protected items, policies, jobs, and backup posture.Scoped to the customer-approved installation boundary. |
| Azure · Azure RBACKey Vault Reader | Selected subscriptions or management group | Read vault and key/secret/certificate metadata. It cannot read secret values or key material.Scoped to the customer-approved installation boundary. |
| Azure · Azure RBACCost Management Reader | Selected subscriptions or management group | Read cost configuration, budgets, exports, and cost-management evidence.Scoped to the customer-approved installation boundary. |
| Azure · Azure RBACLog Analytics Reader | Selected subscriptions, management group, or explicitly supplied workspaces | Query and read Log Analytics data and workspace monitoring configuration.Scoped to the customer-approved installation boundary. |
| Azure · Azure RBACMicrosoft Sentinel Reader | Selected subscriptions, management group, or explicitly supplied workspaces | Read Sentinel incidents, analytics, hunting, and workspace security configuration.Scoped to the customer-approved installation boundary. |
| Azure · Azure RBACManagement Group Reader | Management-group installs only | Read the management-group hierarchy and subscriptions included in the selected group.Conditional: review the role-specific scope; not a blanket subscription grant for every role. |
| Azure · Azure RBACBilling Reader | Explicitly supplied billing scopes only | Read billing-account/profile evidence. The role is not requested when no billing scope is supplied.Conditional: review the role-specific scope; not a blanket subscription grant for every role. |
| Azure · Azure RBACAzure Kubernetes Service RBAC Reader | Each discovered AKS cluster only | Read Kubernetes objects needed to assess cluster configuration; it is not assigned if no AKS cluster exists.Conditional: review the role-specific scope; not a blanket subscription grant for every role. |
| Azure · Azure RBACApp Configuration Data Reader | Each discovered App Configuration store only | Read configuration key-values needed for posture checks; it is not assigned if no store exists.Conditional: review the role-specific scope; not a blanket subscription grant for every role. |
| Azure · Microsoft GraphDirectory.Read.All | Tenant-wide · application permission | Read directory objects and relationships used for tenant-wide identity inventory.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphUser.Read.All | Tenant-wide · application permission | Inventory users, account state, and identity attributes.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphGroup.Read.All | Tenant-wide · application permission | Inventory groups and membership used for access-path analysis.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphApplication.Read.All | Tenant-wide · application permission | Inventory app registrations, enterprise applications, credentials metadata, and consent configuration.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphDevice.Read.All | Tenant-wide · application permission | Inventory Entra-registered devices and trust/compliance attributes.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphOrganization.Read.All | Tenant-wide · application permission | Read tenant identity, settings, and verified organization properties.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphDomain.Read.All | Tenant-wide · application permission | Read verified and federated domain configuration.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphAdministrativeUnit.Read.All | Tenant-wide · application permission | Read administrative units and their membership/delegation boundaries.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphRoleManagement.Read.Directory | Tenant-wide · application permission | Read Entra role definitions and assignments.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphRoleEligibilitySchedule.Read.Directory | Tenant-wide · application permission | Read eligible Privileged Identity Management role schedules.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphRoleAssignmentSchedule.Read.Directory | Tenant-wide · application permission | Read active and scheduled privileged-role assignments.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphRoleManagementPolicy.Read.Directory | Tenant-wide · application permission | Read PIM activation, approval, duration, and notification policies.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphRoleManagement.Read.All | Tenant-wide · application permission | Read role-management configuration exposed across supported Microsoft Graph resources.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphPolicy.Read.All | Tenant-wide · application permission | Read tenant identity and authorization policies.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphPolicy.Read.ConditionalAccess | Tenant-wide · application permission | Read Conditional Access policies and named locations.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphPolicy.Read.AuthenticationMethod | Tenant-wide · application permission | Read authentication-method and MFA policy configuration.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphPolicy.Read.PermissionGrant | Tenant-wide · application permission | Read application consent and permission-grant policies.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphPolicy.Read.DeviceConfiguration | Tenant-wide · application permission | Read device registration and authorization policies.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphCrossTenantInformation.ReadBasic.All | Tenant-wide · application permission | Read basic cross-tenant organization information for trust review.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphAuditLog.Read.All | Tenant-wide · application permission | Read directory audit, provisioning, and sign-in activity.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphReports.Read.All | Tenant-wide · application permission | Read service-usage and security reports.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphReportSettings.Read.All | Tenant-wide · application permission | Read administrative report settings, including concealed-data settings.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphAuditLogsQuery.Read.All | Tenant-wide · application permission | Query audit-log data exposed across Microsoft services.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphAccessReview.Read.All | Tenant-wide · application permission | Read access reviews, reviewers, decisions, and settings.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphEntitlementManagement.Read.All | Tenant-wide · application permission | Read access packages, catalogs, assignments, and entitlement policies.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphLifecycleWorkflows.Read.All | Tenant-wide · application permission | Read joiner, mover, and leaver workflow configuration and execution history.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphAgreement.Read.All | Tenant-wide · application permission | Read terms-of-use agreements and acceptance records.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphOnPremDirectorySynchronization.Read.All | Tenant-wide · application permission | Read hybrid identity synchronization configuration and status.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphSecurityEvents.Read.All | Tenant-wide · application permission | Read security events exposed through the Microsoft Graph security API.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphSecurityAlert.Read.All | Tenant-wide · application permission | Read security alerts for investigation and control evidence.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphSecurityIncident.Read.All | Tenant-wide · application permission | Read correlated security incidents and their status.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphThreatHunting.Read.All | Tenant-wide · application permission | Run read-only advanced hunting queries for security evidence.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphIdentityRiskyUser.Read.All | Tenant-wide · application permission | Read risky-user detections and risk state.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphIdentityRiskEvent.Read.All | Tenant-wide · application permission | Read identity risk detections and event detail.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphIdentityRiskyServicePrincipal.Read.All | Tenant-wide · application permission | Read risk findings for workload identities and service principals.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphSecurityActions.Read.All | Tenant-wide · application permission | Read security remediation-action status without initiating actions.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphThreatIndicators.Read.All | Tenant-wide · application permission | Read tenant threat-intelligence indicators.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphInformationProtectionPolicy.Read.All | Tenant-wide · application permission | Read information-protection policy configuration.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphDeviceManagementConfiguration.Read.All | Tenant-wide · application permission | Read Intune device configuration and compliance policies.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphDeviceManagementManagedDevices.Read.All | Tenant-wide · application permission | Read managed-device inventory, ownership, health, and compliance state.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphDeviceManagementApps.Read.All | Tenant-wide · application permission | Read managed application inventory and app-management policy.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphDeviceManagementServiceConfig.Read.All | Tenant-wide · application permission | Read Intune tenant and service configuration.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Microsoft GraphDeviceManagementRBAC.Read.All | Tenant-wide · application permission | Read Intune roles, assignments, and scope tags.Requires authorized admin consent. Product licensing and telemetry availability still apply. |
| Azure · Defender for EndpointMachine.Read.All | Tenant-wide · application permission | Read onboarded endpoint inventory, health, exposure, and device detail.Requires authorized admin consent and endpoint data in the customer tenant. |
| Azure · Defender for EndpointVulnerability.Read.All | Tenant-wide · application permission | Read discovered vulnerabilities and affected devices.Requires authorized admin consent and endpoint data in the customer tenant. |
| Azure · Defender for EndpointSecurityRecommendation.Read.All | Tenant-wide · application permission | Read endpoint security recommendations and remediation context.Requires authorized admin consent and endpoint data in the customer tenant. |
| Azure · Defender for EndpointSoftware.Read.All | Tenant-wide · application permission | Read installed-software inventory and software evidence.Requires authorized admin consent and endpoint data in the customer tenant. |
| Azure · Defender for EndpointScore.Read.All | Tenant-wide · application permission | Read exposure/security score evidence.Requires authorized admin consent and endpoint data in the customer tenant. |
| Azure · Defender for EndpointAlert.Read.All | Tenant-wide · application permission | Read Defender for Endpoint alerts and related investigation context.Requires authorized admin consent and endpoint data in the customer tenant. |