The collection reads with application permissions your administrator approves — again whenever a new role is added — and with read-only roles in the directory. More than read permissions are ConfigurationMonitoring.ReadWrite.All, because Microsoft’s read permission for configuration monitoring may only list jobs and the Teams policies only come from a snapshot that has been started, and Exchange.ManageAsApp, through which PureTenant calls only reading commands. Anything beyond that is only added with your approval.
Application permissions of the collection
Microsoft GraphMore than 40 read permissions from a wide range of areas
A selection, used app-only — without any person signing in. The one named exception with write access is always included.
| Permission | Type |
|---|---|
Directory.Read.All | read |
Reports.Read.All | read |
AuditLog.Read.All | read |
SecurityIncident.Read.All | read |
AttackSimulation.Read.All | read |
ThreatHunting.Read.All | read |
ConfigurationMonitoring.ReadWrite.All | write · the named exception |
RoleManagement.Read.Directory | read |
IdentityRiskyUser.Read.All | read |
Policy.Read.All | read |
MailboxSettings.Read | read |
SensitivityLabel.Read | read |
eDiscovery.Read.All | read |
Sites.Read.All | read |
DeviceManagementManagedDevices.Read.All | read |
DeviceManagementConfiguration.Read.All | read |
CallRecords.Read.All | read |
VirtualEvent.Read.All | read |
AccessReview.Read.All | read |
CopilotPackages.Read.All | read |
AgentIdentity.Read.All | read |
Defender for Endpoint2 permissions per service, used app-only — without any person signing in.
| Permission | Type |
|---|---|
Machine.Read.All | read |
Vulnerability.Read.All | read |
Exchange Online1 permission per service, used app-only — without any person signing in.
| Permission | Type |
|---|---|
Exchange.ManageAsApp | access · used read-only |
Exchange Online Protection1 permission per service, used app-only — without any person signing in.
| Permission | Type |
|---|---|
Exchange.ManageAsApp | access · used read-only |
Directory roles
The service principal’s directory roles read: Security Reader and Global Reader. A role with write access is only added with your approval (below).
What else applies
“Exchange.ManageAsApp” opens access to the Exchange and Purview cmdlets; PureTenant calls only reading commands through it and rejects any other before it reaches Microsoft. For the Teams policies, the collection creates a snapshot job in your tenant and removes it again afterwards; it uses part of a monthly quota of your tenant. For this, the setup gives Microsoft’s service principal “Tenant Configuration Management” the read-only role “Teams Reader”. The role “Compliance Administrator” is only added if your administrator explicitly approves it, the permission Group.ReadWrite.All only when the Power BI access is set up. On request, your administrator grants personally via PowerShell the role group “eDiscoveryManager” for eDiscovery — it allows more than reading, while PureTenant queries cases with a read-only permission — and the tenant-wide Teams policy “insights-events” for webinars and town halls.
The permissions of the setup
To create the application, your administrator signs in once and approves delegated permissions: Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, RoleManagement.ReadWrite.Directory, and Directory.Read.All. The token of this sign-in only serves to create the application and is discarded afterwards; it is never stored.