Reference
Permissions we request
Every permission Watchtower's app registration asks for at admin consent, what it reads, and how many checks depend on it.
When you onboard a tenant, a Global Administrator grants admin consent to Watchtower's multi-tenant app registration. Microsoft's consent prompt is all-or-nothing, so this page lists everything that prompt contains - read-only application permissions plus the standard sign-in scopes - and, for each one, exactly what Watchtower reads with it. This page is generated from the same code that declares the app registration and runs the collectors, and CI fails if they diverge.
Two standing commitments:
- Read-only scanning. The scan path never writes to your tenant. The single write permission in the manifest exists for the opt-in Intune restore feature and stays dormant unless a tenant admin enables restore - see its row below.
- Evidence minimisation. Collectors project only the fields that checks consume - counts instead of identities where a count answers the question, and never credential material or message content.
Sign-in scopes (delegated)
Standard OpenID Connect scopes used only to sign your users into the dashboard. They grant no access to tenant configuration.
| Scope | Purpose |
|---|---|
openid | OpenID Connect sign-in |
profile | Display name on the signed-in account |
email | Email address on the signed-in account |
offline_access | Refresh tokens so sessions survive token expiry |
User.Read | Read the signed-in user's own profile |
Application permissions (what the scanner reads)
One row per permission in the consent prompt. "Data read" names the collected data sources (each is a minimised projection, not a raw export); "Checks" counts the built-in checks whose evaluation depends on that permission today.
| Permission | Resource | Data read | Checks |
|---|---|---|---|
AuditLog.Read.All | Microsoft Graph | guestUserActivity, servicePrincipalSignInActivities, userRegistrationDetails | 7 |
DeviceManagementApps.Read.All | Microsoft Graph | androidAppProtectionPolicies, iosAppProtectionPolicies, windowsAppProtectionPolicies | 47 |
DeviceManagementConfiguration.Read.All | Microsoft Graph | androidCompliancePolicies, androidConfigurationProfiles, deviceManagementSettings, intuneCompliancePolicies, intuneConfigurationPolicies, iosCompliancePolicies, iosConfigurationProfiles, macosCompliancePolicies, macosConfigurationProfiles, securityBaselineIntents, windowsCompliancePolicies, windowsConfigurationProfiles | 464 |
DeviceManagementConfiguration.ReadWrite.All | Microsoft Graph | Write permission for the opt-in Intune settings restore feature. The scan path never uses it; it stays dormant unless a tenant admin explicitly enables restore in the dashboard, and that gate lives in Watchtower's database, not in the token. | - |
DeviceManagementManagedDevices.Read.All | Microsoft Graph | deviceCleanupRules, managedDeviceOverview. Also read once per scan to decide platform applicability: when Windows, macOS, or iOS has zero enrolled devices, every check for that platform is marked not applicable instead of counting against the posture score. | 1 |
DeviceManagementRBAC.Read.All | Microsoft Graph | roleScopeTags | 1 |
DeviceManagementServiceConfig.Read.All | Microsoft Graph | depEnrollmentProfiles, deviceEnrollmentConfigurations, enrollmentNotificationConfigurations, intuneBrandingProfiles, mobileThreatDefenseConnectors, termsAndConditionsPolicies, windowsHelloEnrollmentConfigurations | 7 |
Directory.Read.All | Microsoft Graph | applications, copilotLicensing, emergencyAccessProfile, entraConnectSyncAccounts, gaGsaRoleAssignments, gsaForwardingProfiles, gsaTaggedApps, gsaUsageReports, guestOwnedObjects, passwordProtectionSettings, passwordRuleSettings, servicePrincipals | 36 |
DirectoryRecommendations.Read.All | Microsoft Graph | directoryRecommendations | 3 |
Domain.Read.All | Microsoft Graph | domains | 1 |
EntitlementManagement.Read.All | Microsoft Graph | entitlementAssignmentPolicies | 4 |
Exchange.ManageAsApp | Office 365 Exchange Online | adminAuditLogConfig, antiPhishPolicies, atpPolicyForO365, atpProtectionPolicyRules, dkimSigningConfig, emailTenantSettings, eopProtectionPolicyRules, externalInOutlook, hostedConnectionFilterPolicies, hostedContentFilterPolicies, hostedOutboundSpamFilterPolicies, mailFlowConnectors, mailboxAuditBypassAssociations, mailboxForwarding, malwareFilterPolicies, malwareFilterRules, organizationConfig, owaMailboxPolicies, roleAssignmentPolicies, safeAttachmentPolicies, safeLinksPolicies, sharingPolicies, teamsProtectionPolicies, transportConfig, transportRules, userMailboxes | 33 |
Group.Read.All | Microsoft Graph | copilotLicensing, groups | 5 |
IdentityRiskEvent.Read.All | Microsoft Graph | userRiskState, workloadIdentityRiskState | 4 |
IdentityRiskyServicePrincipal.Read.All | Microsoft Graph | workloadIdentityRiskState | 2 |
IdentityRiskyUser.Read.All | Microsoft Graph | userRiskState | 2 |
InformationProtectionPolicy.Read.All | Microsoft Graph | labelPolicies | 1 |
NetworkAccess.Read.All | Microsoft Graph | gsaFilteringPosture, gsaForwardingProfiles, gsaSettings, gsaTlsInspection, gsaUsageReports | 22 |
OnPremDirectorySynchronization.Read.All | Microsoft Graph | onPremisesSynchronization | 1 |
Organization.Read.All | Microsoft Graph | copilotLicensing, subscribedSkus, teamsClientConfiguration, teamsExternalAccessPolicy, teamsFederationConfiguration, teamsMeetingPolicy, teamsMessagingPolicy | 20 |
OrgSettings-AppsAndServices.Read.All | Microsoft Graph | appsAndServices | 3 |
OrgSettings-Forms.Read.All | Microsoft Graph | formsSettings | 1 |
Policy.Read.All | Microsoft Graph | adminConsentRequestPolicy, authMethodsPolicy, authenticationFlowsPolicy, authorizationPolicy, b2bPolicy, conditionalAccessPolicies, crossTenantAccessPolicyDefault, defaultAppManagementPolicy, mobileDeviceManagementPolicies, namedLocations, protectedActions, securityDefaults, userConsentSettings | 63 |
Policy.Read.DeviceConfiguration | Microsoft Graph | deviceRegistrationPolicy | 5 |
PrivilegedAccess.Read.AzureAD | Microsoft Graph | praRoleManagementPolicyRules | 1 |
RoleAssignmentSchedule.Read.Directory | Microsoft Graph | directoryRoles, privilegedUsers | 11 |
RoleEligibilitySchedule.Read.Directory | Microsoft Graph | directoryRoles, privilegedUsers | 11 |
RoleManagement.Read.Directory | Microsoft Graph | directoryRoles, emergencyAccessProfile, gaGsaRoleAssignments, pimNotificationRules, praRoleManagementPolicyRules, privilegedRoleDefinitions, privilegedUsers, protectedActions | 19 |
SecurityEvents.Read.All | Microsoft Graph | secureScores | 0 |
SharePointTenantSettings.Read.All | Microsoft Graph | spoTenant | 12 |
Sites.FullControl.All | Office 365 SharePoint Online | spoSites, spoTenant | 12 |
Synchronization.Read.All | Microsoft Graph | spProvisioning | 2 |
User.Read.All | Microsoft Graph | copilotLicensing, emergencyAccessProfile, guestOwnedObjects, guestSponsors, guestUserActivity, perUserMfaStates, privilegedUsers | 17 |
UserAuthenticationMethod.Read.All | Microsoft Graph | emergencyAccessProfile, userRegistrationDetails | 5 |
Optional, best-effort permissions
Not part of the default consent prompt. The checks that read them report indeterminate on tenants where they are not granted:
| Permission | Why it is optional |
|---|---|
CopilotSettings-LimitedMode.Read | Copilot admin "limited mode" setting. Microsoft's endpoint currently supports delegated access only, so the app-only call is refused and the one check reading it reports indeterminate; the permission is deliberately left out of the default consent prompt until Microsoft enables application access. |
DataLossPreventionPolicy.Read.All | Purview DLP policies, part of the optional Purview scan surface configured during onboarding. Tenants that skip it get indeterminate results on the DLP checks instead of invented verdicts. |
Beyond the consent prompt
Some Microsoft surfaces are not readable through Graph application permissions alone:
- Exchange Online admin API: an Exchange Online resource permission (not a Graph scope), plus an Entra role granting Exchange read access.
- SharePoint REST/CSOM: a SharePoint resource permission (not a Graph scope), plus the SharePoint Administrator Entra role.
- Teams admin API: the Global Reader or Teams Administrator Entra role, assigned to Watchtower's service principal during onboarding.
- Public DNS: email-security checks (SPF/DKIM/DMARC) resolve your domains' public DNS records - no tenant permission involved.
When consent is missing
If a permission has not been consented (for example a tenant onboarded before a permission was added to the manifest), the affected data sources fail closed and their checks report indeterminate - never a pass or fail invented without evidence. Re-running admin consent updates the grant.
See also: Check catalog - the same mapping, seen from the check side.