Audit, Reporting, and Policy Visibility

Audit Log Visibility

Microsoft Graph Permission:

AuditLog.Read.All

This allows us to read audit log data.

We use it to review sign-ins, directory changes, admin activity, and other events that help explain what happened in the tenant.

This is important because audit logs support incident investigation, compliance reporting, and detection of suspicious activity.

Reporting Visibility

Microsoft Graph Permission:

Reports.Read.All

This allows us to read Microsoft 365 usage reports.

We use it to understand service usage, user activity, adoption patterns, and operational trends.

This is important because reporting helps identify inactive accounts, underused services, unusual usage patterns, and areas where configuration or licensing may need attention.

Policy Visibility

Microsoft Graph Permission:

Policy.Read.All

This allows us to read policy configuration across Microsoft 365.

We use it to review policies such as conditional access, authentication, authorization, and other tenant-level controls where available through Microsoft Graph.

This is important because policies define how users access services and how security rules are enforced. Reading policies helps confirm whether the tenant's controls match the intended security posture.