Directory Access
Microsoft Graph Permission:
Directory.Read.All
This allows us to read directory data such as users, groups, applications, devices, and other directory objects.
We use it to build a complete view of the Microsoft 365 tenant and understand how identities and access are structured.
This is important because the directory is the core identity system for Microsoft 365. Accurate directory visibility helps identify inactive accounts, unexpected objects, risky group structures, and access management gaps.
Role Management Visibility
Microsoft Graph Permission:
RoleManagement.Read.Directory
This allows us to read directory role management information, including role definitions and role assignments.
We use it to understand who has privileged access, which admin roles exist, and whether role assignments are appropriate.
This is important because privileged Microsoft Entra roles can control users, settings, applications, and security configuration. Reviewing role assignments helps reduce the risk of excessive admin access.
Authentication Method Visibility
Microsoft Graph Permission:
UserAuthenticationMethod.Read.All
This allows us to read users' registered authentication methods, such as multifactor authentication methods.
We use it to assess whether users have strong authentication configured and whether high-risk accounts are protected.
This is important because weak or missing authentication methods are a major account takeover risk. This permission helps identify users who may need stronger protection.
License Assignment Visibility
Microsoft Graph Permission:
LicenseAssignment.Read.All
This allows us to read license assignment information.
We use it to understand which Microsoft licenses are assigned to users and whether licensing is aligned with security and compliance features.
This is important because many Microsoft 365 security and compliance capabilities depend on licensing. Reviewing license assignments helps identify users who may not have the expected protections.