SharePoint Site Visibility
Microsoft Graph Permission:
Sites.Read.All
This allows us to read SharePoint site information across the tenant.
We use it to understand which sites exist, how they are structured, and how collaboration spaces are organized.
This is important because SharePoint sites often contain business-critical files and can be shared internally or externally. Site visibility helps assess exposure and governance.
File Visibility
Microsoft Graph Permission:
Files.Read.All
This allows us to read files across site collections through Microsoft Graph.
We use it only where file-level visibility is required for assessment, classification, governance, or security review.
This is important because sensitive information often lives in OneDrive and SharePoint. File visibility can help identify exposed, stale, or improperly shared data. Because this permission is broad, clients should understand and approve its use carefully.