Permissions disclosure

Note: Exchange.ManageAsApp grants app-only access to Exchange Online management APIs — not to individual mailboxes or mail content. The app is assigned to the View-Only Organization Management role group only (no Microsoft Entra role is needed). The SPF, DMARC and MX lookups are ordinary public DNS queries made from your machine through your own system DNS resolver only (no third-party DNS service is ever used). No Microsoft permission is involved.

Note: Both Exchange.ManageAsApp permissions (Microsoft Exchange Online Protection and Office 365 Exchange Online) only let the 365Posture app open the read-only Security & Compliance PowerShell session; the Global Reader role below limits what that session can do to viewing settings. Global Reader is the read-only version of Global Administrator: it can view settings but cannot change anything, and it is not a mailbox or file permission. It is assigned to the 365Posture app, never to a person, and only for the duration of the Purview collection: setup removes it automatically as soon as the collection finishes (if the removal ever fails, setup prints the exact steps to remove it yourself). To assign and remove it, setup asks you (the signed-in administrator, once, in the browser sign-in) to approve RoleManagement.ReadWrite.Directory on your own login, and only for orders that include Purview; the 365Posture app never receives that permission. The sign-in uses Microsoft Graph Explorer (a Microsoft app), so that approval stays recorded on your account as a Graph Explorer permission after the run; you can revoke it any time in My Apps or the Entra admin centre (Enterprise applications, Graph Explorer, Permissions). If the role cannot be assigned, the Purview policy checks (DLP, retention, labels) show as not assessed instead of failing.

Note: No site, file, user or group name is read: nothing under Sites.* or Files.* is requested, and the sharing domain lists are replaced with anonymous tokens on your machine before anything leaves it. This read-only assessment never asks for a write-capable permission. A few SharePoint settings (the default sharing link, Anyone link expiry and permission, access from unmanaged devices) are only on the SharePoint tenant admin object, which Microsoft lets an app read only with a write-capable permission: the read-only assessment lists them for you to check by hand, and the guest access expiry and infected file download checks are made only in the SharePoint (full control) assessment.

Note: This is the only 365Posture assessment that holds a write-capable permission. The permission is granted by the setup script (using your own sign-in; Microsoft shows no consent screen for it), for the one read of the SharePoint tenant admin settings, and removed right after; the script checks the removal and, if it cannot confirm it, prints the exact steps to remove it yourself and the report shows a warning. Access tokens issued while the permission was held stay valid until they expire, about 60 to 90 minutes, and exist only on your computer. The setup script also installs the PnP.PowerShell module (a pinned version) and, for this run, keeps only the certificate of the computer you run it on on the 365Posture SharePoint app. If you do not want this, choose the read-only SharePoint assessment: it never asks for a write-capable permission.

Note: Microsoft does not offer Teams meeting, guest, app, channel and messaging policies through Microsoft Graph, so the collector reads them with the Microsoft Teams PowerShell module (read-only Get- commands only; setup installs the module). Teams Reader is a read-only role: it can view the Teams admin centre but cannot change anything, and it is not a mailbox, chat or file permission. It is assigned to the 365Posture app, never to a person, and only for the duration of the Teams collection: setup removes it automatically as soon as the collection finishes (if the removal ever fails, setup prints the exact steps to remove it yourself). To assign and remove it, setup asks you (the signed-in administrator, once, in the browser sign-in) to approve RoleManagement.ReadWrite.Directory on your own login, and only for orders that include Teams; the 365Posture app never receives that permission. The sign-in uses Microsoft Graph Explorer (a Microsoft app), so that approval stays recorded on your account as a Graph Explorer permission after the run; you can revoke it any time in My Apps or the Entra admin centre (Enterprise applications, Graph Explorer, Permissions). Only the settings the checks read are collected, policy names you chose are replaced with anonymous tokens before anything leaves your computer, and no message, chat, meeting or call content is read. If the role cannot be assigned, the Teams checks show as not assessed instead of failing.

Note: Most Defender data comes from Microsoft Graph and from the Defender for Endpoint API, read-only. Alerts and incidents are reduced to counts. Device and domain controller names are shortened to the host name on your computer and replaced with anonymous tokens (device1, device2 ...) before upload, so your report can say which devices need attention; the token map that turns them back stays on your computer. No IP address, device id or user name is collected, and no alert title or alert file name. The exclusion folders, file types and processes in your Intune policies are replaced with anonymous tokens (exclusion1, exclusion2 ...) on your computer before upload, and the token map that turns them back stays on your computer. The Defender for Endpoint onboarding package is never read. The Defender for Office 365 policies (Safe Attachments, Safe Links, anti-phishing) are not available through Microsoft Graph, so the collector reads them with Exchange Online PowerShell (read-only Get- commands only). Security Reader is a read-only role: it can view security settings but cannot change anything, and it is not a mailbox or file permission. It is assigned to the 365Posture app, never to a person, and only for the duration of the Defender collection: setup removes it automatically as soon as the collection finishes (if the removal ever fails, setup prints the exact steps to remove it yourself). To assign and remove it, setup asks you (the signed-in administrator, once, in the browser sign-in) to approve RoleManagement.ReadWrite.Directory on your own login, and only for orders that include Defender; the 365Posture app never receives that permission. The sign-in uses Microsoft Graph Explorer (a Microsoft app), so that approval stays recorded on your account as a Graph Explorer permission after the run; you can revoke it any time in My Apps or the Entra admin centre (Enterprise applications, Graph Explorer, Permissions). The three Defender for Endpoint API permissions are requested only when your tenant has the Defender for Endpoint service; features your licences do not include are never requested and show as not licensed. Policy names you chose are replaced with anonymous tokens before anything leaves your computer. If the role cannot be assigned, the Defender for Office 365 checks show as not assessed instead of failing.

Note: The collector reads which apps have been allowed to reach company data. It never reads mail, files, chats or Copilot prompts, and the names of apps your own organisation registered are replaced with anonymous tokens on your machine before anything is uploaded. Third-party vendor app names, such as the product name of an AI note-taker, stay readable so the report can say which tool it is. The deeper data-protection settings that Copilot relies on are graded in the Purview and SharePoint assessments, not here. Not covered yet: AI agent identities (Entra Agent ID), Power Platform and Copilot Studio agents and connectors, and browser traffic to AI websites (finding shadow AI that way needs Defender for Cloud Apps).