collect.manifest.json
|
{ "version": "1.0", "generated": "derived from packages/collectors/fixtures — run `bun run collect:manifest`", "scopes": { "baseline": [ "Application.Read.All", "AuditLog.Read.All", "Directory.Read.All", "ExternalConnection.Read.All", "Group.Read.All", "IdentityRiskyUser.Read.All", "Organization.Read.All", "Policy.Read.All", "ReportSettings.Read.All", "Reports.Read.All", "RoleManagement.Read.Directory", "User.Read.All", "UserAuthenticationMethod.Read.All" ], "optional": { "AgentIdentity": { "description": "Entra Agent ID inventory and ownership checks (preview capability).", "scopes": [ "AgentIdentity.Read.All" ] }, "Copilot": { "description": "Microsoft 365 Copilot package and tenant policy checks.", "scopes": [ "CopilotPackages.Read.All", "CopilotPolicySettings.Read", "CopilotSettings-LimitedMode.Read" ] }, "Defender": { "description": "Defender security posture, incidents, and Cloud App Discovery checks.", "scopes": [ "CloudApp-Discovery.Read.All", "SecurityEvents.Read.All", "SecurityIncident.Read.All" ] }, "eDiscovery": { "description": "Microsoft Purview eDiscovery case checks.", "scopes": [ "eDiscovery.Read.All" ] }, "Intune": { "description": "Microsoft Intune managed-device and detected-app checks.", "scopes": [ "DeviceManagementManagedDevices.Read.All" ] }, "Purview": { "description": "Microsoft Purview sensitivity-label and records-management checks.", "scopes": [ "InformationProtectionPolicy.Read.All", "RecordsManagement.Read.All" ] }, "SharePoint": { "description": "SharePoint tenant settings checks.", "scopes": [ "SharePointTenantSettings.Read.All" ] }, "Teams": { "description": "Teams app catalog and user configuration checks.", "scopes": [ "AppCatalog.Read.All", "TeamsUserConfiguration.Read.All" ] } } }, "collectors": [ { "key": "graph.admin.reportSettings", "module": "core", "evidence": [ { "endpoint": "/v1.0/admin/reportSettings", "method": "GET", "kind": "single", "permission": "ReportSettings.Read.All" } ] }, { "key": "graph.admin.sharepoint.settings", "module": "core", "evidence": [ { "endpoint": "/v1.0/admin/sharepoint/settings", "method": "GET", "kind": "single", "permission": "SharePointTenantSettings.Read.All" } ], "optionalScopeGroups": [ "SharePoint" ] }, { "key": "graph.admin.teams.userConfigurations", "module": "core", "evidence": [ { "endpoint": "/v1.0/admin/teams/userConfigurations", "method": "GET", "kind": "paged", "permission": "TeamsUserConfiguration.Read.All" } ], "optionalScopeGroups": [ "Teams" ] }, { "key": "graph.agentIdentityBlueprints", "module": "core", "evidence": [ { "endpoint": "/v1.0/agentIdentityBlueprints?$select=id,displayName,description,createdDateTime,publisherName&$top=100", "method": "GET", "kind": "paged", "permission": "AgentIdentity.Read.All" } ], "optionalScopeGroups": [ "AgentIdentity" ] }, { "key": "graph.appCatalogs.teamsApps", "module": "core", "slow": true, "evidence": [ { "endpoint": "/beta/appCatalogs/teamsApps?$expand=appDefinitions&$filter=distributionMethod eq 'organization'", "method": "GET", "kind": "paged", "permission": "AppCatalog.Read.All" }, { "endpoint": "/beta/appCatalogs/teamsApps?$expand=appDefinitions&$filter=distributionMethod eq 'store'", "method": "GET", "kind": "paged", "permission": "AppCatalog.Read.All" } ], "optionalScopeGroups": [ "Teams" ] }, { "key": "graph.auditLogs.signIns.legacy", "module": "core", "slow": true, "evidence": [ { "endpoint": "/v1.0/auditLogs/signIns?$filter=createdDateTime ge 2026-08-18T09:00:00.000Z and (clientAppUsed eq 'Authenticated SMTP' or clientAppUsed eq 'Exchange ActiveSync' or ...)&$top=1000", "method": "GET", "kind": "paged", "permission": "AuditLog.Read.All" } ] }, { "key": "graph.copilot.admin.catalog.packages", "module": "core", "evidence": [ { "endpoint": "/beta/copilot/admin/catalog/packages?$top=100", "method": "GET", "kind": "paged", "permission": "CopilotPackages.Read.All" } ], "optionalScopeGroups": [ "Copilot" ] }, { "key": "graph.copilot.reports.usageUserDetail", "module": "core", "evidence": [ { "endpoint": "/v1.0/reports/getMicrosoft365CopilotUsageUserDetail(period='D30')", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" } ] }, { "key": "graph.copilot.reports.userCountSummary", "module": "core", "evidence": [ { "endpoint": "/v1.0/reports/getMicrosoft365CopilotUserCountSummary(period='D30')", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" } ] }, { "key": "graph.copilot.reports.userCountTrend", "module": "core", "evidence": [ { "endpoint": "/v1.0/reports/getMicrosoft365CopilotUserCountTrend(period='D30')", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" } ] }, { "key": "graph.copilot.reports.userCountTrend.v2", "module": "core", "evidence": [ { "endpoint": "/beta/copilot/reports/getMicrosoft365CopilotUserCountTrend(period='D28',version='v2')", "method": "GET", "kind": "paged", "permission": "Reports.Read.All" } ] }, { "key": "graph.delegated.copilot.limitedMode", "module": "core", "delegated": true, "evidence": [ { "endpoint": "/v1.0/copilot/admin/settings/limitedMode", "method": "GET", "kind": "single", "permission": "CopilotSettings-LimitedMode.Read" } ], "optionalScopeGroups": [ "Copilot" ] }, { "key": "graph.delegated.copilot.policySettings", "module": "core", "delegated": true, "evidence": [ { "endpoint": "/beta/copilot/admin/policySettings/microsoft.copilot.allowwebsearch", "method": "GET", "kind": "single", "permission": "CopilotPolicySettings.Read" }, { "endpoint": "/beta/copilot/admin/policySettings/microsoft.copilot.copilotchatpinning", "method": "GET", "kind": "single", "permission": "CopilotPolicySettings.Read" }, { "endpoint": "/beta/copilot/admin/policySettings/microsoft.copilot.blockaccesstoopenfiles", "method": "GET", "kind": "single", "permission": "CopilotPolicySettings.Read" }, { "endpoint": "/beta/copilot/admin/policySettings/microsoft.copilot.imagegeneration", "method": "GET", "kind": "single", "permission": "CopilotPolicySettings.Read" }, { "endpoint": "/beta/copilot/admin/policySettings/microsoft.copilot.allowinadmincenters", "method": "GET", "kind": "single", "permission": "CopilotPolicySettings.Read" } ], "optionalScopeGroups": [ "Copilot" ] }, { "key": "graph.deviceManagement.managedDevices", "module": "core", "evidence": [ { "endpoint": "/v1.0/deviceManagement/managedDevices?$select=id,deviceName,complianceState,operatingSystem,osVersion,lastSyncDateTime,managedDeviceOwnerType,userPrincipalName", "method": "GET", "kind": "paged", "permission": "DeviceManagementManagedDevices.Read.All" } ], "optionalScopeGroups": [ "Intune" ] }, { "key": "graph.directoryRoles", "module": "core", "evidence": [ { "endpoint": "/v1.0/directoryRoles?$expand=members", "method": "GET", "kind": "paged", "permission": "RoleManagement.Read.Directory" } ] }, { "key": "graph.external.connections", "module": "core", "evidence": [ { "endpoint": "/v1.0/external/connections", "method": "GET", "kind": "paged", "permission": "ExternalConnection.Read.All" } ] }, { "key": "graph.groups.assignedLabels", "module": "core", "evidence": [ { "endpoint": "/v1.0/groups?$select=id,displayName,visibility,groupTypes,assignedLabels,resourceProvisioningOptions,createdDateTime", "method": "GET", "kind": "paged", "permission": "Group.Read.All" } ] }, { "key": "graph.groups.licenseAssignments", "module": "core", "evidence": [ { "endpoint": "/v1.0/groups?$count=true&$filter=assignedLicenses/$count ne 0&$select=id,displayName,assignedLicenses,licenseProcessingState", "method": "GET", "kind": "paged", "permission": "Group.Read.All" }, { "endpoint": "/v1.0/groups?$filter=hasMembersWithLicenseErrors eq true&$select=id,displayName", "method": "GET", "kind": "paged", "permission": "Group.Read.All" }, { "endpoint": "/v1.0/subscribedSkus", "method": "GET", "kind": "paged", "permission": "Organization.Read.All" } ] }, { "key": "graph.groups.owners", "module": "core", "evidence": [ { "endpoint": "/v1.0/groups?$select=id,displayName,groupTypes,visibility,resourceProvisioningOptions", "method": "GET", "kind": "paged", "permission": "Group.Read.All" }, { "endpoint": "/v1.0/groups/{id}/owners?$select=id,userPrincipalName,accountEnabled,userType", "method": "GET", "kind": "paged", "permission": "Group.Read.All" } ] }, { "key": "graph.identity.conditionalAccess.policies", "module": "core", "evidence": [ { "endpoint": "/v1.0/identity/conditionalAccess/policies", "method": "GET", "kind": "paged", "permission": "Policy.Read.All" } ] }, { "key": "graph.identityProtection.riskyUsers", "module": "core", "evidence": [ { "endpoint": "/v1.0/identityProtection/riskyUsers", "method": "GET", "kind": "paged", "permission": "IdentityRiskyUser.Read.All" } ] }, { "key": "graph.intune.detectedApps", "module": "core", "evidence": [ { "endpoint": "/beta/deviceManagement/detectedApps", "method": "GET", "kind": "paged", "permission": "DeviceManagementManagedDevices.Read.All" }, { "endpoint": "/v1.0/deviceManagement/managedDevices?$select=id,operatingSystem", "method": "GET", "kind": "paged", "permission": "DeviceManagementManagedDevices.Read.All" } ], "optionalScopeGroups": [ "Intune" ] }, { "key": "graph.policies.authorizationPolicy", "module": "core", "evidence": [ { "endpoint": "/v1.0/policies/authorizationPolicy", "method": "GET", "kind": "single", "permission": "Policy.Read.All" } ] }, { "key": "graph.policies.crossTenantAccess", "module": "core", "evidence": [ { "endpoint": "/v1.0/policies/crossTenantAccessPolicy/default", "method": "GET", "kind": "single", "permission": "Policy.Read.All" }, { "endpoint": "/v1.0/policies/crossTenantAccessPolicy/partners", "method": "GET", "kind": "paged", "permission": "Policy.Read.All" } ] }, { "key": "graph.policies.identitySecurityDefaults", "module": "core", "evidence": [ { "endpoint": "/v1.0/policies/identitySecurityDefaultsEnforcementPolicy", "method": "GET", "kind": "single", "permission": "Policy.Read.All" } ] }, { "key": "graph.policies.permissionGrantPolicies", "module": "core", "evidence": [ { "endpoint": "/v1.0/policies/permissionGrantPolicies?$expand=includes", "method": "GET", "kind": "paged", "permission": "Policy.Read.All" }, { "endpoint": "/v1.0/policies/permissionGrantPolicies?$expand=excludes", "method": "GET", "kind": "paged", "permission": "Policy.Read.All" } ] }, { "key": "graph.reports.authenticationMethods.userRegistrationDetails", "module": "core", "evidence": [ { "endpoint": "/v1.0/reports/authenticationMethods/userRegistrationDetails", "method": "GET", "kind": "paged", "permission": "UserAuthenticationMethod.Read.All" } ] }, { "key": "graph.reports.emailActivityUserDetail", "module": "core", "evidence": [ { "endpoint": "/v1.0/reports/getEmailActivityUserDetail(period='D30')", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" } ] }, { "key": "graph.reports.m365AppUserDetail", "module": "core", "evidence": [ { "endpoint": "/v1.0/reports/getM365AppUserDetail(period='D30')", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" } ] }, { "key": "graph.reports.office365ActivationsUserDetail", "module": "core", "evidence": [ { "endpoint": "/v1.0/reports/getOffice365ActivationsUserDetail", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" } ] }, { "key": "graph.reports.office365ActiveUserDetail", "module": "core", "evidence": [ { "endpoint": "/v1.0/reports/getOffice365ActiveUserDetail(period='D30')", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" } ] }, { "key": "graph.reports.oneDriveActivityUserDetail", "module": "core", "evidence": [ { "endpoint": "/v1.0/reports/getOneDriveActivityUserDetail(period='D30')", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" } ] }, { "key": "graph.reports.oneDriveUsageAccountDetail", "module": "core", "evidence": [ { "endpoint": "/v1.0/reports/getOneDriveUsageAccountDetail(period='D30')", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" }, { "endpoint": "/v1.0/reports/getOffice365ServicesUserCounts(period='D30')", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" } ] }, { "key": "graph.reports.sharePointActivityUserDetail", "module": "core", "evidence": [ { "endpoint": "/v1.0/reports/getSharePointActivityUserDetail(period='D30')", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" } ] }, { "key": "graph.reports.sharePointSiteUsageDetail", "module": "core", "slow": true, "evidence": [ { "endpoint": "/v1.0/reports/getSharePointSiteUsageDetail(period='D30')", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" } ] }, { "key": "graph.reports.teamsUserActivityUserDetail", "module": "core", "evidence": [ { "endpoint": "/v1.0/reports/getTeamsUserActivityUserDetail(period='D30')", "method": "CSV", "kind": "csv", "permission": "Reports.Read.All" } ] }, { "key": "graph.roleManagement.roleAssignments", "module": "core", "evidence": [ { "endpoint": "/v1.0/roleManagement/directory/roleAssignments?$filter=directoryScopeId eq '/'&$expand=principal", "method": "GET", "kind": "paged", "permission": "RoleManagement.Read.Directory" } ] }, { "key": "graph.roleManagement.roleEligibilitySchedules", "module": "core", "evidence": [ { "endpoint": "/v1.0/roleManagement/directory/roleEligibilitySchedules?$expand=principal", "method": "GET", "kind": "paged", "permission": "RoleManagement.Read.Directory" } ] }, { "key": "graph.security.cloudAppDiscovery.aggregatedApps", "module": "core", "slow": true, "evidence": [ { "endpoint": "/beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreams", "method": "GET", "kind": "paged", "permission": "CloudApp-Discovery.Read.All" }, { "endpoint": "/beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/9f8e7d6c-1111-4a2b-8c3d-0e1f2a3b4c60/aggregatedAppsDetails(period=duration'P30D')?$filter=category eq 'Generative AI'", "method": "GET", "kind": "paged", "permission": "CloudApp-Discovery.Read.All" }, { "endpoint": "/beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/{streamId}/aggregatedAppsDetails/{appId}/users", "method": "GET", "kind": "paged", "permission": "CloudApp-Discovery.Read.All" }, { "endpoint": "/v1.0/users/$count?$filter=userType eq 'Member' and accountEnabled eq true", "method": "GET", "kind": "single", "permission": "User.Read.All" } ], "optionalScopeGroups": [ "Defender" ] }, { "key": "graph.security.ediscoveryCases", "module": "core", "evidence": [ { "endpoint": "/v1.0/security/cases/ediscoveryCases?$select=id,status,createdDateTime,lastModifiedDateTime,closedDateTime", "method": "GET", "kind": "paged", "permission": "eDiscovery.Read.All" } ], "optionalScopeGroups": [ "eDiscovery" ] }, { "key": "graph.security.incidents", "module": "core", "evidence": [ { "endpoint": "/v1.0/security/incidents?$filter=status eq 'active' or status eq 'inProgress' or status eq 'awaitingAction'", "method": "GET", "kind": "paged", "permission": "SecurityIncident.Read.All" } ], "optionalScopeGroups": [ "Defender" ] }, { "key": "graph.security.informationProtection.sensitivityLabels", "module": "core", "evidence": [ { "endpoint": "/beta/security/informationProtection/sensitivityLabels", "method": "GET", "kind": "paged", "permission": "InformationProtectionPolicy.Read.All" } ], "optionalScopeGroups": [ "Purview" ] }, { "key": "graph.security.retentionLabels", "module": "core", "evidence": [ { "endpoint": "/v1.0/security/labels/retentionLabels", "method": "GET", "kind": "paged", "permission": "RecordsManagement.Read.All" } ], "optionalScopeGroups": [ "Purview" ] }, { "key": "graph.security.secureScoreControlProfiles", "module": "core", "evidence": [ { "endpoint": "/v1.0/security/secureScoreControlProfiles", "method": "GET", "kind": "paged", "permission": "SecurityEvents.Read.All" }, { "endpoint": "/v1.0/security/secureScores?$top=1", "method": "GET", "kind": "single", "permission": "SecurityEvents.Read.All" } ], "optionalScopeGroups": [ "Defender" ] }, { "key": "graph.security.secureScores", "module": "core", "evidence": [ { "endpoint": "/v1.0/security/secureScores?$top=1", "method": "GET", "kind": "single", "permission": "SecurityEvents.Read.All" } ], "optionalScopeGroups": [ "Defender" ] }, { "key": "graph.servicePrincipals.agentIdentities", "module": "core", "evidence": [ { "endpoint": "/v1.0/servicePrincipals/microsoft.graph.agentIdentity?$select=id,appId,displayName,accountEnabled,createdDateTime,servicePrincipalType,tags&$expand=owners&$top=100", "method": "GET", "kind": "paged", "permission": "AgentIdentity.Read.All" }, { "endpoint": "/v1.0/servicePrincipals/{id}/owners ($batch)", "method": "GET", "kind": "paged", "permission": "AgentIdentity.Read.All" } ], "optionalScopeGroups": [ "AgentIdentity" ] }, { "key": "graph.servicePrincipals.highPrivilege", "module": "core", "slow": true, "evidence": [ { "endpoint": "/v1.0/servicePrincipals?$select=id,appId,displayName,servicePrincipalType,accountEnabled,appOwnerOrganizationId,verifiedPublisher,tags", "method": "GET", "kind": "paged", "permission": "Application.Read.All" }, { "endpoint": "/v1.0/oauth2PermissionGrants", "method": "GET", "kind": "paged", "permission": "Directory.Read.All" }, { "endpoint": "/v1.0/servicePrincipals(appId='00000003-0000-0000-c000-000000000000')?$select=id,appId,appRoles", "method": "GET", "kind": "single", "permission": "Application.Read.All" }, { "endpoint": "/v1.0/servicePrincipals/sp-graph/appRoleAssignedTo", "method": "GET", "kind": "paged", "permission": "Application.Read.All" } ] }, { "key": "graph.subscribedSkus", "module": "core", "evidence": [ { "endpoint": "/v1.0/subscribedSkus", "method": "GET", "kind": "paged", "permission": "Organization.Read.All" } ] }, { "key": "graph.users", "module": "core", "evidence": [ { "endpoint": "/v1.0/users?$select=id,userPrincipalName,displayName,department,jobTitle,accountEnabled,userType,createdDateTime,assignedLicenses,signInActivity", "method": "GET", "kind": "paged", "permission": "User.Read.All" } ] }, { "key": "graph.users.guests", "module": "core", "evidence": [ { "endpoint": "/v1.0/users?$filter=userType eq 'Guest'&$select=id,userPrincipalName,displayName,mail,createdDateTime,accountEnabled,externalUserState,assignedLicenses,signInActivity", "method": "GET", "kind": "paged", "permission": "User.Read.All" } ] }, { "key": "graph.users.licenses", "module": "core", "evidence": [ { "endpoint": "/v1.0/users?$select=id,userPrincipalName,displayName,department,accountEnabled,userType,usageLocation,assignedLicenses,licenseAssignmentStates", "method": "GET", "kind": "paged", "permission": "User.Read.All" }, { "endpoint": "/v1.0/subscribedSkus", "method": "GET", "kind": "paged", "permission": "Organization.Read.All" } ] } ], "excluded": [ { "key": "graph.security.runHuntingQuery.aiNetworkEvents", "reason": "evidence uses method POST, which the PowerShell collector does not issue" }, { "key": "graph.security.runHuntingQuery.labelledFileEgress", "reason": "evidence uses method POST, which the PowerShell collector does not issue" }, { "key": "mde.machines", "reason": "Defender API host (api.securitycenter.microsoft.com), not Graph" }, { "key": "ps.azure.aiServices", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.azure.defenderForCloudSecureScore", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.azure.policyCompliance", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.azure.rbacSprawl", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.azure.subscriptions", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.exo.adminAuditLogConfig", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.exo.mailboxAuditBypass", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.exo.mailboxesAuditDisabled", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.exo.organizationConfig", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.exo.recipients", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.pnp.uniquePermissionsSample", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.powerplatform.dlpPolicies", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.powerplatform.environments", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.powerplatform.flows", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.powerplatform.inventory.agents", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.scc.appRetentionCompliancePolicies", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.scc.autoSensitivityLabelPolicies", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.scc.dlpCompliancePolicies", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.scc.dlpSensitiveInformationTypes", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.scc.exportActivityExplorerData.labelApplied", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.scc.insiderRiskPolicies", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.scc.labelPolicies", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.scc.labels", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.scc.protectionAlerts", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.scc.retentionCompliancePolicies", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.scc.supervisoryReviewPolicies", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.spo.dataAccessGovernance", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.spo.siteLifecycle", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.spo.sites", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.spo.tenant", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.spo.tenantRestrictedSearchMode", "reason": "PowerShell module script (localScript path)" }, { "key": "ps.teams.meetingPolicies", "reason": "PowerShell module script (localScript path)" }, { "key": "graph.users.mailboxSettingsProbe", "reason": "GET /users/{id}/mailboxSettings is not supported tenant-wide by delegated MailboxSettings.Read; the application permission is deliberately not requested" } ], "scopeAudit": { "permissionType": "delegated", "client": "Microsoft Graph PowerShell (Connect-MgGraph)", "result": "Every listed scope is a delegated Microsoft Graph permission; evidence.permission records the consuming operation.", "excluded": [ { "scope": "MailboxSettings.Read", "collector": "graph.users.mailboxSettingsProbe", "operation": "GET /users/{id}/mailboxSettings via /$batch", "reason": "The delegated permission covers the signed-in user mailbox, not tenant-wide mailbox settings. The tenant-wide operation requires application permission, which interactive Connect-MgGraph does not request." } ], "permissions": [ { "scope": "AgentIdentity.Read.All", "selection": "AgentIdentity", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.agentIdentityBlueprints", "graph.servicePrincipals.agentIdentities" ] }, { "scope": "AppCatalog.Read.All", "selection": "Teams", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.appCatalogs.teamsApps" ] }, { "scope": "Application.Read.All", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.servicePrincipals.highPrivilege" ] }, { "scope": "AuditLog.Read.All", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.auditLogs.signIns.legacy" ] }, { "scope": "CloudApp-Discovery.Read.All", "selection": "Defender", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.security.cloudAppDiscovery.aggregatedApps" ] }, { "scope": "CopilotPackages.Read.All", "selection": "Copilot", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.copilot.admin.catalog.packages" ] }, { "scope": "CopilotPolicySettings.Read", "selection": "Copilot", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.delegated.copilot.policySettings" ] }, { "scope": "CopilotSettings-LimitedMode.Read", "selection": "Copilot", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.delegated.copilot.limitedMode" ] }, { "scope": "DeviceManagementManagedDevices.Read.All", "selection": "Intune", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.deviceManagement.managedDevices", "graph.intune.detectedApps" ] }, { "scope": "Directory.Read.All", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.servicePrincipals.highPrivilege" ] }, { "scope": "ExternalConnection.Read.All", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.external.connections" ] }, { "scope": "Group.Read.All", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.groups.assignedLabels", "graph.groups.licenseAssignments", "graph.groups.owners" ] }, { "scope": "IdentityRiskyUser.Read.All", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.identityProtection.riskyUsers" ] }, { "scope": "InformationProtectionPolicy.Read.All", "selection": "Purview", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.security.informationProtection.sensitivityLabels" ] }, { "scope": "Organization.Read.All", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.groups.licenseAssignments", "graph.subscribedSkus", "graph.users.licenses" ] }, { "scope": "Policy.Read.All", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.identity.conditionalAccess.policies", "graph.policies.authorizationPolicy", "graph.policies.crossTenantAccess", "graph.policies.identitySecurityDefaults", "graph.policies.permissionGrantPolicies" ] }, { "scope": "RecordsManagement.Read.All", "selection": "Purview", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.security.retentionLabels" ] }, { "scope": "ReportSettings.Read.All", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.admin.reportSettings" ] }, { "scope": "Reports.Read.All", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.copilot.reports.usageUserDetail", "graph.copilot.reports.userCountSummary", "graph.copilot.reports.userCountTrend", "graph.copilot.reports.userCountTrend.v2", "graph.reports.emailActivityUserDetail", "graph.reports.m365AppUserDetail", "graph.reports.office365ActivationsUserDetail", "graph.reports.office365ActiveUserDetail", "graph.reports.oneDriveActivityUserDetail", "graph.reports.oneDriveUsageAccountDetail", "graph.reports.sharePointActivityUserDetail", "graph.reports.sharePointSiteUsageDetail", "graph.reports.teamsUserActivityUserDetail" ] }, { "scope": "RoleManagement.Read.Directory", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.directoryRoles", "graph.roleManagement.roleAssignments", "graph.roleManagement.roleEligibilitySchedules" ] }, { "scope": "SecurityEvents.Read.All", "selection": "Defender", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.security.secureScoreControlProfiles", "graph.security.secureScores" ] }, { "scope": "SecurityIncident.Read.All", "selection": "Defender", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.security.incidents" ] }, { "scope": "SharePointTenantSettings.Read.All", "selection": "SharePoint", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.admin.sharepoint.settings" ] }, { "scope": "TeamsUserConfiguration.Read.All", "selection": "Teams", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.admin.teams.userConfigurations" ] }, { "scope": "User.Read.All", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.security.cloudAppDiscovery.aggregatedApps", "graph.users", "graph.users.guests", "graph.users.licenses" ] }, { "scope": "UserAuthenticationMethod.Read.All", "selection": "baseline", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.reports.authenticationMethods.userRegistrationDetails" ] }, { "scope": "eDiscovery.Read.All", "selection": "eDiscovery", "permissionType": "delegated", "graphPowerShellClient": true, "collectors": [ "graph.security.ediscoveryCases" ] } ] } } |