Permissions Explained

365TUNE collects data from Microsoft 365 through the Microsoft Graph API and two other Microsoft APIs, the Office 365 Management APIs and the Power BI REST API. Together they provide secure, read-only access to a wide range of Microsoft 365 services.

1. Application Registration and Permissions

During the initial setup, a Global Administrator grants read-only permissions to 365TUNE, including User.Read.All, Reports.Read.All and others. These permissions allow the tool to retrieve user profile data and usage reports without the ability to modify or delete any data.
365TUNE is registered as an application within Microsoft Entra ID (formerly Azure Active Directory), enabling it to securely access Microsoft 365 data.
365TUNE does not store Global Admin credentials. It uses secure authentication through OAuth 2.0 to access the necessary data.

Below are the detailed breakdown of permissions requested during the onboarding/app registration process.

Microsoft Graph Permissions:

Application permissions (read-only), plus one delegated permission used to sign in.

Permission	Description	What 365TUNE Uses It For
User.Read (delegated)	Sign in and read user profile	Signs in the administrator who grants consent during onboarding and reads their basic profile.
Application.Read.All	Read all applications	Lists registered applications and their permissions for security auditing and identifying apps with excessive permissions.
AuditLog.Read.All	Read all audit log data	Accesses audit logs for sign-ins, file access, mailbox activity, and admin actions to track activity and detect inactive users.
AuditLogsQuery.Read.All	Read audit logs data from all services	Queries the audit log across Microsoft 365 services to report on user and admin activity.
DelegatedAdminRelationship.Read.All	Read Delegated Admin relationships with customers	Automatically discovers which tenants you manage via GDAP and syncs user access based on existing security group mappings.
Directory.Read.All	Read directory data	Accesses user accounts, groups, organizational units, and directory structure to inventory users across managed tenants.
Domain.Read.All	Read domains	Reads the tenant's domains and their settings for security and compliance checks.
eDiscovery.Read.All	Read all eDiscovery objects	Reads eDiscovery cases and settings for compliance posture reporting.
GroupMember.Read.All	Read all group memberships	Reads group memberships to report on access, group-based licensing, and privileged group membership.
InformationProtectionPolicy.Read.All	Read all published labels and label policies for an organization	Reads published sensitivity labels and label policies for compliance assessments.
MailboxSettings.Read	Read all user mailbox settings	Reads mailbox settings such as forwarding rules, automatic replies, and time zone settings. Can't read emails.
Organization.Read.All	Read organization information	Reads tenant details such as organization name and subscribed licenses for license reporting.
Policy.Read.All	Read your organization's policies	Reads Conditional Access, authentication, and authorization policies for security assessments and baseline drift analysis.
RecordsManagement.Read.All	Read Records Management configuration, labels and policies	Reads retention labels and records management settings for compliance assessments.
Reports.Read.All	Read all usage reports	Retrieves Microsoft 365 usage statistics, application usage data, and adoption metrics for usage analysis.
ReportSettings.Read.All	Read all admin report settings	Accesses tenant report settings including privacy settings and report customization options.
RoleManagement.Read.All	Read role management data for all RBAC providers	Reads role definitions and assignments to identify privileged users and detect role assignment drift.
SecurityActions.Read.All	Read your organization's security actions	Reads security actions for your tenant for security posture reporting.
SecurityAlert.Read.All	Read all security alerts	Reads alerts from Microsoft security products for security posture reporting.
Sites.Read.All	Read items in all site collections	Reads SharePoint sites, lists, and their permissions for SharePoint reports and permission analysis.
User.Read.All	Read all users' full profiles	Retrieves user properties including department, job title, manager, office location, and license assignments for reporting and optimization.
UserAuthenticationMethod.Read.All	Read all users' authentication methods	Reads which sign-in methods users have registered to report MFA coverage. Can't read passwords or other secrets.

Other Microsoft API Permissions:

Application permissions (read-only).

API	Permission	Description	What 365TUNE Uses It For
Office 365 Management APIs	ActivityFeed.Read	Read activity data for your organization	Reads the Microsoft 365 activity feed (unified audit log) for user and admin activity.
Power BI Service	Tenant.Read.All	View all content in tenant	Reads the Power BI inventory (workspaces, reports, datasets) for governance reporting.

2. Using Microsoft APIs

After the initial setup and permission approval, 365TUNE interacts only with Microsoft APIs: mainly the Microsoft Graph API, the gateway to Microsoft 365 data, plus the Office 365 Management APIs for activity data and the Power BI REST API for Power BI inventory. These APIs give access to a variety of data, including:
- User data: Information on users, their assigned licenses, and roles.
- Usage data: Activity and usage reports from services like Exchange, Teams, and OneDrive.
365TUNE makes API calls to these Microsoft endpoints to collect this data in real time.

3. Secure Data Access

365TUNE uses OAuth 2.0 tokens to authenticate API requests. These tokens are obtained once the Global Administrator grants consent and are used for subsequent requests to Microsoft Graph and the other Microsoft APIs.
This method ensures that 365TUNE accesses the data securely and does not require storing any sensitive credentials. It operates with the granted read-only permissions, ensuring that it can only view and analyze data without the ability to make changes.
365TUNE sends requests to Microsoft Graph and the other Microsoft APIs to retrieve specific datasets such as:
- User profiles: Data about users, their licenses, and assigned roles.
- Reports: License usage, activity metrics, and other compliance reports.
The data collected is then analyzed and compiled into reports, which help administrators monitor license consumption and user activity across the organization.

Conclusion

365TUNE relies on Microsoft Graph and other official Microsoft 365 APIs for collecting and analyzing data from Microsoft 365. By using secure OAuth 2.0 authentication and read-only permissions, 365TUNE ensures that it can gather important insights without compromising data integrity or requiring continuous admin access. Working only through official Microsoft APIs makes the tool both secure and efficient for reporting and compliance monitoring.

Want to learn more about Entra ID App Registration & Permissions? Head to this articlefrom Microsoft.