Permission reference¶

24 Microsoft Graph application permissions are required. All are read-only (*.Read.All / *.Read.Directory); LicenseLens never grants write access.

Permission
`AccessReview.Read.All`
`Application.Read.All`
`AuditLog.Read.All`
`CustomDetection.Read.All`
`DelegatedPermissionGrant.Read.All`
`Device.Read.All`
`DeviceManagementApps.Read.All`
`DeviceManagementConfiguration.Read.All`
`DeviceManagementManagedDevices.Read.All`
`Directory.Read.All`
`DlpPolicy.Read.All`
`Domain.Read.All`
`EntitlementManagement.Read.All`
`IdentityRiskyServicePrincipal.Read.All`
`Organization.Read.All`
`Policy.Read.All`
`RoleManagement.Read.Directory`
`SecurityAlert.Read.All`
`SecurityEvents.Read.All`
`SecurityIdentitiesHealth.Read.All`
`SecurityIdentitiesSensors.Read.All`
`SecurityIncident.Read.All`
`User.Read.All`
`eDiscovery.Read.All`

PowerShell bridge modules¶

Exchange Online, Teams, SharePoint, and Power Platform surfaces are collected through the allowlisted PowerShell bridge using official modules only:

Defender for Endpoint API (separate resource)
Exchange Online / Security & Compliance (PowerShell bridge)
Microsoft Graph (application permissions)
Microsoft Sentinel / selective Azure (Azure RBAC)
Power BI / Fabric admin REST (separate resource)
Teams / SharePoint Online / OneDrive (PowerShell bridge)

The authoritative per-operation matrix lives in src/licenselens/graph_ops.py and the purpose of each permission in permissions.md.