Entra-ID Advanced Permissions

Setting Advanced Permissions

The following table summarizes permissions that Axonius requires to fetch various Entra ID resources.

Use this information to enable required permissions and to only apply necessary permissions.

Azure Service	Permissions	Advanced Configuration
Last sign-in audit log information	`AuditLog.Read.All` `Device.Read.All`	Fetch users Last Sign-In
Entra ID Intune	`DeviceManagementApps.Read.All` `DeviceManagementConfiguration.Read.All` `DeviceManagementManagedDevices.Read.All` `DeviceManagementServiceConfig.Read.All` `Directory.Read.All` (also for SaaS data)	Fetch devices from Intune Fetch software information from Intune
Allow for enriching Intune devices with their Security Baseline states	`DeviceManagementConfiguration.ReadWrite.All`	Fetch Security Baseline Device States
Fetch Risky Users information	`IdentityRiskyUser.Read.All`	Fetch risky users information
Fetch extra custom user flow attributes to be added dynamically to the User’s assets data	`IdentityUserFlow.Read.All`	Fetch custom user flow attributes
Fetch users	`User.Read.All`	Default
Fetch authentication method (if the Allow use of Beta API endpoints setting is enabled)	`UserAuthenticationMethod.Read.All`	Fetch user authentication methods If you enable this setting *and* have the additional `Policy.Read.All` permission, not only the adapter will fetch authentication methods, but also extra information regarding each authentication method’s status — whether they are enabled or disabled.
Group app roles	`Directory.Read.All` or `AppRoleAssignment.ReadWrite.All`	Fetch group app roles
Role data	`Directory.Read.All`	Fetch user app roles
User Contacts data	`Contacts.Read`	Fetch user contacts
Fetch password validity data	`Domain.Read.All`	Default
Fetch Device Information Protection - Bitlocker Recovery Key	`BitlockerKey.ReadBasic.All`	Fetch Device Information Protection - Bitlocker Recovery Key Fetch Device Configuration Policy Settings for Bitlocker
Fetch mailbox settings for users	`MailboxSettings.Read`	Fetch mailbox settings for users
Fetch claims policy for enterprise applications	`Policy.ReadWrite.ApplicationConfiguration`	Fetch claims policy for enterprise applications
Fetch the conditions created or enforced by the Entra ID configuration	`Policy.Read.All`	Fetch Conditional Access Policies
Fetch information about Microsoft Apps Usage	`Reports Reader` role	Fetch Microsoft apps reports
Fetch Office365 activity endpoints (and SaaS data)	`Reports.Read.All`	Fetch date of last activity for M365 product
Allow fetching email activity	`Reports.Read.All`	Fetch email activity from Office 365 in the last X days
Allow fetching licenses and application settings	`Global.Read`	Fetch users license detail
Allow fetching extensions that Entra ID is granted permissions to		Fetch user extensions
Agent identities information	`AgentIdentity.Read.All`	Fetch agent identities
Fetch "Guest" users	`User.Read.All` → `Directory.Read.All`	Fetch "Guest" users
Fetch users images	`ProfilePhoto.Read.All` → `User.Read.All`	Fetch users images
Fetch devices from Intune	`DeviceManagementManagedDevices.Read.All`	Fetch devices from Intune
Fetch user groups	`Group.Read.All` (covers members too) or `GroupMember.Read.All` + `Group.Read.All` → `Directory.Read.All`	Fetch user groups
Fetch user assigned roles	`RoleManagement.Read.Directory` → `Directory.Read.All`	Fetch user assigned roles
Fetch users Last Sign-In	`AuditLog.Read.All` `Directory.Read.All` (Graph requires both in app context)	Fetch users Last Sign-In
Fetch user authentication methods	`UserAuthenticationMethod.Read.All` `Policy.Read.All` `Reports.Read.All`	Fetch user authentication methods
Fetch mobile devices	`Device.Read.All`	Fetch mobile devices
Fetch Users' Managers	`User.Read.All` → `Directory.Read.All`	Fetch Users' Managers
Fetch Conditional Access Policies	`Policy.Read.All` or `Policy.Read.ConditionalAccess`	Fetch Conditional Access Policies
Fetch audit logs	`AuditLog.Read.All` `Directory.Read.All`	Fetch audit logs
Fetch all directory roles	`RoleManagement.Read.Directory` → `Directory.Read.All`	Fetch all directory roles
Fetch all role definitions	`RoleManagement.Read.Directory` → `Directory.Read.All`	Fetch all role definitions
Enable real-time asset updates	`User.Read.All` + `Group.Read.All` → `Directory.Read.All`	Enable real-time asset updates
Fetch applications that do not require assignment	`Application.Read.All` + `DelegatedPermissionGraad.All`	Fetch applications that do not require assignment
Fetch service principal as Users	`Application.Read.All` + `DelegatedPermissionGrant.Read.All` Add the following permissions for additional data: `AuditLog.Read.All` for SP sign-ins `Synchronization.Read.All` for provisioning status `Policy.Read.All for claims policy`	Fetch service principal as Users
Fetch Reports & Microsoft 365 Apps Settings (Graph API)	`ReportSettings.Read.All` + `OrgSettings-Microsoft365Install.Read.All`	Fetch Reports & Microsoft 365 Apps Settings (Graph API)

Enforcement Action Permissions

To use the Entra ID Enforcement Actions, the following permissions are required:

Supported Resource	Delegated	Application
device	`GroupMember.ReadWrite.All` `Device.ReadWrite.All`	`GroupMember.ReadWrite.All` `Device.ReadWrite.All`
group	`GroupMember.ReadWrite.All` `Group.ReadWrite.All`	`GroupMember.ReadWrite.All` `Group.ReadWrite.All`
orgContact	`GroupMember.ReadWrite.All` `OrgContact.Read.All`	`GroupMember.ReadWrite.All` `OrgContact.Read.Al`
group	`GroupMember.ReadWrite.All` `Group.ReadWrite.All`	`GroupMember.ReadWrite.All` `Group.ReadWrite.All`
servicePrincipal	`GroupMember.ReadWrite.All` `Application.ReadWrite.All`	`GroupMember.ReadWrite.All` `Application.ReadWrite.All`
user	`GroupMember.ReadWrite.All` `User.ReadWrite.All`	`GroupMember.ReadWrite.All` `User.ReadWrite.All`

Updated 7 days ago

Did this page help you?