Entra-ID Advanced Permissions

Last sign-in audit log information

AuditLog.Read.All Device.Read.All

Fetch users Last Sign-In

Entra ID Intune

DeviceManagementApps.Read.All DeviceManagementConfiguration.Read.All DeviceManagementManagedDevices.Read.All DeviceManagementServiceConfig.Read.All Directory.Read.All (also for SaaS data)

Fetch devices from Intune
Fetch software information from Intune

Allow for enriching Intune devices with their Security Baseline states

DeviceManagementConfiguration.ReadWrite.All

Fetch Security Baseline Device States

Fetch Risky Users information

IdentityRiskyUser.Read.All

Fetch risky users information

Fetch extra custom user flow attributes to be added dynamically to the User’s assets data

IdentityUserFlow.Read.All

Fetch custom user flow attributes

Fetch users

User.Read.All

Default

Fetch authentication method (if the Allow use of Beta API endpoints setting is enabled)

UserAuthenticationMethod.Read.All

Fetch user authentication methods
If you enable this setting and have the additional Policy.Read.All permission, not only the adapter will fetch authentication methods, but also extra information regarding each authentication method’s status — whether they are enabled or disabled.

MCAS data

SecurityEvents.Read.All SecurityEvents.ReadWrite.All
Investigation.Read

Group app roles

Directory.Read.All or AppRoleAssignment.ReadWrite.All

Fetch group app roles

Role data

Directory.Read.All RoleManagement.Read.All

Fetch user app roles

User Contacts data

Contacts.Read

Fetch user contacts

Fetch password validity data

Domain.Read.All

Default

Fetch Device Information Protection - Bitlocker Recovery Key

BitlockerKey.ReadBasic.All

Fetch Device Information Protection - Bitlocker Recovery Key
Fetch Device Configuration Policy Settings for Bitlocker

Fetch mailbox settings for users

MailboxSettings.Read

Fetch mailbox settings for users

Fetch claims policy for enterprise applications

Policy.ReadWrite.ApplicationConfiguration

Fetch claims policy for enterprise applications

Fetch the conditions created or enforced by the Entra ID configuration

Policy.Read.All

Fetch Conditional Access Policies