Auditing permissions
AI summary
The Auditing authenticator in Rencore Governance requests Microsoft permissions to read activity feeds, audit logs, directory data, service health, and service messages. Each permission is paired with the inventory objects that depend on it, so you understand what data access each feature requires.
The permissions Rencore Governance requests through the Auditing authenticator, and the inventory objectsInventory objectAn inventory object is one item Rencore Governance has scanned from a connector, such as a single Team, SharePoint site collection, user or Power App.Read more that rely on each one. Each permission links to its Microsoft documentation.
See Microsoft permissions for every authenticator, and Required permissions for how consent works.
Permissions
| Permission | Description | Type | Used by |
|---|---|---|---|
Read activity feed ActivityFeed.Read (Office 365Microsoft 365Microsoft 365 is the Microsoft cloud suite of Teams, SharePoint, OneDrive, Exchange and the Office apps.Read more Management APIs) | Allows to read activity feed. | Application | |
Read all usage reports Reports.Read.All | Allows an app to read all service usage reports without a signed-in user. Services that provide usage reports include Microsoft 365 and Microsoft Entra IDMicrosoft Entra IDMicrosoft Entra ID, formerly Azure Active Directory, is the Microsoft identity service behind every Microsoft 365 tenant.Read more. | Application | Summary of active user (report) , Trend of daily active user (report) , Copilot user activity (report) , User activity , Usage , User activity , Device usage |
Read audit logAudit logThe audit log records the actions performed in a Rencore Governance Workspace, with who did it and when.Read more AuditLog.Read.All | Allows to read audit log. | Application | Risky Entra ID sign-in , User registration credential |
Read directory data Directory.Read.All | Allows the app to read data in your organization's directory, such as users, groups and apps, without a signed-in user. | Application | Registration certificate , Client secret , Application registration , App role assignment , App role , Deleted app registration certificate , Deleted app client secret , Deleted application registration , Deleted application verified publisher , Device , DeviceOwnerEntity , DeviceUserEntity , Directory role , Domain , Enterprise registration certificate , Enterprise app client secret , Enterprise application verified publisher , Enterprise application , Enterprise application OAuth2 permission scope , EnterpriseApplicationOwnerEntity , OAuth2 permission grant , OAuth2 permission scope , Verified publisher |
Read service health ServiceHealth.Read.All | Allows the app to read service health information. | Application | |
Read service messages ServiceMessage.Read.All | Allows the app to read your tenant's service announcement messages, without a signed-in user. Messages may include information about new or changed features. | Application | Message Center message |
Frequently asked questions
Which permissions does the auditing authenticator request?
6 permissions: Read activity feed, Read all usage reports, Read audit log, Read directory data and 2 more.
What are the Microsoft names of the auditing permissions?
ActivityFeed.Read, Reports.Read.All, AuditLog.Read.All, Directory.Read.All, ServiceHealth.Read.All and ServiceMessage.Read.All.
Are the auditing permissions application or delegated permissions?
All 6 permissions are application permissions.
Which inventories need the auditing permissions?
The inventories of Copilot, Microsoft 365, Teams and Entra ID.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?