Microsoft 365 all services permissions
AI summary
Rencore Governance requests multiple permissions through the Microsoft 365 all services authenticator to access your organizational data. For each permission, you can review its description, see which inventory objects use it, and find Microsoft's documentation.
The permissions Rencore Governance requests through the Microsoft 365Microsoft 365Microsoft 365 is the Microsoft cloud suite of Teams, SharePoint, OneDrive, Exchange and the Office apps.Read more all services authenticator, and the inventory objectsInventory objectAn inventory object is one item Rencore Governance has scanned from a connector, such as a single Team, SharePoint site collection, user or Power App.Read more that rely on each one. Each permission links to its Microsoft documentation.
See Microsoft permissions for every authenticator, and Required permissions for how consent works.
Permissions
| Permission | Description | Type | Used by |
|---|---|---|---|
| Get labels tenant scope. | Allows the app to get sensitivity labelsSensitivity labelA sensitivity label is a Microsoft Purview classification, such as Confidential or Internal, that an organization applies to content and to containers such as Teams and SharePoint sites.Read more. | Application | Sensitivity label |
Read activity feed ActivityFeed.Read (Office 365 Management APIs) | Allows to read activity feed. | Application | |
Read all Viva Engage communitiesViva Engage communityA Viva Engage community is a group in Viva Engage where people share posts, files and events around a team, project or interest.Read more Community.Read.All | Allows the app to list Viva Engage communities, and to read their properties on behalf of the signed-in user. | Application | VivaEngageCommunityMemberEntity , VivaEngageCommunityOwnerEntity , Community |
Read all app catalogs AppCatalog.Read.All | Allows the app to read the apps in the app catalogs. | Application | App |
Read all channel messages ChannelMessage.Read.All | Allows the app to read all channel messages in Microsoft TeamsMicrosoft TeamsMicrosoft Teams is the Microsoft 365 app for chat, meetings and team collaboration.Read more, without a signed-in user. | Application | |
Read all company places Place.Read.All | Allows the app to read company places (conference rooms and room lists) for calendar events and other applications. | Application | Rooms & equipment |
Read all groups Group.Read.All | Allows the app to read memberships for all groups without a signed-in user. Also allows the app to read calendar, conversations, files, and other group content for all groups. | Application | Deleted group , Group , GroupMemberEntity , GroupOwnerEntity , GroupToGroupRelationEntity , Deleted team , Channel , TeamsChannelMemberEntity , Team , TeamsInstalledAppRelationEntity , TeamsMemberEntity , TeamsOwnerEntity , Tab , VivaEngageCommunityMemberEntity , VivaEngageCommunityOwnerEntity , Community |
Read all usage reports Reports.Read.All | Allows an app to read all service usage reports without a signed-in user. Services that provide usage reports include Microsoft 365 and Microsoft Entra IDMicrosoft Entra IDMicrosoft Entra ID, formerly Azure Active Directory, is the Microsoft identity service behind every Microsoft 365 tenant.Read more. | Application | Summary of active user (report) , Trend of daily active user (report) , Copilot user activity (report) , User activity , Usage , User activity , Device usage |
Read all users' full profiles User.Read.All | Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user. | Application | Deleted user , User , TeamsMemberEntity , TeamsOwnerEntity |
Read all users' tasks and tasklist Tasks.Read.All | Allows the app to read all users' tasks and task lists in your organization, without a signed-in user. | Application | Plan , PlannerPlanMemberEntity , PlannerPlanOwnerEntity |
Read audit logAudit logThe audit log records the actions performed in a Rencore Governance Workspace, with who did it and when.Read more AuditLog.Read.All | Allows to read audit log. | Application | Risky Entra ID sign-in , User registration credential |
Read directory data Directory.Read.All | Allows the app to read data in your organization's directory, such as users, groups and apps, without a signed-in user. | Application | Registration certificate , Client secret , Application registration , App role assignment , App role , Deleted app registration certificate , Deleted app client secret , Deleted application registration , Deleted application verified publisher , Device , DeviceOwnerEntity , DeviceUserEntity , Directory role , Domain , Enterprise registration certificate , Enterprise app client secret , Enterprise application verified publisher , Enterprise application , Enterprise application OAuth2 permission scope , EnterpriseApplicationOwnerEntity , OAuth2 permission grant , OAuth2 permission scope , Verified publisher |
| Read file data | Allows the app to read data in your organization's file. | Application | OneDrive |
Read items in all site collectionsSite collectionA site collection is the top-level SharePoint container that holds a root site, its subsites, lists, libraries and files.Read more Sites.Read.All | Allows the app to read documents and list items in all site collections without a signed in user. | Application | GroupSiteCollectionEntity , SharePoint agent , Deleted site collection , List/library , Locked site collection , Site collection , SharePoint special group , Site , TeamsSharePointSiteEntity |
Read organization information Organization.Read.All | Allows the app to read the organization and related resources, without a signed-in user. Related resources include things like subscribed SKUs and tenant branding information. | Application | Subscription , Service assignment , App , UserLicenseEntity , UserServicePlanEntity |
Read service health ServiceHealth.Read.All | Allows the app to read service health information. | Application | |
Read service messages ServiceMessage.Read.All | Allows the app to read your tenant's service announcement messages, without a signed-in user. Messages may include information about new or changed features. | Application | Message Center message |
Read teams' settings TeamSettings.Read.All | Read this team's settings, on behalf of the signed-in user. | Application | |
Read the members of all channels. ChannelMember.Read.All | Read the members of all channels, without a signed-in user. | Application | Shared channel external member , TeamsSharedChannelRelationEntity |
Read the members of all teams. TeamMember.Read.All | Read the members of all teams, without a signed-in user. | Application | |
Read user mailboxMailboxA mailbox is an Exchange Online recipient that stores email, calendar items and contacts.Read more settings MailboxSettings.Read | Allows the app to the read user's mailbox settings. Does not include permission to send mail. | Application | Redirect rule , Mailbox |
Frequently asked questions
Which permissions does the Microsoft 365 all services authenticator request?
Which permissions does the Microsoft 365 all services authenticator request?21 permissions: Get labels tenant scope, Read activity feed, Read all Viva Engage communities, Read all app catalogs and 17 more.
What are the Microsoft names of the Microsoft 365 all services permissions?
What are the Microsoft names of the Microsoft 365 all services permissions?ActivityFeed.Read, Community.Read.All, AppCatalog.Read.All, ChannelMessage.Read.All, Place.Read.All and 14 more.
Are the Microsoft 365 all services permissions application or delegated permissions?
Are the Microsoft 365 all services permissions application or delegated permissions?All 21 permissions are application permissions.
Which inventories need the Microsoft 365 all services permissions?
Which inventories need the Microsoft 365 all services permissions?The inventories of Microsoft 365, Viva Engage, Teams, Copilot, Planner and 4 more.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?