Microsoft permissions RAIDEN requests

When you connect your Microsoft 365 tenant, RAIDEN requests a defined set of permissions through Microsoft’s standard admin-consent flow. This page lists exactly what RAIDEN asks for, grouped by the Microsoft API it belongs to, with a plain-language note on what each permission is used for. Everything here is documented to match RAIDEN’s actual consent manifest. The vast majority of permissions are read-only — RAIDEN reads your sign-in, mailbox, directory, and security data to detect and investigate threats. A small number of write permissions exist solely to carry out response actions, and those only run when you explicitly choose to take an action.

RAIDEN requests these permissions tenant-wide via admin consent. The connector reads your data to run detections and build investigations; it does not modify anything unless you opt into a response action.

Microsoft Graph — read (detection & enrichment)

These are the core read permissions RAIDEN uses to ingest activity and enrich investigations. They are always requested.

Permission	What it’s for
`User.Read.All`	Read user profiles across the directory so findings can be attributed to the right account.
`AuditLog.Read.All`	Read Entra ID sign-in and audit logs — the primary feed for identity and account-takeover detection.
`AuditLogsQuery.Read.All`	Query unified audit log data for investigation and historical lookback.
`Directory.Read.All`	Read directory objects (users, groups, roles) to understand account context and privilege.
`SecurityEvents.Read.All`	Read Microsoft security alerts so RAIDEN can correlate them into Cases.
`SecurityIncident.Read.All`	Read Microsoft 365 Defender incidents for correlation with RAIDEN findings.
`IdentityRiskEvent.Read.All`	Read Entra ID Protection risk detections (risky sign-ins).
`IdentityRiskyUser.Read.All`	Read Entra ID Protection risky-user state.
`IdentityRiskyServicePrincipal.Read.All`	Read risky service principal / app risk state.
`Policy.Read.All`	Read tenant policies, including Conditional Access, to assess control posture.
`Reports.Read.All`	Read usage and security reports for context and enrichment.
`UserAuthenticationMethod.Read.All`	Read registered authentication methods (MFA configuration) for accounts under investigation.
`ThreatHunting.Read.All`	Run advanced hunting (KQL) queries across Microsoft 365 Defender data.
`Application.Read.All`	Read app registrations and service principals to investigate OAuth consent abuse.
`Device.Read.All`	Read device objects from the directory for device context.
`DeviceManagementManagedDevices.Read.All`	Read Intune managed-device inventory for device context.
`Domain.Read.All`	Read verified domains for the tenant.
`Organization.Read.All`	Read tenant-level organization details.
`DelegatedAdminRelationship.Read.All`	Read delegated admin (GDAP) relationships — used in partner / MSSP scenarios.
`Mail.Read`	Read mailbox messages for business-email-compromise investigation (e.g. inspecting suspect messages).

Microsoft Graph — write / response actions (used only when you take an action)

These permissions exist so RAIDEN can carry out response actions. They are not used during routine detection — they run only when you explicitly trigger the corresponding action.

Permission	What it’s for
`Mail.ReadWrite`	Take mailbox response actions, such as removing or quarantining a malicious message during BEC remediation.
`MailboxSettings.ReadWrite`	Modify mailbox settings as part of response — for example, removing an attacker-created forwarding or inbox rule.
`Policy.ReadWrite.ConditionalAccess`	Apply Conditional Access changes as a response action (e.g. tightening access for a compromised account).
`User.ReadWrite.All`	Used for account-level response actions today — revoking a user’s active sign-in sessions and disabling a compromised account.

Account response uses a broad scope today. Account session-revoke and account-disable currently rely on the broad User.ReadWrite.All scope. RAIDEN’s response code references narrower operations (User.RevokeSessions.All and User.EnableDisableAccount.All), but those granular scopes are not what the consent manifest requests today — the manifest requests User.ReadWrite.All. Moving account response to least-privilege granular scopes is tracked as separate work.

DeviceManagementManagedDevices.PrivilegedOperations.All is requested in the manifest but is reserved and currently unused — no RAIDEN code path performs a privileged device operation. It is listed here for transparency, not as an active response action.

Microsoft Defender for Endpoint (WindowsDefenderATP)

If you use Microsoft Defender for Endpoint, RAIDEN requests these permissions to pull endpoint context into investigations. All are read-only.

Permission	What it’s for
`Machine.Read.All`	Read device (machine) information from Defender for Endpoint.
`Alert.Read.All`	Read Defender for Endpoint alerts for correlation into Cases.
`AdvancedQuery.Read.All`	Run advanced hunting (KQL) queries against Defender for Endpoint telemetry.
`Vulnerability.Read.All`	Read device and software vulnerability data.
`Software.Read.All`	Read software inventory across devices.
`File.Read.All`	Read file metadata and prevalence information for investigated files.

Defender threat-intelligence reads (WindowsDefenderATP)

These threat-intelligence read permissions are also requested under the Defender for Endpoint resource (not Microsoft Graph). They let RAIDEN enrich indicators (IPs, URLs, threat intel) against Microsoft’s data. All are read-only.

Permission	What it’s for
`Ip.Read.All`	Read IP address reputation / context.
`Url.Read.All`	Read URL reputation / context.
`Ti.Read.All`	Read threat-intelligence indicator data.
`User.Read.All`	Read user context from Defender for Endpoint.

Opt-in only: Retrieving a Defender investigation package (raw forensic artefacts such as process trees and captures) requires the additional Alert.ReadWrite.All permission. RAIDEN does not request this by default — it is included only when a tenant explicitly opts in, and its use is gated behind admin notification and MFA step-up.

Office 365 Management APIs

Permission	What it’s for
`ActivityFeed.Read`	Subscribe to and read the Office 365 unified activity feed (audit content) for ingestion.

Summary

Read-only by default. Detection and investigation run entirely on read permissions across Microsoft Graph, Defender for Endpoint, and the Office 365 Management API.
Write permissions are response-only. Mail.ReadWrite, MailboxSettings.ReadWrite, Policy.ReadWrite.ConditionalAccess, and User.ReadWrite.All are used only when you explicitly take a response action.
Account response uses a broad scope today (User.ReadWrite.All); a least-privilege migration is tracked separately.
One reserved permission (DeviceManagementManagedDevices.PrivilegedOperations.All) is requested but currently unused.
One opt-in permission (Alert.ReadWrite.All) is requested only when a tenant enables Defender investigation-package retrieval.

Questions?

Email [email protected] with any questions about permissions.

Get Started

MSSP Partners

Using RAIDEN

Reference

Microsoft permissions RAIDEN requests

Microsoft Graph — read (detection & enrichment)

Microsoft Graph — write / response actions (used only when you take an action)

Microsoft Defender for Endpoint (WindowsDefenderATP)

Defender threat-intelligence reads (WindowsDefenderATP)

Office 365 Management APIs

Summary

Questions?

​Microsoft Graph — read (detection & enrichment)

​Microsoft Graph — write / response actions (used only when you take an action)

​Microsoft Defender for Endpoint (WindowsDefenderATP)

​Defender threat-intelligence reads (WindowsDefenderATP)

​Office 365 Management APIs

​Summary

​Questions?

Microsoft Graph — read (detection & enrichment)

Microsoft Graph — write / response actions (used only when you take an action)

Microsoft Defender for Endpoint (WindowsDefenderATP)

Defender threat-intelligence reads (WindowsDefenderATP)

Office 365 Management APIs

Summary

Questions?