> ## Documentation Index
> Fetch the complete documentation index at: https://docs.raidenhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft permissions RAIDEN requests

> The exact Microsoft Graph, Microsoft Defender for Endpoint, and Office 365 Management API permissions RAIDEN asks for during onboarding — what each one is for, and which are read-only versus used for response actions.

When you connect your Microsoft 365 tenant, RAIDEN requests a defined set of permissions through Microsoft's standard admin-consent flow. This page lists exactly what RAIDEN asks for, grouped by the Microsoft API it belongs to, with a plain-language note on what each permission is used for.

Everything here is documented to match RAIDEN's actual consent manifest. The vast majority of permissions are **read-only** — RAIDEN reads your sign-in, mailbox, directory, and security data to detect and investigate threats. A small number of **write** permissions exist solely to carry out **response actions**, and those only run when you explicitly choose to take an action.

<Note>
  RAIDEN requests these permissions tenant-wide via admin consent. The connector reads your data to run detections and build investigations; it does not modify anything unless you opt into a response action.
</Note>

***

## Microsoft Graph — read (detection & enrichment)

These are the core read permissions RAIDEN uses to ingest activity and enrich investigations. They are always requested.

| Permission                                | What it's for                                                                                         |
| ----------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| `User.Read.All`                           | Read user profiles across the directory so findings can be attributed to the right account.           |
| `AuditLog.Read.All`                       | Read Entra ID sign-in and audit logs — the primary feed for identity and account-takeover detection.  |
| `AuditLogsQuery.Read.All`                 | Query unified audit log data for investigation and historical lookback.                               |
| `Directory.Read.All`                      | Read directory objects (users, groups, roles) to understand account context and privilege.            |
| `SecurityEvents.Read.All`                 | Read Microsoft security alerts so RAIDEN can correlate them into Cases.                               |
| `SecurityIncident.Read.All`               | Read Microsoft 365 Defender incidents for correlation with RAIDEN findings.                           |
| `IdentityRiskEvent.Read.All`              | Read Entra ID Protection risk detections (risky sign-ins).                                            |
| `IdentityRiskyUser.Read.All`              | Read Entra ID Protection risky-user state.                                                            |
| `IdentityRiskyServicePrincipal.Read.All`  | Read risky service principal / app risk state.                                                        |
| `Policy.Read.All`                         | Read tenant policies, including Conditional Access, to assess control posture.                        |
| `Reports.Read.All`                        | Read usage and security reports for context and enrichment.                                           |
| `UserAuthenticationMethod.Read.All`       | Read registered authentication methods (MFA configuration) for accounts under investigation.          |
| `ThreatHunting.Read.All`                  | Run advanced hunting (KQL) queries across Microsoft 365 Defender data.                                |
| `Application.Read.All`                    | Read app registrations and service principals to investigate OAuth consent abuse.                     |
| `Device.Read.All`                         | Read device objects from the directory for device context.                                            |
| `DeviceManagementManagedDevices.Read.All` | Read Intune managed-device inventory for device context.                                              |
| `Domain.Read.All`                         | Read verified domains for the tenant.                                                                 |
| `Organization.Read.All`                   | Read tenant-level organization details.                                                               |
| `DelegatedAdminRelationship.Read.All`     | Read delegated admin (GDAP) relationships — used in partner / MSSP scenarios.                         |
| `Mail.Read`                               | Read mailbox messages for business-email-compromise investigation (e.g. inspecting suspect messages). |

***

## Microsoft Graph — write / response actions (used only when you take an action)

These permissions exist so RAIDEN can carry out response actions. They are **not** used during routine detection — they run only when you explicitly trigger the corresponding action.

| Permission                           | What it's for                                                                                                                  |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ |
| `Mail.ReadWrite`                     | Take mailbox response actions, such as removing or quarantining a malicious message during BEC remediation.                    |
| `MailboxSettings.ReadWrite`          | Modify mailbox settings as part of response — for example, removing an attacker-created forwarding or inbox rule.              |
| `Policy.ReadWrite.ConditionalAccess` | Apply Conditional Access changes as a response action (e.g. tightening access for a compromised account).                      |
| `User.ReadWrite.All`                 | Used for account-level response actions today — revoking a user's active sign-in sessions and disabling a compromised account. |

<Warning>
  **Account response uses a broad scope today.** Account session-revoke and account-disable currently rely on the broad `User.ReadWrite.All` scope. RAIDEN's response code references narrower operations (`User.RevokeSessions.All` and `User.EnableDisableAccount.All`), but those granular scopes are **not** what the consent manifest requests today — the manifest requests `User.ReadWrite.All`. Moving account response to least-privilege granular scopes is tracked as separate work.
</Warning>

<Note>
  `DeviceManagementManagedDevices.PrivilegedOperations.All` is requested in the manifest but is **reserved and currently unused** — no RAIDEN code path performs a privileged device operation. It is listed here for transparency, not as an active response action.
</Note>

***

## Microsoft Defender for Endpoint (WindowsDefenderATP)

If you use Microsoft Defender for Endpoint, RAIDEN requests these permissions to pull endpoint context into investigations. All are **read-only**.

| Permission               | What it's for                                                               |
| ------------------------ | --------------------------------------------------------------------------- |
| `Machine.Read.All`       | Read device (machine) information from Defender for Endpoint.               |
| `Alert.Read.All`         | Read Defender for Endpoint alerts for correlation into Cases.               |
| `AdvancedQuery.Read.All` | Run advanced hunting (KQL) queries against Defender for Endpoint telemetry. |
| `Vulnerability.Read.All` | Read device and software vulnerability data.                                |
| `Software.Read.All`      | Read software inventory across devices.                                     |
| `File.Read.All`          | Read file metadata and prevalence information for investigated files.       |

### Defender threat-intelligence reads (WindowsDefenderATP)

These threat-intelligence read permissions are also requested under the Defender for Endpoint resource (not Microsoft Graph). They let RAIDEN enrich indicators (IPs, URLs, threat intel) against Microsoft's data. All are **read-only**.

| Permission      | What it's for                                 |
| --------------- | --------------------------------------------- |
| `Ip.Read.All`   | Read IP address reputation / context.         |
| `Url.Read.All`  | Read URL reputation / context.                |
| `Ti.Read.All`   | Read threat-intelligence indicator data.      |
| `User.Read.All` | Read user context from Defender for Endpoint. |

<Note>
  **Opt-in only:** Retrieving a Defender **investigation package** (raw forensic artefacts such as process trees and captures) requires the additional `Alert.ReadWrite.All` permission. RAIDEN does **not** request this by default — it is included only when a tenant explicitly opts in, and its use is gated behind admin notification and MFA step-up.
</Note>

***

## Office 365 Management APIs

| Permission          | What it's for                                                                             |
| ------------------- | ----------------------------------------------------------------------------------------- |
| `ActivityFeed.Read` | Subscribe to and read the Office 365 unified activity feed (audit content) for ingestion. |

***

## Summary

* **Read-only by default.** Detection and investigation run entirely on read permissions across Microsoft Graph, Defender for Endpoint, and the Office 365 Management API.
* **Write permissions are response-only.** `Mail.ReadWrite`, `MailboxSettings.ReadWrite`, `Policy.ReadWrite.ConditionalAccess`, and `User.ReadWrite.All` are used only when you explicitly take a response action.
* **Account response uses a broad scope today** (`User.ReadWrite.All`); a least-privilege migration is tracked separately.
* **One reserved permission** (`DeviceManagementManagedDevices.PrivilegedOperations.All`) is requested but currently unused.
* **One opt-in permission** (`Alert.ReadWrite.All`) is requested only when a tenant enables Defender investigation-package retrieval.

## Questions?

Email [support@raidenhq.com](mailto:support@raidenhq.com) with any questions about permissions.