Permissions by service
Every delegated Microsoft Graph permission OpenAdminOS requests, by service and part, with the reason and the consent it needs.
On this page
This page is generated from the service registry in packages/agent-sdk/src/services.ts, the same source the app uses for the connect dialog, Settings and the setup script. Every permission is delegated: OpenAdminOS acts as the signed-in admin and can only read what that account can read.
Consent shows who can approve a permission. Admin means an administrator has to grant consent for the tenant before anyone can use it. User means a user can consent for themselves. Permission IDs are the delegated permission IDs on the Microsoft Graph service principal (app ID 00000003-0000-0000-c000-000000000000). They are listed for the requiredResourceAccess manifest snippet; the setup script resolves them again at run time.
Sign-in#
With the OpenAdminOS app, every connection requests these four scopes plus the scopes of the parts you choose, and nothing else. With your own app registration, sign-in requests https://graph.microsoft.com/.default and offline_access, and the token carries whatever the registration has been granted.
| Scope | Reason | Consent | Permission ID |
|---|---|---|---|
openid |
Signs you in. | User | 37f7f235-527c-4136-accd-4a02d197296e |
profile |
Shows your name and account on the connected tenant. | User | 14dad69e-099b-42c9-810b-d002981feec1 |
offline_access |
Keeps you signed in between sessions with a refresh token. | User | 7427e0e9-2fba-42fe-b0c0-848c9e6a8182 |
User.Read |
Reads your own profile to confirm which account signed in. | User | e1fe6dd8-ba31-4d61-89e7-88639da4683d |
Intune#
Managed devices, compliance and configuration policies, apps, scripts and Autopilot. Intune guide.
| Part | Scope | Reason | Consent | Permission ID |
|---|---|---|---|---|
| Users and groups | User.Read.All |
Reads users, their licence assignments, location and last sign-in, so assignments, owners and audit entries show names rather than object IDs. | Admin | a154be20-db9c-4678-8ab7-66f6cc099a59 |
| Users and groups | GroupMember.Read.All |
Reads groups and group membership, which policy, app and filter assignments target. | Admin | bc024368-1153-4739-b217-4326f2e966d0 |
| Users and groups | Organization.Read.All |
Reads the tenant profile and /subscribedSkus so the status strip shows the Entra ID tier and licences, and agents that need P1 or P2 are badged. | Admin | 4908d5b9-3fb2-4b1e-9336-1888b7937185 |
| Devices and configuration | DeviceManagementManagedDevices.Read.All |
Reads Intune enrolled devices, detected apps, troubleshooting events and fleet status. Used by Compliance overview, Find inactive devices, OS update posture, Tenant health report and Chat device questions. | Admin | 314874da-47d6-4978-88dc-cf0d37f0bb82 |
| Devices and configuration | DeviceManagementConfiguration.Read.All |
Reads compliance policies, configuration profiles, settings catalog policies, update policies, endpoint security policies, assignment filters, administrative templates and encryption states. | Admin | f1493658-876a-4c87-8fa7-edb559b3476a |
| Devices and configuration | DeviceManagementServiceConfig.Read.All |
Reads Windows Autopilot devices, Autopilot deployment profiles and enrollment configurations. | Admin | 8696daa5-bce5-4b2e-83f9-51b6defc4e1e |
| Devices and configuration | DeviceManagementScripts.Read.All |
Reads remediations and platform scripts so Chat can explain assignment, execution and reporting gaps. | Admin | d32381d8-ee89-4220-9c83-b672aa68d404 |
| Devices and configuration | DeviceManagementRBAC.Read.All |
Reads Intune scope tags so Chat can explain policy visibility and scope tag targeting. | Admin | 49f0cc30-024c-4dfd-ab3e-82e137ee5431 |
| Devices and configuration | Device.Read.All |
Reads Entra device objects for stale device checks, Autopilot matching and Intune versus Entra inventory comparisons. | Admin | 951183d1-1a61-466f-a6d1-1fde911bfd95 |
| Apps | DeviceManagementApps.Read.All |
Reads Intune apps, managed app policies, app protection policies and app configuration policies so Chat can answer deployment and mobile app protection questions. | Admin | 4edf5f54-4666-44af-9de9-0144fb4b6e8c |
Intune Run-Time Scopes#
Never requested when a tenant is connected. An agent that declares one of these asks for consent when it runs, and a write still pauses for diff confirmation.
| Scope | Reason |
|---|---|
DeviceManagementManagedDevices.ReadWrite.All |
Changes managed device properties. Requested only when a write agent that declares it runs. |
DeviceManagementManagedDevices.PrivilegedOperations.All |
Runs remote actions such as retire and wipe. Requested only when a write agent that declares it runs. |
DeviceManagementConfiguration.ReadWrite.All |
Changes compliance and configuration policies. Requested only when a write agent that declares it runs. |
DeviceManagementServiceConfig.ReadWrite.All |
Changes Autopilot and enrollment configuration. Requested only when a write agent that declares it runs. |
DeviceManagementScripts.ReadWrite.All |
Changes remediations and platform scripts. Requested only when a write agent that declares it runs. |
DeviceManagementRBAC.ReadWrite.All |
Changes Intune roles and scope tags. Requested only when a write agent that declares it runs. |
DeviceManagementApps.ReadWrite.All |
Changes Intune apps and app policies. Requested only when a write agent that declares it runs. |
Entra#
Users, groups, app registrations, roles, Conditional Access, sign-in logs and risk signals. Entra guide.
| Part | Scope | Reason | Consent | Permission ID |
|---|---|---|---|---|
| Users and groups | User.Read.All |
Reads users, their licence assignments, location and last sign-in, so assignments, owners and audit entries show names rather than object IDs. | Admin | a154be20-db9c-4678-8ab7-66f6cc099a59 |
| Users and groups | GroupMember.Read.All |
Reads groups and group membership, which policy, app and filter assignments target. | Admin | bc024368-1153-4739-b217-4326f2e966d0 |
| Users and groups | Organization.Read.All |
Reads the tenant profile and /subscribedSkus so the status strip shows the Entra ID tier and licences, and agents that need P1 or P2 are badged. | Admin | 4908d5b9-3fb2-4b1e-9336-1888b7937185 |
| Devices | Device.Read.All |
Reads Entra device objects for stale device checks, Autopilot matching and Intune versus Entra inventory comparisons. | Admin | 951183d1-1a61-466f-a6d1-1fde911bfd95 |
| App registrations | Application.Read.All |
Reads app registrations and service principals so Dormant app registrations can flag apps that are no longer used. | Admin | c79f8feb-a9db-4090-85f9-90d820caa0eb |
| Roles and domains | RoleManagement.Read.Directory |
Reads Entra directory roles so Chat can answer which admin roles exist and how policies target privileged users. Role assignments are never changed. | Admin | 741c54c3-0c1e-44a1-818b-3f97ab4e8c83 |
| Roles and domains | AdministrativeUnit.Read.All |
Reads administrative units so scoped administration questions use the tenant's actual delegation structure. | Admin | 3361d15d-be43-4de6-b441-3c746d05163d |
| Roles and domains | Domain.Read.All |
Reads verified domains and their authentication type so Chat can explain federation and domain configuration. | Admin | 2f9ee017-59c1-4f1d-9472-bd5529a7b311 |
| Conditional Access and policies | Policy.Read.All |
Reads Conditional Access and related tenant policies so the Conditional access explainer can describe what is enforced and why. | Admin | 572fea84-0151-49b2-9301-11cb16974376 |
| Sign-in logs | AuditLog.Read.All |
Reads sign-in logs and directory audit events. Used by Sign-in failure explainer, Tenant change audit and Stale guest cleanup. | Admin | e4c9e354-4dc5-45b8-9e7c-e1393b0b1a20 |
| Sign-in logs | IdentityRiskyUser.Read.All |
Reads Entra ID Protection risky user signals so Risky sign-in triage can group and explain risk events. Returns data only on Entra ID P2. | Admin | d04bb851-cb7c-4146-97c7-ca3e71baf56c |
Entra Run-Time Scopes#
Never requested when a tenant is connected. An agent that declares one of these asks for consent when it runs, and a write still pauses for diff confirmation.
| Scope | Reason |
|---|---|
Directory.Read.All |
Reads broad directory data. Never requested at connect, only when an agent that declares it runs. |
User.ReadWrite.All |
Changes users. Requested only when a write agent that declares it runs. |
Group.Read.All |
Reads all groups and their properties. Older agents declare it where GroupMember.Read.All is enough. Requested only when an agent that declares it runs. |
Group.ReadWrite.All |
Changes groups. Requested only when a write agent that declares it runs. |
GroupMember.ReadWrite.All |
Changes group memberships. Requested only when a write agent that declares it runs. |
IdentityRiskyUser.ReadWrite.All |
Confirms or dismisses risky users. Requested only when a write agent that declares it runs. |
Directory.ReadWrite.All |
Changes directory objects. Requested only when a write agent that declares it runs. |
Application.ReadWrite.All |
Changes app registrations. Requested only when a write agent that declares it runs. |
RoleManagement.ReadWrite.Directory |
Changes directory role assignments. Requested only when a write agent that declares it runs. |
AdministrativeUnit.ReadWrite.All |
Changes administrative units. Requested only when a write agent that declares it runs. |
Domain.ReadWrite.All |
Changes domains. Requested only when a write agent that declares it runs. |
Policy.ReadWrite.ConditionalAccess |
Changes Conditional Access policies. Requested only when a write agent that declares it runs. |
Defender#
Microsoft Defender alerts and incidents, and Secure Score. Defender guide.
| Part | Scope | Reason | Consent | Permission ID |
|---|---|---|---|---|
| Alerts and incidents | SecurityAlert.Read.All |
Reads Microsoft Defender alerts so Chat can summarize open alerts by severity and service. Triage actions are never taken. | Admin | bc257fb8-46b4-4b15-8713-01e91bfbe4ea |
| Alerts and incidents | SecurityIncident.Read.All |
Reads Microsoft Defender incidents so Chat can report incident status, classification and assignment. Incidents are never changed. | Admin | b9abcc4f-94fc-4457-9141-d20ce80ec952 |
| Secure Score | SecurityEvents.Read.All |
Reads Microsoft Secure Score and its controls so the Secure score prioritizer can rank improvement actions by impact. | Admin | 64733abd-851e-478a-bffb-e47a14b18235 |
| Advanced hunting (planned, never requested) | ThreatHunting.Read.All |
Runs read-only advanced hunting queries across Microsoft Defender data. | Admin | b152eca8-ea73-4a48-8c98-1a6742673d99 |
Defender Run-Time Scopes#
Never requested when a tenant is connected. An agent that declares one of these asks for consent when it runs, and a write still pauses for diff confirmation.
| Scope | Reason |
|---|---|
SecurityEvents.ReadWrite.All |
Changes Secure Score control states. Requested only when a write agent that declares it runs. |
SecurityAlert.ReadWrite.All |
Updates Defender alerts, for example status and classification. Requested only when a write agent that declares it runs. |
SecurityIncident.ReadWrite.All |
Updates Defender incidents, for example status and assignment. Requested only when a write agent that declares it runs. |
Planned Services#
Exchange, Teams, SharePoint are planned and request nothing today. See Planned services.
Generated from repository metadata by generate-gitbook-docs.mjs.View as Markdown