Azure & O365 Permissions

When you connect the Azure / Defender XDR bundle (see Tools & Integrations), CloudPeek authenticates to Microsoft services through a Microsoft Entra ID app registration in your tenant. Its permissions are split across five Microsoft APIs, each covered in a section below: Intune, Microsoft Graph, Microsoft Purview, Microsoft Threat Protection and WindowsDefenderATP.

Note

Unless stated otherwise, every permission on this page is an Application permission (CloudPeek's background workers and agents act without a signed-in user), requires admin consent, and shows Granted for CloudPeek in the app registration. The single exception is Microsoft Graph User.Read, which is a Delegated permission and does not require admin consent by default (tenant consent policies can still require administrator approval).

Intune

These permissions are granted on the Intune service API. They back the Intune tool, which the AI uses to bring device state and compliance context into investigations. Note that most Intune data is read through Microsoft Graph; see the DeviceManagement* permissions in the Microsoft Graph section below.

Permission	Description	Use case
`get_data_warehouse`	Get data warehouse information from Microsoft Intune	Query the Intune data warehouse for historical device and compliance reporting, so investigations can see how a device's posture has changed over time rather than only its current state
`get_device_compliance`	Get device state and compliance information from Microsoft Intune	Pull the live compliance state of a device involved in an alert, letting triage answer "was this device compliant when the activity happened?" without an analyst opening the Intune portal

Microsoft Graph

Microsoft Graph is the primary API for the Azure / Defender XDR bundle: the Defender XDR, Entra ID, Intune, Office 365 and Purview tools all read most of their data through it. This is the largest permission set, so the tables below are grouped by what the permissions are for. All of them appear under Microsoft Graph in the Azure portal.

Security alerts, incidents and hunting

These power the Defender XDR tool: alert ingestion for automatic triage, incident retrieval for incident management, and advanced hunting for threat hunting.

Permission	Description	Use case
`SecurityAlert.Read.All`	Read all security alerts	Pull Defender XDR alerts through the Graph security API, both as an automatic alert source for triage and when the AI fetches a specific alert during an investigation
`SecurityIncident.Read.All`	Read all security incidents	Retrieve Defender XDR incidents and their correlated alerts so CloudPeek incidents stay in step with what analysts see in the Defender portal
`SecurityEvents.Read.All`	Read your organization's security events	Read security events and Secure Score data from the legacy Graph security endpoints used by some Defender workloads
`SecurityActions.Read.All`	Read your organization's security actions	Review the history of security response actions already taken in the tenant, so the AI does not recommend an action that has already been performed
`ThreatHunting.Read.All`	Run hunting queries	Execute advanced hunting (KQL) queries across Defender XDR tables during investigations and threat hunts
`CustomDetection.Read.All`	Read all custom detection rules	List custom detection rules and their run history so investigations can see which rule produced an alert and how it is configured
`RoleManagement.Read.Defender`	Read M365 Defender RBAC configuration	Verify the Defender RBAC configuration when the Defender XDR tool is connected, so permission problems surface at setup rather than mid-investigation
`SecurityAnalyzedMessage.Read.All`	Read metadata and detection details for all emails in your organization	Investigate phishing and email-borne threats: retrieve detection details for suspicious messages when triaging email security alerts

Threat intelligence

Permission	Description	Use case
`ThreatIntelligence.Read.All`	Read all Threat Intelligence Information	Enrich indicators seen in alerts with Microsoft threat intelligence during triage and investigation
`ThreatIndicators.Read.All`	Read all threat indicators	List the tenant's existing IOC indicators so the AI can check whether an indicator from an investigation is already blocked or flagged
`ThreatIndicators.ReadWrite.OwnedBy`	Manage threat indicators this app creates or owns	Create, update and delete IOC indicators as follow-up actions approved through HITL. Scoped to indicators CloudPeek creates itself, so it can never modify indicators owned by other apps

Identity and directory

These back the Entra ID tool: sign-in logs, audit logs, risky users and conditional access policies used in identity-centred investigations.

Permission	Description	Use case
`AuditLog.Read.All`	Read all audit log data	Retrieve Entra ID sign-in logs and directory audit logs, the core evidence for "who signed in from where" questions in identity investigations
`AuditActivity.Read`	Read activity audit log from the audit store	Search the unified audit store for user and admin activity through the Graph audit log query API, used by the Office 365 tool
`IdentityRiskEvent.Read.All`	Read all identity risk event information	Pull risky sign-in detections from Entra ID Identity Protection when triaging identity alerts
`IdentityRiskyUser.Read.All`	Read all identity risky user information	Look up whether a user involved in an alert is flagged as risky, and why, before recommending containment
`Policy.Read.All`	Read your organization's policies	Read conditional access policies to answer "should this sign-in have been blocked?" during identity investigations
`User.Read.All`	Read all users' full profiles	Resolve the user accounts referenced in alerts and incidents to full profiles (department, roles, contact details) for investigation context
`Directory.Read.All`	Read directory data	Resolve groups, roles and other directory objects referenced in alerts, and map relationships between the identities involved in an incident
`Device.Read.All`	Read all devices	Correlate identities with their registered directory device objects when an investigation spans both a user and a machine
`User.Read`	Sign in and read user profile	The one delegated permission (no admin consent needed by default): lets the administrator sign in during interactive setup of the Azure bundle and confirms who is connecting

Device management (Intune)

These back the Intune tool's device queries, alongside the two service-specific permissions in the Intune section above.

Permission	Description	Use case
`DeviceManagementManagedDevices.Read.All`	Read Microsoft Intune devices	List and look up Intune-managed devices so investigations can identify the device behind an alert and its owner, OS and enrolment state
`DeviceManagementConfiguration.Read.All`	Read Microsoft Intune device configuration and policies	Read compliance policies and device configuration profiles to explain why a device is non-compliant, not just that it is
`DeviceManagementApps.Read.All`	Read Microsoft Intune apps	List the applications detected on managed devices, used to spot unexpected or vulnerable software on a device under investigation

Defender for Identity sensors

Permission	Description	Use case
`SecurityIdentitiesSensors.Read.All`	Read all identity security sensors	List the Defender for Identity sensors deployed in the environment when assessing identity-infrastructure coverage
`SecurityIdentitiesHealth.Read.All`	Read all identity security health issues	Surface Defender for Identity health issues, so a quiet sensor is recognised as a monitoring gap rather than an absence of threats
`SecurityIdentitiesAutoConfig.Read.All`	Read sensors window auditing configuration	Read the Windows auditing configuration applied to sensors, to confirm identity telemetry is actually being collected as expected

Files and collaboration

Permission	Description	Use case
`Files.Read.All`	Read files in all site collections	Inspect files flagged in alerts (for example a malware detection or DLP match on a SharePoint or OneDrive file) during an investigation
`Sites.Read.All`	Read items in all site collections	Read SharePoint site items for context around file-related alerts, such as where a flagged document lives and what sits alongside it
`InformationProtectionPolicy.Read.All`	Read all published labels and label policies for an organization	Read sensitivity labels and label policies, used by the Purview tool to establish how sensitive the data involved in an incident is

Tenant and service context

Permission	Description	Use case
`Organization.Read.All`	Read organization information	Read basic tenant details to label the connected tenant and verify the connection when the Azure bundle is configured
`ServiceHealth.Read.All`	Read service health	Check Microsoft 365 service health during triage, so a flood of alerts caused by a Microsoft service incident is recognised as such
`AgentCard.ReadWrite.ManagedBy`	Read and write managed-by agent cards in Agent Registry	Publish and maintain CloudPeek's own agent card in the Microsoft Agent Registry, so the tenant can discover and govern the CloudPeek agent. Scoped to cards CloudPeek manages

Microsoft Purview

This permission is granted on the Microsoft Purview API. It backs the Purview tool, which brings data-governance context, such as DLP alerts and data classifications, into investigations. Sensitivity labels and label policies are read through Microsoft Graph instead; see InformationProtectionPolicy.Read.All in the Microsoft Graph section.

Permission	Description	Use case
`Purview.ApplicationAccess`	Purview Application API Access	Query the Purview APIs for DLP alerts and data classifications, so an incident touching a file or mailbox can be weighed against what the data actually is and how it is classified

Microsoft Threat Protection

These permissions are granted on the Microsoft Threat Protection API, the service API behind the unified Microsoft Defender XDR portal. They back the Defender XDR tool's incident management and cross-workload hunting.

Permission	Description	Use case
`AdvancedHunting.Read.All`	Run advanced hunting queries	Run KQL advanced hunting queries across all Defender XDR workloads (endpoint, identity, email, cloud apps) during investigations and threat hunts
`CustomDetections.ReadWrite.All`	Read and write all custom detection rules	Read custom detection rules for investigation context, and create or update rules as follow-up actions, for example turning a successful hunting query into a recurring detection, with HITL approval
`Incident.ReadWrite.All`	Read and write all incidents	Retrieve Defender XDR incidents for incident management, and write status changes, classifications and comments back so the Defender portal reflects CloudPeek's triage outcome

WindowsDefenderATP

WindowsDefenderATP is the API name for Microsoft Defender for Endpoint. These permissions back the Defender for Endpoint tool: endpoint alerts, machine inventory, vulnerability management and the endpoint response actions available as follow-up actions.

Alerts and response

Permission	Description	Use case
`Alert.Read.All`	Read all alerts	Pull endpoint alerts, both as an automatic alert source for triage and when fetching a specific alert during an investigation
`Alert.ReadWrite.All`	Read and write all alerts	Update alert status and classification and add triage comments, so the Defender portal shows what CloudPeek concluded and why
`Event.Write`	Write timeline events	Record CloudPeek's investigation and response actions as events on the affected device's timeline, keeping an auditable trail alongside Defender's own telemetry
`Machine.Scan`	Scan machine	Trigger a Defender antivirus scan on a device as a follow-up action, only after HITL approval
`RemediationTasks.Read.All`	Read all remediation tasks	Track vulnerability-management remediation tasks so recommendations account for fixes that are already in progress
`IntegrationConfiguration.ReadWrite`	Read and write integration settings	Manage the Defender for Endpoint integration settings when the tool is connected and kept in sync

Machines and users

Permission	Description	Use case
`Machine.Read.All`	Read all machine profiles	Look up the machines involved in an alert (risk level, exposure, health, tags) and search the machine inventory during investigations
`User.Read.All`	Read user profiles	See which users have logged on to a machine under investigation, linking endpoint activity back to identities

Indicators and enrichment

Permission	Description	Use case
`Ti.Read.All`	Read all IOCs	List the custom IOC indicators already configured in Defender for Endpoint, so the AI knows what is already blocked or flagged
`Ti.ReadWrite.All`	Read and write all IOCs	Create, update and remove IOC indicators (file hashes, IPs, URLs) as follow-up actions approved through HITL
`File.Read.All`	Read file profiles	Enrich a file hash from an alert with its organisation-wide prevalence and Defender's verdict on the file
`Ip.Read.All`	Read IP address profiles	Enrich an IP address with the machines and alerts it has been associated with across the estate
`Url.Read.All`	Read URL profiles	Enrich a URL or domain with its prevalence and the devices that contacted it, useful in phishing investigations

Vulnerability and posture management

Permission	Description	Use case
`Vulnerability.Read.All`	Read Threat and Vulnerability Management vulnerability information	Retrieve the vulnerabilities affecting a device or the whole estate, giving investigations exposure context for the assets involved
`Software.Read.All`	Read Threat and Vulnerability Management software information	Read the software inventory to identify vulnerable or unexpected software on devices under investigation
`SecurityRecommendation.Read.All`	Read Threat and Vulnerability Management security recommendations	Surface Defender's security recommendations when proposing remediation for an incident
`Score.Read.All`	Read Threat and Vulnerability Management score	Read the exposure score and configuration score to report the estate's overall endpoint posture and how it trends
`SecurityBaselinesAssessment.Read.All`	Read all security baselines assessment information	Check devices against security baseline assessments to spot configuration drift on machines involved in incidents
`SecurityConfiguration.Read.All`	Read all security configurations	Read security configuration state, including antivirus health across devices, to identify unprotected or misconfigured endpoints