Appearance
App Permissions
When a tenant is connected, Watchmont registers a dedicated app in the customer's Microsoft 365 tenant and grants it a set of application permissions. This page lists exactly what is granted, so you can answer a customer's "what does this app have access to?" with confidence.
All permissions are application (app-only) permissions on Microsoft Graph unless noted. Permission IDs are looked up live in the tenant at consent time, so only permissions that exist in that tenant are granted.
Two tiers
- Read-Only tenants get the base set below.
- Read/Write tenants get the base set plus the read/write set.
Base permissions (both tiers)
Granted to every connected tenant, read-only and read/write alike.
| Permission | Powers |
|---|---|
User.Read.All | User list, profiles, sign-in activity |
Directory.Read.All | Directory objects, OAuth grants, org data |
Organization.Read.All | Tenant / org details, verified domains |
Domain.Read.All | Domain security (SPF/DKIM/DMARC) analysis |
Application.Read.All | App registrations & service principals |
RoleManagement.Read.Directory | Directory role assignments (admins) |
Group.Read.All | Groups inventory |
GroupMember.Read.All | Group membership |
Policy.Read.All | Conditional Access & security defaults status |
UserAuthenticationMethod.Read.All | MFA registration / methods |
SecurityEvents.Read.All | Secure Score, security events |
SecurityAlert.ReadWrite.All | Read and dismiss/resolve alerts in the portal |
SecurityIncident.ReadWrite.All | Read and update incidents |
ThreatHunting.Read.All | Advanced hunting (shadow AI, cloud app events) |
IdentityRiskyUser.Read.All | Risky users |
IdentityRiskEvent.Read.All | Risk detections |
IdentityRiskyServicePrincipal.Read.All | Risky service principals |
AuditLog.Read.All | Sign-in & audit logs |
AuditLogsQuery.Read.All | Audit log queries |
Reports.Read.All | M365 usage & Copilot adoption reports |
ServiceHealth.Read.All | Service health |
ServiceMessage.Read.All | Message centre posts |
CallRecords.Read.All | Teams Phone call records |
Sites.Read.All | SharePoint sites & permissions |
SharePointTenantSettings.Read.All | SharePoint tenant settings |
MailboxSettings.Read | Out-of-office, shared-mailbox detection |
Channel.ReadBasic.All | Teams channels |
TeamMember.Read.All | Teams membership |
TeamworkDevice.Read.All | Teams-certified devices |
DeviceManagementConfiguration.Read.All | Intune configuration profiles |
DeviceManagementManagedDevices.Read.All | Intune managed devices |
BitlockerKey.Read.All | BitLocker recovery keys |
NetworkAccessPolicy.Read.All | Global Secure Access policies |
NetworkAccess.Read.All | Global Secure Access data |
NetworkAccess-Reports.Read.All | Global Secure Access reports |
Alert write on read-only tenants
SecurityAlert.ReadWrite.All and SecurityIncident.ReadWrite.All are in the base set even for read-only tenants. They only let you dismiss or resolve an alert record inside the portal. They do not change anything in the customer's tenant configuration.
Read/Write permissions (added for read/write tenants)
Granted on top of the base set when a tenant is provisioned read/write.
| Permission | Powers |
|---|---|
User.ReadWrite.All | Edit users, offboard, change UPN |
User.RevokeSessions.All | Sign a user out of all sessions |
Directory.ReadWrite.All | Directory writes |
Group.ReadWrite.All | Create / edit groups |
GroupMember.ReadWrite.All | Add / remove group members |
Policy.ReadWrite.ConditionalAccess | Create / edit Conditional Access policies |
Policy.ReadWrite.Authorization | Authorization policy changes |
Policy.ReadWrite.SecurityDefaults | Enable / disable Security Defaults |
RoleManagement.ReadWrite.Directory | Assign directory roles |
IdentityRiskyUser.ReadWrite.All | Dismiss / remediate risky users |
SecurityEvents.ReadWrite.All | Update security events |
SharePointTenantSettings.ReadWrite.All | Change SharePoint tenant settings |
UserAuthenticationMethod.ReadWrite.All | Reset MFA / manage auth methods |
DeviceManagementManagedDevices.ReadWrite.All | Intune device actions |
DeviceManagementManagedDevices.PrivilegedOperations.All | Wipe / retire devices |
DeviceManagementConfiguration.ReadWrite.All | Create / edit Intune policies |
Device.ReadWrite.All | Enable / disable device objects |
NetworkAccessPolicy.ReadWrite.All | Global Secure Access policy writes |
NetworkAccess.ReadWrite.All | Global Secure Access writes |
MailboxSettings.ReadWrite | Set out-of-office |
DelegatedPermissionGrant.ReadWrite.All | Revoke risky OAuth consents |
Sites.ReadWrite.All | Revoke external SharePoint / OneDrive shares |
Application.ReadWrite.All | Manage service principal settings (Global Secure Access profile assignment) |
AppRoleAssignment.ReadWrite.All | Assign users and groups to apps (Global Secure Access profiles) |
Beyond Microsoft Graph
Two more grants complete the setup:
Exchange.ManageAsApp(Office 365 Exchange Online) lets Watchmont run Exchange Online management as the app: mailbox rules, distribution-group membership, mobile devices, shared-mailbox permissions.- Azure Resource Manager: during consent the platform also requests
offline_accessandmanagement.azure.com/user_impersonationso it can grant the service principal the Azure Reader role, for the Azure resource view. This is best-effort (see the Azure Reader gotcha).
Directory roles assigned to the app
| Tier | Roles |
|---|---|
| Read-Only | Exchange Administrator, Security Reader |
| Read/Write | Exchange Administrator, Security Administrator, User Administrator |
Keeping permissions current
New features occasionally add a permission. Existing tenants then show RE-AUTH NEEDED until re-authorized, which re-consents to the current set. See Connecting a Tenant › Re-authorizing later.