> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ctrlconnect.nl/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft permissions CtrlConnect uses, and why

> Every Microsoft permission CtrlConnect asks for, what each one is used for, what CtrlConnect never does, and how to review or revoke access at any time.

Before CtrlConnect can show you anything about your tenant, a Global Administrator approves a set of Microsoft permissions. This page lists every one, explains in plain language why CtrlConnect needs it, and shows where you see the result in the product. Share it with your security team before you connect.

> **Mostly read-only**
>
> Most permissions only let CtrlConnect read information so it can show reports, queues, and dashboards.

> **Changes only when you ask**
>
> CtrlConnect changes your tenant only when an admin takes an action, or when an automation policy you created runs.

> **Every change is logged**
>
> Each change appears in the [audit log](https://docs.ctrlconnect.nl/audit-log.md), showing whether a person or an automated job made it.

## What CtrlConnect never does

> [!TIP]
>
> **No reading email.** CtrlConnect does not ask for permission to read mail messages.

> [!TIP]
>
> **No sending mail from your tenant.** Review emails come from `noreply@ctrlconnect.nl`, a CtrlConnect mailbox in our own tenant. Your consent screen never includes permission to send mail as your users.

> [!TIP]
>
> **No opening your files.** CtrlConnect reads file and folder names, locations, and who they are shared with. It never downloads or opens file contents.

> [!TIP]
>
> **No passwords or secrets.** You sign in with Microsoft. CtrlConnect sees which sign-in methods a user has registered, never the methods themselves.

## Every permission, explained

Microsoft names each permission by what it allows, for example `User.Read.All` means "read all user profiles". The consent screen Microsoft shows you uses the same names as this page.

**Reading your tenant**

These permissions only read. They power the overview, reports, and review queues.

### Users and sign-in

| Permission | Why CtrlConnect needs it | Where you see it |
| - | - | - |
| `User.Read.All` | Read user profiles, account status, and assigned licenses. | [Users](https://docs.ctrlconnect.nl/users/directory.md) |
| `Directory.Read.All` | Read groups, owners, members, and organization details. | Users, [Workspaces](https://docs.ctrlconnect.nl/workspaces/directory.md) |
| `Group.Read.All` | Keep group and Teams membership up to date as it changes. | [Workspace details](https://docs.ctrlconnect.nl/workspaces/workspace-details.md) |
| `RoleManagement.Read.Directory` | See who holds admin roles. | Privileged access report |
| `UserAuthenticationMethod.Read.All` | See which sign-in methods each user has registered, so you can find gaps in MFA. | MFA compliance report |
| `AuditLog.Read.All` | Read directory audit events and last sign-in times. | [Audit log](https://docs.ctrlconnect.nl/audit-log.md), Inactive users report |
| `Policy.Read.All` | Read your conditional access policies. | [User details](https://docs.ctrlconnect.nl/users/user-details.md), Security tab |

### SharePoint, OneDrive, and Teams

| Permission | Why CtrlConnect needs it | Where you see it |
| - | - | - |
| `Sites.Read.All` | Read sites, document libraries, OneDrives, and who each item is shared with. | Workspaces, sharing reports |
| `SharePointTenantSettings.Read.All` | Read your tenant-wide SharePoint sharing settings. | [Overview](https://docs.ctrlconnect.nl/overview.md) |
| `InformationProtectionPolicy.Read.All` | Read the names of your sensitivity labels. | Unclassified sites report |
| `Team.ReadBasic.All` | Read the names and basic details of your Teams. | Workspaces |
| `Channel.ReadBasic.All` | Read the names of Teams channels. | Workspace details |
| `Tasks.Read.All` | Check whether a Microsoft 365 group uses Planner. | Workspace details |

### Usage and security

| Permission | Why CtrlConnect needs it | Where you see it |
| - | - | - |
| `Reports.Read.All` | Read Microsoft 365 usage reports, such as activity and storage. | Inactive workspaces, license reports |
| `IdentityRiskyUser.Read.All` | Read users that Entra ID Protection flagged as risky. Needs Entra ID P2. | [Threat queue](https://docs.ctrlconnect.nl/security/threat-queue.md) |

**Changes you make**

These permissions let CtrlConnect carry out an action an admin starts, such as blocking a sign-in. CtrlConnect never uses them on its own, apart from automation policies you create yourself.

| Permission | What it lets you do from CtrlConnect |
| - | - |
| `User.ReadWrite.All` | Edit profile fields: display name, first and last name, job title, department, company, business phone, and office location. |
| `User.EnableDisableAccount.All` | Block or unblock a user's sign-in. |
| `GroupMember.ReadWrite.All` | Add people to groups or remove them, including through [function roles](https://docs.ctrlconnect.nl/function-roles.md). |
| `LicenseAssignment.ReadWrite.All` | Assign, remove, or change licenses. Also used by a [license policy](https://docs.ctrlconnect.nl/lifecycle/policies.md) that reclaims unused seats, if you set one up. |
| `RoleManagement.ReadWrite.Directory` | Change a user's admin role. High-impact roles ask for extra confirmation. |
| `SecurityIncident.ReadWrite.All` | Read Microsoft Defender incidents, and send your triage (status, assignee, and comments) back to Defender so both stay in sync. |

> [!NOTE]
>
> Microsoft's permissions are broad by design. For example, `User.ReadWrite.All` covers every profile field. CtrlConnect only changes the fields listed above, and only when you save a change.

**Exchange and templates**

These permissions support specific features. Grant them if you use those features.

| Permission | Why CtrlConnect needs it | Feature |
| - | - | - |
| `Exchange.ManageAsApp`, with the Exchange Administrator role | Read and change mailbox settings such as forwarding, delegates, and automatic replies. Microsoft only offers these settings through Exchange, not Microsoft Graph. | The **Mail** tab on [User details](https://docs.ctrlconnect.nl/users/user-details.md), mailbox access in function roles |
| `Sites.FullControl.All` | Create SharePoint sites from templates, and read each site's own sharing setting. Microsoft only offers both through the SharePoint admin API, which requires this permission. | [Templates](https://docs.ctrlconnect.nl/templates.md), per-site sharing settings |

> [!TIP]
>
> If you don't grant one of these, everything else in CtrlConnect keeps working. The features that need it show **not read** or ask you to grant the permission.

## How your access stays protected

> **You approve it in Microsoft**
>
> Consent happens on Microsoft's own screen. CtrlConnect only receives the permissions your Global Administrator approves there.

> **Separated from the web app**
>
> The CtrlConnect web app never holds your Microsoft credentials. Changes are sent to Microsoft by a separate background service and recorded in the audit log.

> **People and jobs kept apart**
>
> Automated jobs are always recorded as jobs, never as a person, so you can always tell who made a change.

> **Your tenant only**
>
> Your data is kept separate from other customers' data at the database level.

## Review or revoke access at any time

CtrlConnect appears in your tenant as an enterprise application. You stay in control of it.

**1. Open the Microsoft Entra admin center**

Go to **Enterprise applications** and select **CtrlConnect**.

**2. Review the permissions**

Open **Permissions** to see exactly what was granted. It matches the list on this page.

**3. Remove access if you need to**

Delete the application to revoke all access at once. CtrlConnect can no longer read or change anything in your tenant.

## Common questions

> **Why does CtrlConnect use application permissions?**
>
> CtrlConnect keeps your reports and queues up to date in the background, even when nobody is signed in. Microsoft requires application permissions for that kind of background access.

> **Do we have to grant everything?**
>
> No. If a permission is missing, only the feature that needs it is affected. That feature shows **not read** or names the permission it needs, and the rest of CtrlConnect keeps working.

> **Will we need to approve new permissions later?**
>
> Only if a new CtrlConnect feature needs one. Microsoft asks a Global Administrator to approve it first, and nothing new is granted until you do.

> **Who in our organization needs to approve?**
>
> A Global Administrator. If that isn't you, use **Request approval** during setup to send them the request. See [Connect your tenant](https://docs.ctrlconnect.nl/get-started/connect-your-tenant.md).

Still have questions? Email [support@ctrlconnect.nl](mailto:support@ctrlconnect.nl) and we'll walk your security team through it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.