NL Dutch
FR French
IT Italian
JP Japanese
DE German
US English (US)
ES Spanish

Contact Us

If you still have questions or prefer to get help directly from an agent, please submit a request.
We’ll get back to you as soon as possible.

  • Contact Us
English (US)
NL Dutch
FR French
IT Italian
JP Japanese
DE German
US English (US)
ES Spanish
  • Home
  • CyberFOX Optimize365
  • Getting Started

Required Permissions & Roles

Written by Owen Parry

Updated at November 12th, 2026

Contact Us

If you still have questions or prefer to get help directly from an agent, please submit a request.
We’ll get back to you as soon as possible.

  • CyberFOX AutoElevate
    Getting Started with AutoElevate AutoElevate Concepts Admin Portal & Settings Elevation & Blocker Rules Technician Mode & Approvals Deploying via RMM Tools PSA & Ticketing Integrations Other Integrations Troubleshooting AutoElevate FAQ Selling AutoElevate
  • CyberFOX Optimize365
    Getting Started Integrations Assessing Client Security Remediation Account & Administration
  • CyberFOX Password Manager
    Using CyberFOX Password Manager Administrating CyberFOX Password Manager Legacy Password Boss
  • CyberFOX DNS Filtering
    Getting Started with DNS Filtering DNS Filtering Concepts Network Requirements for DNS Filtering DNS Filtering Company and Location Setup Managing your DNS Filtering Policies Using Roaming Clients for DNS Filtering DNS Filtering Reports & Logs DNS Filtering Troubleshooting FAQ
  • Marketing Toolkit
    MSP Marketing & Education Toolkit
  • Changelogs for Autoelevate and Password Boss
  • CyberFOX Product Roadmap
  • Current Status
+ More

Optimize365 uses two Microsoft 365 app registrations — one for read-only scanning and one for remediation. Each app requires a specific set of API permissions and Microsoft Entra roles.

Read-Only App (Optimize365-ReadOnly)

Used for security scanning and compliance analysis.

API Permissions

Permission API Permission type
Directory.Read.All Microsoft Graph Application
Application.Read.All Microsoft Graph Application
AppCatalog.Read.All Microsoft Graph Application
AuditLog.Read.All Microsoft Graph Application
AuditLogsQuery-Exchange.Read.All Microsoft Graph Application
AuditLogsQuery-SharePoint.Read.All Microsoft Graph Application
Reports.Read.All Microsoft Graph Application
Policy.Read.All Microsoft Graph Application
Domain.Read.All Microsoft Graph Application
Group.Read.All Microsoft Graph Application
Organization.Read.All Microsoft Graph Application
User.Read.All Microsoft Graph Application
User.ReadBasic.All Microsoft Graph Application
UserAuthenticationMethod.Read.All Microsoft Graph Application
UserAuthMethod-Passkey.Read.All Microsoft Graph Application
RoleManagement.Read.All Microsoft Graph Application
RoleManagement.Read.Exchange Microsoft Graph Application
PrivilegedAccess.Read.AzureAD Microsoft Graph Application
PrivilegedAccess.Read.AzureADGroup Microsoft Graph Application
PrivilegedAccess.Read.AzureResources Microsoft Graph Application
SecurityEvents.Read.All Microsoft Graph Application
SecurityActions.Read.All Microsoft Graph Application
ThreatAssessment.Read.All Microsoft Graph Application
InformationProtectionPolicy.Read.All Microsoft Graph Application
SharePointTenantSettings.Read.All Microsoft Graph Application
Sites.Read.All Microsoft Graph Application
TermStore.Read.All Microsoft Graph Application
TeamSettings.Read.All Microsoft Graph Application
MailboxSettings.Read Microsoft Graph Application
Device.Read.All Microsoft Graph Application
DeviceManagementManagedDevices.Read.All Microsoft Graph Application
DeviceManagementApps.Read.All Microsoft Graph Application
DeviceManagementConfiguration.Read.All Microsoft Graph Application
DeviceManagementServiceConfig.Read.All Microsoft Graph Application
ServiceHealth.Read.All Microsoft Graph Application
ServiceMessage.Read.All Microsoft Graph Application
ServiceActivity-Exchange.Read.All Microsoft Graph Application
OrgSettings-AppsAndServices.Read.All Microsoft Graph Application
OrgSettings-Forms.Read.All Microsoft Graph Application
MultiTenantOrganization.Read.All Microsoft Graph Application
Sites.FullControl.All SharePoint Online Application
Exchange.ManageAsApp Exchange Online Application
EopPolicySync.AccessAsApp Exchange Online Protection Application

Entra Roles

Role
Global Reader

Write App (Optimize365-Write)

Used for automated remediation.

API Permissions

Permission API Permission type
Directory.Read.All Microsoft Graph Application
Application.Read.All Microsoft Graph Application
AppCatalog.Read.All Microsoft Graph Application
AuditLog.Read.All Microsoft Graph Application
AuditLogsQuery-Exchange.Read.All Microsoft Graph Application
AuditLogsQuery-SharePoint.Read.All Microsoft Graph Application
Reports.Read.All Microsoft Graph Application
Policy.Read.All Microsoft Graph Application
Domain.Read.All Microsoft Graph Application
Group.Read.All Microsoft Graph Application
Organization.Read.All Microsoft Graph Application
User.Read.All Microsoft Graph Application
User.ReadBasic.All Microsoft Graph Application
UserAuthenticationMethod.Read.All Microsoft Graph Application
UserAuthMethod-Passkey.Read.All Microsoft Graph Application
RoleManagement.Read.All Microsoft Graph Application
RoleManagement.Read.Exchange Microsoft Graph Application
PrivilegedAccess.Read.AzureAD Microsoft Graph Application
PrivilegedAccess.Read.AzureADGroup Microsoft Graph Application
PrivilegedAccess.Read.AzureResources Microsoft Graph Application
SecurityEvents.Read.All Microsoft Graph Application
SecurityActions.Read.All Microsoft Graph Application
ThreatAssessment.Read.All Microsoft Graph Application
InformationProtectionPolicy.Read.All Microsoft Graph Application
SharePointTenantSettings.Read.All Microsoft Graph Application
Sites.Read.All Microsoft Graph Application
TermStore.Read.All Microsoft Graph Application
TeamSettings.Read.All Microsoft Graph Application
MailboxSettings.Read Microsoft Graph Application
Device.Read.All Microsoft Graph Application
DeviceManagementManagedDevices.Read.All Microsoft Graph Application
DeviceManagementApps.Read.All Microsoft Graph Application
DeviceManagementConfiguration.Read.All Microsoft Graph Application
DeviceManagementServiceConfig.Read.All Microsoft Graph Application
ServiceHealth.Read.All Microsoft Graph Application
ServiceMessage.Read.All Microsoft Graph Application
ServiceActivity-Exchange.Read.All Microsoft Graph Application
OrgSettings-AppsAndServices.Read.All Microsoft Graph Application
OrgSettings-Forms.Read.All Microsoft Graph Application
MultiTenantOrganization.Read.All Microsoft Graph Application
Sites.FullControl.All SharePoint Online Application
Exchange.ManageAsApp Exchange Online Application
EopPolicySync.AccessAsApp Exchange Online Protection Application
Directory.ReadWrite.All Microsoft Graph Application
Application.ReadWrite.All Microsoft Graph Application
Group.ReadWrite.All Microsoft Graph Application
Organization.ReadWrite.All Microsoft Graph Application
Policy.ReadWrite.ConditionalAccess Microsoft Graph Application
Policy.ReadWrite.AccessReview Microsoft Graph Application
Policy.ReadWrite.ApplicationConfiguration Microsoft Graph Application
Policy.ReadWrite.Authorization Microsoft Graph Application
Policy.ReadWrite.SecurityDefaults Microsoft Graph Application
AccessReview.ReadWrite.All Microsoft Graph Application
User.ReadWrite.All Microsoft Graph Application
UserAuthenticationMethod.ReadWrite.All Microsoft Graph Application
TeamSettings.ReadWrite.All Microsoft Graph Application
TermStore.ReadWrite.All Microsoft Graph Application
Sites.Manage.All Microsoft Graph Application
Sites.Archive.All Microsoft Graph Application
Sites.FullControl.All Microsoft Graph Application
Sites.ReadWrite.All Microsoft Graph Application
Sites.Selected Microsoft Graph Application
DeviceManagementApps.ReadWrite.All Microsoft Graph Application
DeviceManagementConfiguration.ReadWrite.All Microsoft Graph Application
DeviceManagementRBAC.ReadWrite.All Microsoft Graph Application
DeviceManagementServiceConfig.ReadWrite.All Microsoft Graph Application
DeviceManagementCloudCA.ReadWrite.All Microsoft Graph Application
full_access_as_app Exchange Online Application

Entra Roles

Role
Exchange Administrator
Security Administrator
Compliance Administrator
Conditional Access Administrator
Authentication Administrator
SharePoint Administrator
Teams Administrator
User Administrator
Application Administrator
Privileged Role Administrator
Authentication Policy Administrator
Cloud Application Administrator
Groups Administrator
Privileged Authentication Administrator
Security Operator
Azure Information Protection Administrator
Cloud Device Administrator
Global Secure Access Administrator
Compliance Data Administrator

Was this article helpful?

Yes
No
Give feedback about this article

Related Articles

  • Optimize365 Overview — Start Here
  • Getting Started with Optimize365
  • Generate Client Login Consent Share Link
  • Manually Assign the Global Reader Role to Optimize365
CyberFOX

PRACTICAL CYBERSECURITY FOR LEAN IT TEAMS

Platforms
  • Privileged Access Management
  • Password Management
  • DNS Filtering
  • SASE
Industry
  • Higher Education
  • K-12 Education
  • State and Local Government
  • Manufacturing
Company
  • About
  • Awards
  • Partnerships
  • Trust & Legal
  • Contact
  • Login
  • FAQ
  • Referral Program
  • Support
© 2026 CYBERFOX LLC ALL RIGHTS RESERVED | Privacy Policy | Terms of Service | Sitemap
Expand