Permissions Explained
A complete breakdown of every Microsoft Graph permission IdentityOps requests, why it's needed, and what data it reads.
How IdentityOps accesses your data
IdentityOps uses delegated Microsoft Graph permissions. This means every API call runs in the context of the signed-in user — not as a background service or daemon. IdentityOps can only read what your admin account is authorized to see, and only while an active session exists.
There are no application-level permissions, no client secrets stored in your tenant, and no background processes polling your data. Every scan is initiated by a user session or a scheduled job that uses a securely stored refresh token.
Core permissions
These permissions are required for all IdentityOps plans. They cover app governance, license analysis, and user context.
View core permissions table
Device permissions (Pro plan)
These additional permissions are requested when you enable device governance on the Pro plan. They provide visibility into your Intune managed device fleet.
View device permissions table
Why read-only matters
Every permission listed above ends in .Read or .Read.All. Microsoft enforces these scopes at the API level. Even if there were a bug in IdentityOps that attempted a write operation — creating an app, modifying a user, deleting a device — Microsoft would reject the request with a 403 Forbidden error. This is not a policy we set; it is a constraint enforced by the Microsoft identity platform itself.
This design means IdentityOps is structurally incapable of modifying your tenant, regardless of what happens in our code. Read-only is not just a promise — it is an architectural guarantee enforced by Microsoft.
How to revoke access
You can revoke IdentityOps access at any time. No support ticket, no waiting period.