Permissions and licences
The read-only Microsoft Graph permissions Revo uses, and which signals need Entra ID P1 or P2.
Updated
Every permission is a read-only Microsoft Graph application permission. Revo never changes anything in a customer's tenant.
Graph permissions
| Permission | Used for |
|---|---|
| Directory.Read.All | Users, groups, roles (including role-assignable groups), licences, organisation, domains; a user's devices and groups |
| Policy.Read.All | Conditional Access, security defaults, authorization (consent and guest) policy, authentication methods policy |
| AuditLog.Read.All | Sign-in activity and MFA registration reports; directory audit logs (admin role changes, app consents); a user's recent sign-ins |
| UserAuthenticationMethod.Read.All | MFA registration details; a user's authentication methods |
| RoleManagement.Read.Directory | Privileged role assignments |
| Application.Read.All | App registrations, secrets and granted permissions |
| SecurityEvents.Read.All | Microsoft Secure Score and its recommendations |
| SharePointTenantSettings.Read.All | SharePoint and OneDrive sharing settings |
| SecurityAlert.Read.All | Defender XDR, Defender for Office 365 and Entra ID Protection alerts |
| IdentityRiskyUser.Read.All | Risky users |
| IdentityRiskEvent.Read.All | Risky sign-in detections |
| MailboxSettings.Read | Optional. Tells shared, room and equipment mailboxes apart from people, and reads inbox rules to find external forwarding |
Without MailboxSettings.Read, unlicensed accounts that look unused are listed as accounts to review instead of being confirmed as shared mailboxes, and external forwarding rules aren't read.
Licences
Some signals depend on the customer's Microsoft licences, not on Revo.
| Capability | Requires |
|---|---|
| Conditional Access analysis | Entra ID P1 |
| Sign-in activity (stale accounts, last sign-in) | Entra ID P1 |
| MFA registration report, and so sign-in strength | Entra ID P1 |
| A user's recent sign-ins | Entra ID P1 |
| Risky users and risk detections | Entra ID P2 |
| Security alerts | Only exist for licensed products: Defender for Office 365 / Business Premium, Defender XDR, Entra ID Protection |
| Secure Score | Any Microsoft 365 tenant with Defender data |
Checks that can't run for licensing reasons are recorded as skipped (licence-dependent) and never produce findings.
"Not available" messages
Every signal succeeds or fails on its own, and the Identity pages say which are available:
| Message | Means | Do this |
|---|---|---|
| Needs Microsoft Entra ID P1 (or P2) | A licensing fact for this tenant | Nothing, or upgrade the customer's licences |
| Reconnect to grant the permission | The tenant was connected before Revo asked for that permission | Generate a new consent link and have the customer's administrator approve it |
| The last sync failed | The user list couldn't be read | The pages keep the last good data; check the connection, then Sync now |
A temporary failure (throttling, an outage) keeps the previous values for that signal, so a throttled read never clears a risk state, a forwarding rule or an MFA method.
Not covered
Exchange Online settings only available through Exchange PowerShell (for example the external auto-forwarding policy or mailbox auditing), Intune device compliance, and forwarding set up other than by inbox rules (mailbox-level forwarding, transport rules). Microsoft's own alerts still report suspicious forwarding.