Tenant

This is Contoso's tenant

Everything here is sample data, and you can't change it in the demo. On your own tenant these controls work.

Permissions

What Orbit can read in your tenant. Every permission is read-only. Required permissions are part of the approval when your organisation signed up. Optional ones switch on extra checks, and you turn each one on in the report that uses it.

Permission	What Orbit uses it for	Type	Status
AccessReview.Read.All	Check whether access reviews are configured.	Required	Granted
Alert.Read.All	Microsoft Defender for Endpoint: read security alert summaries.	Required	Granted
Application.Read.All	Read app registrations: credentials (expired or long-lived secrets), redirect URIs, owners and the permissions apps hold.	Required	Granted
AttackSimulation.Read.All	Read attack simulation and training activity.	Required	Granted
AuditLog.Read.All	Read sign-in activity and authentication-method registration to flag inactive accounts and MFA gaps. Read the directory audit log to show who made a configuration change.	Required	Granted
ConfigurationMonitoring.Read.All	Read configuration snapshots from Microsoft's Tenant Configuration Management service. This is the only way to read Exchange Online, Defender for Office 365 and Teams meeting policies.	Required	Granted
DeviceManagementApps.Read.All	Read Intune mobile application protection (MAM) policies, and the Intune audit log to show who changed a policy.	Required	Granted
DeviceManagementConfiguration.Read.All	Read Intune configuration profiles, compliance policies, security baselines, endpoint security policies and update policies. Read their assignments and settings-catalog values to find policies that conflict.	Required	Granted
DeviceManagementManagedDevices.Read.All	Read Intune-managed device inventory, compliance, sync and encryption state.	Required	Granted
DeviceManagementServiceConfig.Read.All	Read Intune enrollment configuration and the health of the Apple push certificate, Apple VPP and enrollment tokens and Managed Google Play.	Required	Granted
Directory.Read.All	Resolve user, group and role names, and read directory settings such as password protection and consent configuration.	Required	Granted
IdentityUserFlow.Read.All	Read self-service sign-up user flows for external users.	Required	Granted
Machine.Read.All	Microsoft Defender for Endpoint: read device protection status.	Required	Granted
Organization.Read.All	Read your organisation's display name and hybrid (on-premises sync) status.	Required	Granted
Policy.Read.All	Read Conditional Access policies and named locations, authentication methods, consent and app-management policies, and cross-tenant access defaults.	Required	Granted
Reports.Read.All	Read Microsoft 365 usage reports (Teams and SharePoint site activity, Exchange mailbox usage and Copilot usage) to flag dormant and externally-shared content.	Required	Granted
RoleManagement.Read.Directory	Read Privileged Identity Management (PIM): eligible versus permanent admin role assignments and whether Global Administrator activation needs approval.	Required	Granted
RoleManagementAlert.Read.Directory	Read Privileged Identity Management's own security alerts.	Required	Granted
Score.Read.All	Microsoft Defender for Endpoint: read exposure and device scores.	Required	Granted
SecurityAlert.Read.All	Read security alert summaries across Microsoft Defender.	Required	Granted
SecurityConfiguration.Read.All	Microsoft Defender for Endpoint: read device security configuration assessments.	Required	Granted
SecurityRecommendation.Read.All	Microsoft Defender for Endpoint: read security recommendations.	Required	Granted
SensitivityLabels.Read.All	Read the tenant's Microsoft Purview sensitivity labels to check content classification is in place.	Required	Granted
SharePointTenantSettings.Read.All	Read the tenant's SharePoint and OneDrive settings: external sharing, device sync and session controls.	Required	Granted
Software.Read.All	Microsoft Defender for Endpoint: read device software inventory.	Required	Granted
Vulnerability.Read.All	Microsoft Defender for Endpoint: read device vulnerability information.	Required	Granted
ConfigurationMonitoring.ReadWrite.All	Ask Tenant Configuration Management to take a configuration snapshot each night, and delete Orbit's own finished snapshot jobs. This permission creates and deletes snapshot jobs only. It cannot change any setting in your tenant. You grant it in the Mail Security setup when you connect that report, never at sign-up.	Optional	Granted
MailboxSettings.Read	Read each mailbox's inbox rules to find rules that forward mail outside the organisation or hide warnings. The Mail Security setup script grants it.	Optional	Granted
Sites.Read.All	Read each site's sharing links and direct grants for the Copilot readiness site scan. You grant it in the readiness report when you enable the site scan, and you revoke it there when you finish.	Optional	Granted