# What Octiga needs from your tenant

> What a client's Global Administrator consents to when connecting a tenant, and what Octiga uses each permission and directory role for.

Connecting a client tenant to Octiga takes one consent grant. Knowing what it contains, and why Octiga needs each permission, helps when a client admin asks what they're agreeing to.

## The consent, in plain terms

A **Global Administrator at the client tenant** grants consent once, for the whole tenant; no other user at the client is asked for anything. Octiga then reads and manages Microsoft 365 for that tenant, and doesn't ask again unless the permissions change.

## Two applications

Octiga uses two separate Microsoft Entra app registrations:

- **A sign-in application**, used only so MSP staff can sign in to Octiga with their own Microsoft account. It holds no permissions on any client tenant.
- **A management application**, consented once per client tenant, that holds every permission below. This is the one a client's Global Administrator approves.

Keeping them separate means only the management application, scoped by the client's own consent, can access a client's data. A staff member's own Microsoft account can't.

## Permissions requested

The management application requests the permissions below, grouped by API. Each is an application permission: it works without a signed-in user, which lets Octiga sync and act on a schedule.

**Microsoft Graph — 20 permissions**

| Permission                                   | What it's used for                                                                            |
| -------------------------------------------- | --------------------------------------------------------------------------------------------- |
| Directory.ReadWrite.All                      | Read and write users, groups and other directory objects.                                     |
| User.ReadWrite.All                           | Read and update user profiles — used for password resets and account changes.                 |
| RoleManagement.ReadWrite.Directory           | Assign Octiga's own management application the least-privilege admin roles listed below.      |
| Policy.Read.All                              | Read tenant-wide policies.                                                                    |
| Policy.ReadWrite.ConditionalAccess           | Read and write Conditional Access policies, for the Conditional Access Policy baselines.      |
| Domain.ReadWrite.All                         | Read and verify the tenant's domains.                                                         |
| AuditLog.Read.All                            | Read sign-in and audit-log activity, used for account risk findings such as dormant accounts. |
| Reports.Read.All                             | Read Microsoft 365 usage reports.                                                             |
| Mail.ReadBasic.All                           | Read basic mailbox properties — never message content — across every mailbox.                 |
| MailboxSettings.ReadWrite                    | Read and change mailbox settings such as forwarding and inbox rules.                          |
| UserAuthenticationMethod.ReadWrite.All       | Read and write users' registered authentication methods.                                      |
| DeviceManagementConfiguration.ReadWrite.All  | Read and write Intune device compliance and configuration policies.                           |
| DeviceManagementManagedDevices.ReadWrite.All | Read and write properties of Intune-managed devices.                                          |
| DeviceManagementApps.ReadWrite.All           | Read and write Intune app protection policies.                                                |
| DeviceManagementServiceConfig.ReadWrite.All  | Read and write Intune service-level configuration.                                            |
| Sites.Read.All                               | Read SharePoint site collections.                                                             |
| Application.ReadWrite.All                    | Manage Octiga's own application registration and service principal in your tenant.            |
| AppRoleAssignment.ReadWrite.All              | Assign Octiga's own management application the directory roles listed below.                  |
| DelegatedPermissionGrant.ReadWrite.All       | Manage delegated permission grants for Octiga's own application, as part of setup.            |
| DelegatedAdminRelationship.ReadWrite.All     | Manage delegated admin relationships with your tenant.                                        |

**Exchange Online — 1 permission**

| Permission           | What it's used for                                                                                                                                                                                                        |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Exchange.ManageAsApp | Manage the tenant's Exchange Online configuration and mailboxes without an interactive sign-in — mail flow rules, forwarding, and the mailbox settings covered in [Mail flow](https://docs.octiga.io/tenants/mail-flow/). |

**Office 365 Management APIs — 3 permissions**

| Permission           | What it's used for                                                                                        |
| -------------------- | --------------------------------------------------------------------------------------------------------- |
| ActivityFeed.Read    | Read Microsoft 365 activity records — the source for [Events](https://docs.octiga.io/monitoring/events/). |
| ActivityFeed.ReadDlp | Read data-loss-prevention policy events, including detected sensitive data.                               |
| ServiceHealth.Read   | Read Microsoft 365 service health status.                                                                 |

**SharePoint — 3 permissions**

| Permission              | What it's used for                                                                       |
| ----------------------- | ---------------------------------------------------------------------------------------- |
| Sites.FullControl.All   | Full control of every SharePoint site collection, for the sharing and storage baselines. |
| TermStore.ReadWrite.All | Read and write SharePoint's managed metadata term store.                                 |
| User.ReadWrite.All      | Read and update user profile properties and basic site information in SharePoint.        |

## Directory roles Octiga assigns to itself

Once consent is granted, Octiga assigns its own management application these Microsoft Entra directory roles, so day-to-day reads and writes run under scoped admin roles rather than the application permissions alone:

- Exchange Administrator
- SharePoint Administrator
- Intune Administrator
- Security Administrator
- Authentication Policy Administrator
- User Administrator
- Domain Name Administrator
- Password Administrator
- Privileged Authentication Administrator

Global Administrator isn't among them: Octiga doesn't hold Global Administrator in your tenant.

> **Note:** Privileged Authentication Administrator lets Octiga reset the password of a user who holds an admin role. User Administrator alone can't reset an admin's password.

## Limits on this access

Octiga doesn't change Azure group membership; groups are a read-only input (see [Groups and priority](https://docs.octiga.io/baselines/groups-and-priority/)). It acts only on the tenants you've connected.