What Octiga needs from your tenant
Connecting a client tenant to Octiga takes one consent grant. Knowing what it contains, and why Octiga needs each permission, helps when a client admin asks what they’re agreeing to.
The consent, in plain terms
Section titled “The consent, in plain terms”A Global Administrator at the client tenant grants consent once, for the whole tenant; no other user at the client is asked for anything. Octiga then reads and manages Microsoft 365 for that tenant, and doesn’t ask again unless the permissions change.
Two applications
Section titled “Two applications”Octiga uses two separate Microsoft Entra app registrations:
- A sign-in application, used only so MSP staff can sign in to Octiga with their own Microsoft account. It holds no permissions on any client tenant.
- A management application, consented once per client tenant, that holds every permission below. This is the one a client’s Global Administrator approves.
Keeping them separate means only the management application, scoped by the client’s own consent, can access a client’s data. A staff member’s own Microsoft account can’t.
Permissions requested
Section titled “Permissions requested”The management application requests the permissions below, grouped by API. Each is an application permission: it works without a signed-in user, which lets Octiga sync and act on a schedule.
Microsoft Graph — 20 permissions
| Permission | What it’s used for |
|---|---|
| Directory.ReadWrite.All | Read and write users, groups and other directory objects. |
| User.ReadWrite.All | Read and update user profiles — used for password resets and account changes. |
| RoleManagement.ReadWrite.Directory | Assign Octiga’s own management application the least-privilege admin roles listed below. |
| Policy.Read.All | Read tenant-wide policies. |
| Policy.ReadWrite.ConditionalAccess | Read and write Conditional Access policies, for the Conditional Access Policy baselines. |
| Domain.ReadWrite.All | Read and verify the tenant’s domains. |
| AuditLog.Read.All | Read sign-in and audit-log activity, used for account risk findings such as dormant accounts. |
| Reports.Read.All | Read Microsoft 365 usage reports. |
| Mail.ReadBasic.All | Read basic mailbox properties — never message content — across every mailbox. |
| MailboxSettings.ReadWrite | Read and change mailbox settings such as forwarding and inbox rules. |
| UserAuthenticationMethod.ReadWrite.All | Read and write users’ registered authentication methods. |
| DeviceManagementConfiguration.ReadWrite.All | Read and write Intune device compliance and configuration policies. |
| DeviceManagementManagedDevices.ReadWrite.All | Read and write properties of Intune-managed devices. |
| DeviceManagementApps.ReadWrite.All | Read and write Intune app protection policies. |
| DeviceManagementServiceConfig.ReadWrite.All | Read and write Intune service-level configuration. |
| Sites.Read.All | Read SharePoint site collections. |
| Application.ReadWrite.All | Manage Octiga’s own application registration and service principal in your tenant. |
| AppRoleAssignment.ReadWrite.All | Assign Octiga’s own management application the directory roles listed below. |
| DelegatedPermissionGrant.ReadWrite.All | Manage delegated permission grants for Octiga’s own application, as part of setup. |
| DelegatedAdminRelationship.ReadWrite.All | Manage delegated admin relationships with your tenant. |
Exchange Online — 1 permission
| Permission | What it’s used for |
|---|---|
| Exchange.ManageAsApp | Manage the tenant’s Exchange Online configuration and mailboxes without an interactive sign-in — mail flow rules, forwarding, and the mailbox settings covered in Mail flow. |
Office 365 Management APIs — 3 permissions
| Permission | What it’s used for |
|---|---|
| ActivityFeed.Read | Read Microsoft 365 activity records — the source for Events. |
| ActivityFeed.ReadDlp | Read data-loss-prevention policy events, including detected sensitive data. |
| ServiceHealth.Read | Read Microsoft 365 service health status. |
SharePoint — 3 permissions
| Permission | What it’s used for |
|---|---|
| Sites.FullControl.All | Full control of every SharePoint site collection, for the sharing and storage baselines. |
| TermStore.ReadWrite.All | Read and write SharePoint’s managed metadata term store. |
| User.ReadWrite.All | Read and update user profile properties and basic site information in SharePoint. |
Directory roles Octiga assigns to itself
Section titled “Directory roles Octiga assigns to itself”Once consent is granted, Octiga assigns its own management application these Microsoft Entra directory roles, so day-to-day reads and writes run under scoped admin roles rather than the application permissions alone:
- Exchange Administrator
- SharePoint Administrator
- Intune Administrator
- Security Administrator
- Authentication Policy Administrator
- User Administrator
- Domain Name Administrator
- Password Administrator
- Privileged Authentication Administrator
Global Administrator isn’t among them: Octiga doesn’t hold Global Administrator in your tenant.
Limits on this access
Section titled “Limits on this access”Octiga doesn’t change Azure group membership; groups are a read-only input (see Groups and priority). It acts only on the tenants you’ve connected.