Permissions explained

Mito’s app registration gets three kinds of access in your tenant. All of it is read-only: none of it lets Mito create, change or delete anything.

What	Granted on	Why
29 Microsoft Graph application permissions, all .Read	Microsoft Graph	Reads Entra ID, Intune, Defender, Purview, SharePoint and Teams settings through the Graph API
Exchange.ManageAsApp	Office 365 Exchange Online	Lets the app open an Exchange Online PowerShell session without a user signed in
Global Reader directory role	Your directory	Decides what that Exchange (and Teams) session may do: read, never write

Application permissions apply to the app itself, not to a signed-in user, which is what lets Mito run on a schedule. Because no user is involved, they need an administrator’s consent, which you give once when you set the app up.

Microsoft Graph permissions

These are the read-only scopes Mito’s assessment engine asks for, plus the scopes its preview checks of AI agent identities use.

Permission	What Mito reads with it
AgentIdentity.Read.All	AI agent identities in Entra ID, for the checks on who owns agents and what they can reach
AgentIdentityBlueprint.Read.All	Agent identity blueprints (the templates agents are created from)
AgentIdentityBlueprintPrincipal.Read.All	The service principals of those blueprints
Application.Read.All	App registrations and enterprise apps: credentials close to expiry, risky API permissions, unverified publishers
AuditLog.Read.All	Sign-in and directory audit logs, for example to find admins who have not signed in for months or still use legacy authentication
DeviceManagementConfiguration.Read.All	Intune device configuration and compliance policies
DeviceManagementManagedDevices.Read.All	Intune managed devices, to check compliance coverage
DeviceManagementRBAC.Read.All	Intune role assignments and scope tags
DeviceManagementServiceConfig.Read.All	Intune enrolment and service settings, such as enrolment restrictions and Windows Autopilot
Directory.Read.All	Users, groups, roles, domains and organisation settings: the basis of most identity checks
DirectoryRecommendations.Read.All	Microsoft’s own Entra ID recommendations for your tenant
EntitlementManagement.Read.All	Access packages and their assignment policies (Identity Governance)
IdentityRiskEvent.Read.All	Identity Protection risk detections, to confirm risk-based policies are working
NetworkAccess.Read.All	Global Secure Access settings
OnPremDirectorySynchronization.Read.All	Entra Connect / Cloud Sync settings, such as whether privileged accounts are synced from on-premises
OrgSettings-AppsAndServices.Read.All	Organisation-wide Microsoft 365 apps and services settings
OrgSettings-Forms.Read.All	Microsoft Forms settings, such as phishing protection and external sharing
Policy.Read.All	Authentication methods, authorisation, cross-tenant access and other tenant policies
Policy.Read.ConditionalAccess	Conditional Access policies and named locations
Reports.Read.All	Usage and registration reports, for example which users have registered MFA
ReportSettings.Read.All	Whether user names are concealed in Microsoft 365 reports
RoleEligibilitySchedule.Read.Directory	Privileged Identity Management (PIM) eligible role assignments
RoleManagement.Read.All	Directory role definitions and assignments: who holds Global Administrator and other privileged roles
RoleManagementAlert.Read.Directory	PIM security alerts
SecurityIdentitiesSensors.Read.All	Microsoft Defender for Identity sensors
SecurityIdentitiesHealth.Read.All	Defender for Identity health issues
SharePointTenantSettings.Read.All	SharePoint and OneDrive tenant settings, such as external sharing
ThreatHunting.Read.All	Runs read-only advanced hunting queries in Microsoft Defender, used by a few checks that cannot get their data any other way
UserAuthenticationMethod.Read.All	Which sign-in methods users have registered (for example whether admins have phishing-resistant MFA). It cannot read passwords or secrets.

None of these permissions can send mail, read mailbox contents, read files in SharePoint or OneDrive, or change settings. Some (such as AuditLog.Read.All and Directory.Read.All) do read information about people in your organisation, such as names, sign-in times and role memberships; Mito uses it only to evaluate the checks and show you the results.

Exchange.ManageAsApp

Many Exchange Online and Defender for Office 365 settings (anti-phishing, anti-spam, mail flow rules, mailbox auditing, DKIM) are only available through Exchange Online PowerShell, not Microsoft Graph. Exchange.ManageAsApp lets the app open such a session by itself.

The permission on its own grants no rights in Exchange. What the session may do is decided entirely by the directory role assigned to the app, which for Mito is Global Reader. So the session can run Get- commands that read configuration, and every command that would change something is refused by Exchange.

Global Reader

Global Reader is Microsoft’s built-in read-only administrator role: it can see everything a Global Administrator can see, and change nothing. Mito needs it because Exchange Online, Security & Compliance and Teams PowerShell check the app’s directory role, not its Graph permissions. It is the only role Mito’s app has.

If you prefer not to assign Global Reader, the Graph-based checks still run, and the Exchange, Defender for Office 365 and Teams checks are reported as skipped.

What the setup script itself asks for

When you run the setup script, it signs in as you with three extra delegated scopes: Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All and RoleManagement.ReadWrite.Directory. These let it create the app, grant consent and assign Global Reader on your behalf. They belong to your sign-in session only and are not given to Mito’s app.