Connect to Microsoft MCP integrations

Most Microsoft MCP integrations use the same connection pattern:

1. Create an app registration in Microsoft Entra ID.
2. Create a client secret.
3. Create the integration in Nango and add the client ID and client secret.
4. Copy the OAuth callback URL from Nango and add it to the app registration as a Web redirect URI under Authentication.
5. Add the Microsoft API permissions required by the integration.
6. Complete the Microsoft authorization flow.

This page covers the common setup. Each Microsoft integration still has its own permission list. Use the permission list provided by Kindo for the integration you are connecting.

Use the exact permissions for your integration

Do not grant broad Microsoft Graph permissions “just in case.” Add only the permissions required for the specific integration and tools you plan to use.

Applies to

Use this guide for Microsoft integrations that authenticate through Microsoft Entra ID, including:

• Microsoft Azure
• Microsoft Defender
• Microsoft Defender for Cloud
• Microsoft eDiscovery
• Microsoft Entra ID
• Microsoft Entra ID Governance
• Microsoft Excel Online
• Microsoft Fabric
• Microsoft Graph Security (Microsoft Defender XDR)
• Microsoft Intune
• Microsoft Outlook
• Microsoft Purview Compliance
• Microsoft Purview Data Governance
• Microsoft Teams
• SharePoint Online

Some integrations need extra tenant, endpoint, subscription, or target-user values. If Kindo gives you additional fields for a specific integration, enter them in the Kindo integration form after you complete the common Entra setup.

Prerequisites

• A Microsoft Entra ID tenant.
• Permission to create or update app registrations in that tenant.
• Permission to grant admin consent if the requested Microsoft API permissions require it.
• Access to the Nango dashboard for your Kindo deployment.
• The permission list for the Microsoft integration you are connecting.

Step 1: Create the Entra app registration

1. Open the Microsoft Entra admin center.

2. Go to Entra ID > App registrations.

3. Click New registration.

4. Enter a clear name, such as Kindo Microsoft MCP or Kindo - <Integration Name>.

5. Choose the supported account type for your tenant. For most enterprise setups, choose Accounts in this organizational directory only.

6. Leave Redirect URI empty for now. You will add the OAuth callback URL from Nango in a later step.

7. Click Register.

Step 2: Copy the client ID

1. Open the app registration you just created.

2. Go to Overview.

3. Copy Application (client) ID.

4. If the Kindo integration asks for it, also copy Directory (tenant) ID.

Step 3: Create a client secret

1. In the app registration, go to Certificates & secrets.

2. Open the Client secrets tab.

3. Click New client secret.

4. Add a description, such as Kindo integration.

5. Choose an expiration period that matches your organization’s policy.

6. Click Add.

7. Copy the secret Value immediately.

Copy the secret value, not the secret ID

Microsoft only shows the secret Value once. Kindo needs the secret value. The secret ID will not work.

Step 4: Create the integration in Nango

1. Open the Nango dashboard for your Kindo deployment.

2. Create a new integration for the Microsoft MCP you are connecting.

3. Enter the values from your Entra app registration:

   Field	Where to find it
   Client ID	App registration > Overview > Application (client) ID
   Client Secret	App registration > Certificates & secrets > Client secrets > Value
   Tenant ID	App registration > Overview > Directory (tenant) ID, if requested

4. Add any integration-specific fields that are requested, such as a Purview endpoint URL, Azure subscription ID, or target user ID.

5. Save the integration.

6. Copy the OAuth callback URL shown in the Nango integration setup. You need it in the next step.

   The callback URL usually ends with:

   /oauth/callback

Step 5: Add the Nango callback URL to the app registration

1. In the Microsoft Entra admin center, go back to your app registration.

2. Go to Authentication.

3. Under Platform configurations, click Add a platform and select Web.

4. Paste the OAuth callback URL you copied from Nango as the Redirect URI.

5. Save the configuration.

Step 6: Add Microsoft API permissions

1. In the app registration, go to API permissions.

2. Click Add a permission.

3. Select the Microsoft API required by your integration. Most Microsoft 365 integrations use Microsoft Graph.

4. Choose Delegated permissions. Kindo integrations use delegated permissions only.

5. Add the permissions from the integration-specific permission list.

6. If required, click Grant admin consent.

How delegated permissions work

Delegated permissions act as the signed-in user. The integration’s effective access is the intersection of two grants:

• the permissions granted to the application, and
• the permissions the signed-in user already has in the tenant.

The integration can never reach data the signed-in user cannot access themselves, and the user’s access through the integration is limited to what the registered application’s permissions allow. For example, if the app holds Sites.ReadWrite.All but the signed-in user only has read access to a SharePoint site, the integration cannot write to that site.

Integration-specific permissions

Microsoft Azure

This integration authenticates against Azure Resource Manager, not Microsoft Graph. An app registration set up for a Graph integration on this page will not work here, and vice versa.

The app registration is still created in Microsoft Entra ID: Azure identity lives in Entra, so an Azure Resource Manager token is an Entra token.

Add the following instead of the Microsoft Graph permissions:

API	Permission	Type	Admin consent required
Azure Resource Manager	user_impersonation	Delegated	No

Find Azure Resource Manager under the APIs my organization uses tab when adding a permission (App ID 797f4846-ba00-4fd7-ba43-dac1f8f63013).

When linking the connection, Kindo also asks for:

Field	Description
Tenant ID	App registration > Overview > Directory (tenant) ID
Subscription ID	Optional. The default subscription for tools that need one. Management-group and tenant-scoped tools work without it.

The user_impersonation permission grants no access to any Azure resource. It only lets Kindo sign you in and request an Azure Resource Manager token on your behalf. What that token can read comes entirely from Azure RBAC, so also assign a role to your account (Azure Portal > Subscriptions > your subscription > Access control (IAM) > Add role assignment):

Role	Grants
Reader	All read tools: subscriptions, resource groups, resources, policy and compliance, RBAC, and management groups

Assign Reader at a management group instead to cover every subscription beneath it in one assignment.

Microsoft Azure — Application mode

Microsoft Azure can also connect in application mode, where the integration authenticates as the app itself (client credentials) instead of as a signed-in user. Use the Microsoft Azure (Application) integration in Kindo. Set it up as its own integration, with its own app registration, client ID, and client secret — Steps 1 to 4 on this page apply unchanged.

Two things differ from the delegated setup above.

Skip Step 6. Application mode needs no API permissions at all. Azure Resource Manager exposes no application permissions, so there is nothing to add and nothing to consent. Adding Microsoft Graph application permissions grants a service principal no Azure access.

Assign the RBAC role to the app, not to yourself. With no signed-in user, the service principal is the only identity involved, so it needs the role directly (Azure Portal > Subscriptions > your subscription > Access control (IAM) > Add role assignment > Reader > Members > User, group, or service principal, then search for the app registration by name). Assign at a management group to cover every subscription beneath it.

Microsoft Azure — US Government

Select the Microsoft Azure (Government) integration in Kindo rather than Microsoft Azure, and create its app registration in the Azure Government portal at portal.azure.us. A commercial app registration cannot be used.

Add the same permission, connection fields, and RBAC role as above.

Azure has no separate GCC and GCC High tiers — every Azure Government subscription uses this integration.

Microsoft Defender

This integration uses permissions from three APIs: Microsoft Graph, Microsoft Threat Protection, and WindowsDefenderATP. All of them are Delegated permissions. Find Microsoft Threat Protection and WindowsDefenderATP under the APIs my organization uses tab when adding a permission.

Add the following Microsoft Graph permissions:

Permission	Description	Admin consent required
User.Read	Sign in and read user profile	No

Add the following Microsoft Threat Protection permissions:

Permission	Description	Admin consent required
Incident.Read	Read incidents	Yes
Incident.ReadWrite	Read and write incidents	Yes

Add the following WindowsDefenderATP permissions:

Permission	Description	Admin consent required
AdvancedQuery.Read	Run advanced queries	Yes
Alert.Read	Read alerts	Yes
Alert.ReadWrite	Read and write alerts	Yes
Machine.Isolate	Isolate machine	Yes
Machine.Read	Read machine information	Yes
Machine.Scan	Scan machine	Yes
Ti.ReadWrite	Read and write IOCs	Yes

Requires an active Defender for Endpoint subscription

This integration also requires an active Microsoft Defender for Endpoint subscription on the tenant, separate from the permissions above.

Microsoft Defender — GCC High

Select the Microsoft Defender for Endpoint (GCC High) integration in Kindo rather than Microsoft Defender, and create its app registration in the Azure Government portal at portal.azure.us. A commercial app registration cannot be used.

Add the same permissions listed above.

This integration supports GCC High and DoD tenants. GCC tenants are not supported.

Microsoft Defender for Cloud

This is a separate integration and product from Microsoft Defender above — it authenticates against Azure Resource Manager, not Microsoft Graph, so its setup differs from the other integrations on this page. An app registration set up for Microsoft Defender will not work here, and vice versa.

Add the following permission instead of Microsoft Graph:

API	Permission	Type	Admin consent required
Azure Resource Manager	user_impersonation	Delegated	No

Find Azure Resource Manager under the APIs my organization uses tab when adding a permission (App ID 797f4846-ba00-4fd7-ba43-dac1f8f63013).

When linking the connection, Kindo also asks for:

Field	Description
Tenant ID	App registration > Overview > Directory (tenant) ID
Subscription ID	The Azure subscription to monitor with Defender for Cloud

In addition to the Entra app permission, assign an Azure RBAC role to your account on that subscription (Azure Portal > Subscriptions > your subscription > Access control (IAM) > Add role assignment):

Role	Grants
Security Reader	All read tools (alerts, recommendations, secure score, compliance overview, security coverage)
Security Admin	Everything Security Reader does, plus dismissing/updating alerts

list_alerts returns empty until at least one paid Defender plan (e.g. Defender for Servers) is enabled on the subscription — the free tier still covers secure score, recommendations, and compliance overview.

Microsoft Defender for Cloud — US Government

Select the Microsoft Defender for Cloud (Government) integration in Kindo rather than Microsoft Defender for Cloud, and create its app registration in the Azure Government portal at portal.azure.us. A commercial app registration cannot be used.

Add the same permission, connection fields, and RBAC role as above.

Some tools return fewer results than in the commercial cloud:

Tool	In Azure Government
list_recommendation_findings	Machine vulnerability findings aren’t included.
list_security_coverage	Defender for AI Services, App Service, and Azure Cosmos DB aren’t listed.
get_compliance_overview	The available compliance standards differ.

Microsoft eDiscovery

Add the following Microsoft Graph permissions. All of them are Delegated permissions.

Permission	Description	Admin consent required
eDiscovery.Read.All	Read all eDiscovery objects	Yes
eDiscovery.ReadWrite.All	Read and write all eDiscovery objects	Yes
offline_access	Maintain access to data you have given it access to	No
User.Read	Sign in and read user profile	No

Microsoft eDiscovery — Application mode

Microsoft eDiscovery can also connect in application mode, where the integration authenticates as the app itself (client credentials) instead of as a signed-in user. This is a separate connection from the standard delegated eDiscovery integration above — set it up as its own Kindo integration if you need automation that runs without a signed-in user.

Two setup steps, not one

Granting the Microsoft Graph application permissions below is not enough by itself. eDiscovery access is also gated by a separate Microsoft Purview RBAC registration — see Step B below.

Step A: Grant the Graph application permissions

Add the following Microsoft Graph permissions as Application permissions (not Delegated) on the app registration:

Permission	Description	Admin consent required
eDiscovery.Read.All	Read all eDiscovery objects	Yes
eDiscovery.ReadWrite.All	Read and write all eDiscovery objects	Yes

Step B: Register the app in Microsoft Purview’s RBAC layer

This step happens in Security & Compliance PowerShell, not in Entra ID or the Purview portal UI — service principals cannot be added to eDiscovery role groups directly from the portal.

1. Get the app’s Object ID — not the Application (client) ID. In the Microsoft Entra admin center, go to Enterprise applications, search for your app, and copy the Object ID shown there (this is a different ID than the one on the app registration’s Overview page).

2. Install and connect the Exchange Online Management module:

   Install-Module ExchangeOnlineManagement
   Import-Module ExchangeOnlineManagement
   Connect-IPPSSession

3. Register the app as a service principal in Purview/Exchange’s RBAC system:

   New-ServicePrincipal -AppId "<application-client-id>" -ObjectId "<enterprise-app-object-id>" -DisplayName "Kindo - Microsoft eDiscovery (Application)"
   Get-ServicePrincipal

4. Add the service principal to the eDiscoveryManager role group:

   Add-RoleGroupMember -Identity "eDiscoveryManager" -Member "<enterprise-app-object-id>"
   Get-RoleGroupMember -Identity "eDiscoveryManager"

5. For access to all cases in the tenant rather than only cases the app is a member of, also grant eDiscovery Administrator:

   Add-eDiscoveryCaseAdmin -User "<enterprise-app-object-id>"
   Get-eDiscoveryCaseAdmin

Prerequisites for Step B:

• The tenant must have Microsoft Purview eDiscovery (Premium) licensed. A missing license produces the same 401 symptom even when both steps above are done correctly.
• An account with the Role Management role in Microsoft Purview, to run the RoleGroupMember/eDiscoveryCaseAdmin cmdlets above.

Microsoft Entra ID

Add the following Microsoft Graph permissions. All of them are Delegated permissions.

Permission	Description	Admin consent required
AppRoleAssignment.ReadWrite.All	Manage app permission grants and app role assignments	Yes
AuditLog.Read.All	Read audit log data	Yes
Directory.Read.All	Read directory data	Yes
DirectoryRecommendations.Read.All	Read Azure AD recommendations	Yes
Group.Read.All	Read all groups	Yes
GroupMember.Read.All	Read group memberships	Yes
offline_access	Maintain access to data you have given it access to	No
Policy.Read.All	Read your organization’s policies	Yes
Policy.Read.AuthenticationMethod	Read authentication method policies	Yes
Policy.Read.ConditionalAccess	Read your organization’s conditional access policies	No
Reports.Read.All	Read all usage reports	Yes
RoleManagement.Read.Directory	Read directory RBAC settings	Yes
User.EnableDisableAccount.All	Enable and disable user accounts	Yes
User.Read	Sign in and read user profile	No
User.Read.All	Read all users’ full profiles	Yes
User.ReadBasic.All	Read all users’ basic profiles	No

Microsoft Entra ID — conditional access

The What If tool needs Entra ID P1

Evaluating a hypothetical sign-in requires a Microsoft Entra ID P1 or P2 licence. Without one it returns Your tenant is not licensed for this feature. Office 365 E5 does not include Entra ID P1.

Reading conditional access policies and counting their impact from sign-in logs work without a premium licence. A tenant with no conditional access policies is usually running on Security Defaults, which the impact tools report by that name.

Microsoft Entra ID — Application mode

Microsoft Entra ID can also connect in application mode, where the integration authenticates as the app itself (client credentials) instead of as a signed-in user. This is a separate connection from the delegated integration above — set it up as its own Kindo integration if you need automation that runs without a signed-in user.

Add the following Microsoft Graph permissions as Application permissions (not Delegated) on the app registration. The set differs slightly from the delegated list: application mode reads app role assignments with Directory.Read.All and resolves users with User.Read.All.

Permission	Description	Admin consent required
AuditLog.Read.All	Read all audit log data	Yes
Directory.Read.All	Read directory data	Yes
DirectoryRecommendations.Read.All	Read all Azure AD recommendations	Yes
Group.Read.All	Read all groups	Yes
GroupMember.Read.All	Read all group memberships	Yes
Policy.Read.All	Read your organization’s policies	Yes
Policy.Read.AuthenticationMethod	Read authentication method policies	Yes
Policy.Read.ConditionalAccess	Read your organization’s conditional access policies	Yes
Reports.Read.All	Read all usage reports	Yes
RoleManagement.Read.Directory	Read all directory RBAC settings	Yes
User.EnableDisableAccount.All	Enable and disable user accounts	Yes
User.Read.All	Read all users’ full profiles	Yes

Two reports are delegated-only: Microsoft does not support application permissions for the authentication-method registration summary or the application sign-in summary, so those two tools fail on an application connection. Everything else works in either mode.

Microsoft Entra ID Governance

Add the following Microsoft Graph permissions. All of them are Delegated permissions.

Permission	Description	Admin consent required
AccessReview.Read.All	Read all access reviews that user can access	Yes
AccessReview.ReadWrite.All	Manage all access reviews that user can access	Yes
EntitlementManagement.Read.All	Read all entitlement management resources	Yes
EntitlementManagement.ReadWrite.All	Read and write entitlement management resources	Yes
LifecycleWorkflows-Reports.Read.All	Read all Lifecycle workflows reports	Yes
LifecycleWorkflows-Workflow.Activate	Run workflows on demand in Lifecycle workflows	Yes
LifecycleWorkflows-Workflow.ReadBasic.All	List all workflows in Lifecycle workflows	Yes
offline_access	Maintain access to data you have given it access to	No
PrivilegedAssignmentSchedule.Read.AzureADGroup	Read assignment schedules for access to Azure AD groups	Yes
PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup	Read, create, and delete assignment schedules for access to Azure AD groups	Yes
PrivilegedEligibilitySchedule.Read.AzureADGroup	Read eligibility schedules for access to Azure AD groups	Yes
PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup	Read, create, and delete eligibility schedules for access to Azure AD groups	Yes
RoleAssignmentSchedule.Read.Directory	Read all active role assignments for your company’s directory	Yes
RoleAssignmentSchedule.ReadWrite.Directory	Read, update, and delete all active role assignments for your company’s directory	Yes
RoleEligibilitySchedule.Read.Directory	Read all eligible role assignments for your company’s directory	Yes
RoleEligibilitySchedule.ReadWrite.Directory	Read, update, and delete all eligible role assignments for your company’s directory	Yes
RoleManagement.Read.Directory	Read directory RBAC settings	Yes
User.Read	Sign in and read user profile	No

PIM and Lifecycle Workflows need extra tenant licensing

• Privileged Identity Management (PIM) (role/group assignment and eligibility schedules) requires Microsoft Entra ID P2 (or Microsoft 365 E5).
• Lifecycle Workflows requires the separate Microsoft Entra ID Governance license.

Microsoft Excel Online

Add the following Microsoft Graph permissions. All of them are Delegated permissions.

Permission	Description	Admin consent required
Files.Read	Read user files	No
Files.ReadWrite	Have full access to user files	No
offline_access	Maintain access to data you have given it access to	No
User.Read	Sign in and read user profile	No

Microsoft Fabric

This integration authenticates as the app itself (a service principal using client credentials) instead of as a signed-in user, so its setup differs from the other integrations on this page:

• No additional API permissions are required. The default User.Read permission that Entra adds to every new app registration is enough, and it does not need admin consent.
• No redirect URI or user sign-in flow is needed. Skip Step 5, the Callback URL substep of Step 4, and the sign-in portion of Step 7. Use the Fabric connection form below instead of the Step 4 credentials table.
• Access is controlled inside Microsoft Fabric, not in Entra. Queries run with the service principal’s permissions, so grant it only the read access you intend to expose.

Configure the service principal in Microsoft Fabric:

1. In the Fabric admin portal, enable the Service principals can use Fabric APIs tenant setting.

2. Open the target Fabric workspace and select Manage access.

3. Add the app registration by name.

4. Assign the least-privileged role that can reach the target Lakehouse or Warehouse — typically a Viewer role or explicit SELECT rights.

When linking the Microsoft Fabric account, the connection form asks for the following values:

Field	Description
Tenant ID	App registration > Overview > Directory (tenant) ID
SQL Endpoint Host	Full host,port of the Fabric Lakehouse SQL endpoint, for example foo.datawarehouse.fabric.microsoft.com,1433
Lakehouse Database	Database/lakehouse name
Client ID	App registration > Overview > Application (client) ID
Client Secret	App registration > Certificates & secrets > Client secrets > Value

Microsoft Graph Security (Microsoft Defender XDR)

“Microsoft Graph Security” is Kindo’s internal name for this integration (matching the Graph /security/... namespace it calls); Microsoft’s product name for the same surface is Defender XDR (formerly Microsoft 365 Defender) — the unified security portal correlating signals across Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Entra ID Protection. It’s a different product from both Microsoft Defender (Defender for Endpoint specifically, a separate integration on this page) and Microsoft Defender for Cloud (Azure’s cloud security posture management, unrelated to the Defender XDR family).

Add the following Microsoft Graph permissions. All of them are Delegated permissions.

Permission	Description	Admin consent required
IdentityRiskyUser.Read.All	Read identity risky user information	Yes
IdentityRiskyUser.ReadWrite.All	Read and write risky user information	Yes
offline_access	Maintain access to data you have given it access to	No
SecurityAlert.Read.All	Read all security alerts	Yes
SecurityAlert.ReadWrite.All	Read and write to all security alerts	Yes
SecurityEvents.Read.All	Read your organization’s security events	Yes
SecurityIncident.Read.All	Read incidents	Yes
SecurityIncident.ReadWrite.All	Read and write to incidents	Yes
ThreatHunting.Read.All	Run hunting queries	Yes
User.Read	Sign in and read user profile	No

Some tools need extra licensing, not just permissions

• Risky users requires Microsoft Entra ID P2 (or Microsoft 365 E5) to be licensed on the tenant.
• Advanced hunting device-scoped tables like DeviceInfo require Microsoft Defender for Endpoint to be licensed.

Microsoft Graph Security — Application mode

Microsoft Graph Security can also connect in application mode, where the integration authenticates as the app itself (client credentials) instead of as a signed-in user. This is a separate connection from the delegated integration above — set it up as its own Kindo integration if you need automation that runs without a signed-in user.

Add the same permissions listed above, but as Application permissions (not Delegated) on the app registration. Unlike eDiscovery’s application mode, this one doesn’t need any extra RBAC registration step — the Graph application permissions alone are sufficient.

Microsoft Intune

Add the following Microsoft Graph permissions. All of them are Delegated permissions.

Permission	Description	Admin consent required
DeviceManagementApps.Read.All	Read Microsoft Intune apps	Yes
DeviceManagementConfiguration.Read.All	Read Microsoft Intune Device Configuration and Policies	Yes
DeviceManagementManagedDevices.PrivilegedOperations.All	Perform user-impacting remote actions on Microsoft Intune devices	Yes
DeviceManagementManagedDevices.Read.All	Read Microsoft Intune devices	Yes
offline_access	Maintain access to data you have given it access to	No
User.Read	Sign in and read user profile	No

Requires an active Intune license on the tenant

This integration also requires Microsoft Intune to be licensed on the tenant (bundled with Microsoft 365 E3/E5, Microsoft 365 Business Premium, Enterprise Mobility + Security E3/E5, or standalone Intune Plan 1), separate from the permissions above.

Microsoft Intune — Application mode

Microsoft Intune can also connect in application mode, where the integration authenticates as the app itself (client credentials) instead of as a signed-in user. This is a separate connection from the delegated integration above — set it up as its own Kindo integration if you need automation that runs without a signed-in user.

Add the same permissions listed above, but as Application permissions (not Delegated) on the app registration. The tenant licensing requirement above applies to this mode too.

Microsoft Outlook

Covers mail, calendar, and contacts in one integration. Add the following Microsoft Graph permissions. All of them are Delegated permissions. Mail is read and sent as the signed-in user.

Permission	Description	Admin consent required
Calendars.Read	Read user calendars	No
Calendars.Read.Shared	Read user and shared calendars	No
Calendars.ReadBasic	Read basic details of user calendars	No
Calendars.ReadWrite	Have full access to user calendars	No
Contacts.Read	Read user contacts	No
Mail.Read	Read user mail	No
Mail.ReadBasic	Read user basic mail	No
Mail.Send	Send mail as a user	No
offline_access	Maintain access to data you have given it access to	No
People.Read	Read users’ relevant people lists	No
User.Read	Sign in and read user profile	No

Microsoft Outlook Calendar

Add the following Microsoft Graph permissions. All of them are Delegated permissions.

Permission	Description	Admin consent required
Calendars.Read	Read user calendars	No
Calendars.Read.Shared	Read user and shared calendars	No
Calendars.ReadBasic	Read basic details of user calendars	No
Calendars.ReadWrite	Have full access to user calendars	No
offline_access	Maintain access to data you have given it access to	No
User.Read	Sign in and read user profile	No

find_meeting_times needs Calendars.Read.Shared — it reads attendee availability, which the unshared calendar permissions don’t cover.

Microsoft Purview Compliance

Add the following Microsoft Graph permissions. All of them are Delegated permissions.

Permission	Description	Admin consent required
AuditLogsQuery.Read.All	Read audit logs data from all services	Yes
Content.Process.User	Process content for data security, governance and compliance	Yes
Files.ReadWrite.All	Have full access to all files user can access	No
InformationProtectionPolicy.Read	Read user sensitivity labels and label policies.	No
offline_access	Maintain access to data you have given it access to	No
ProtectionScopes.Compute.User	Compute Purview policies for an individual user	Yes
SecurityAlert.Read.All	Read all security alerts	Yes
SecurityAlert.ReadWrite.All	Read and write to all security alerts	Yes
SecurityIncident.Read.All	Read incidents	Yes
SecurityIncident.ReadWrite.All	Read and write to incidents	Yes
ThreatHunting.Read.All	Run hunting queries	Yes
User.Read	Sign in and read user profile	No

Microsoft Purview Compliance — Application mode

Microsoft Purview Compliance can also connect in application mode, where the integration authenticates as the app itself (client credentials) instead of as a signed-in user. This is a separate connection from the delegated integration above — set it up as its own Kindo integration if you need automation that runs without a signed-in user. Tested and confirmed working.

Add the following Microsoft Graph permissions as Application permissions (not Delegated) on the app registration. Two differ from the delegated list: sensitivity labels come from the tenant catalog with InformationProtectionPolicy.Read.All, and protection scopes are computed tenant-wide with ProtectionScopes.Compute.All.

Permission	Description	Admin consent required
AuditLogsQuery.Read.All	Read audit logs data from all services	Yes
Content.Process.User	Process content for data security, governance and compliance	Yes
Files.ReadWrite.All	Read and write files in all site collections	Yes
InformationProtectionPolicy.Read.All	Read all published labels and label policies for an organization.	Yes
ProtectionScopes.Compute.All	Compute Purview policies at tenant scope	Yes
SecurityAlert.Read.All	Read all security alerts	Yes
SecurityAlert.ReadWrite.All	Read and write to all security alerts	Yes
SecurityIncident.Read.All	Read all security incidents	Yes
SecurityIncident.ReadWrite.All	Read and write to all security incidents	Yes
ThreatHunting.Read.All	Run hunting queries	Yes

For the Content.Process.User / ProtectionScopes.Compute.User tools specifically: DLP policies must be created with the New-DlpComplianceRule PowerShell cmdlet to apply to Entra-registered (app-only) callers — policies created in the Purview portal UI don’t apply to them.

Microsoft Purview Data Governance

This integration uses permissions from two APIs: Microsoft Graph and Microsoft Purview. All of them are Delegated permissions. Find Microsoft Purview under the APIs my organization uses tab when adding a permission.

Add the following Microsoft Graph permission:

Permission	Description	Admin consent required
User.Read	Sign in and read user profile	No

Add the following Microsoft Purview permission:

Permission	Description	Admin consent required
Purview.DelegatedAccess	Purview Delegated API Access	No

Also requires Purview collection role assignments

The permissions above only let the app call the API — the signed-in user also needs Purview data-plane roles assigned on a collection in the Microsoft Purview governance portal (Data Map → Collections → select the root collection → Role assignments):

Role	Grants
Data Curator	Catalog data plane — entities, glossary, lineage, relationships
Data Source Administrator	Scanning data plane — data sources, scans
Collection Admin	Account/metadata policy data plane — collections management

Only members of the Collection Admin role can assign these roles.

Microsoft Sentinel (Management)

Like Microsoft Defender for Cloud, this integration authenticates against Azure Resource Manager, not Microsoft Graph. Add the following permission instead of Microsoft Graph:

API	Permission	Type	Admin consent required
Azure Resource Manager	user_impersonation	Delegated	No

Find Azure Resource Manager under the APIs my organization uses tab when adding a permission (App ID 797f4846-ba00-4fd7-ba43-dac1f8f63013).

When linking the connection, Kindo also asks for:

Field	Description
Tenant ID	App registration > Overview > Directory (tenant) ID
Subscription ID	The subscription holding the Sentinel workspace
Resource Group Name	The resource group holding the workspace
Workspace Name	The Log Analytics workspace Sentinel runs on

All four are required — Microsoft.SecurityInsights has no tenant-level surface to fall back on.

In addition to the Entra app permission, assign an Azure RBAC role to your account on that workspace (Azure Portal > your workspace > Access control (IAM) > Add role assignment):

Role	Grants
Microsoft Sentinel Reader	All read tools (incidents, alerts, bookmarks, watchlists, analytics rules)
Microsoft Sentinel Responder	Everything Reader does, plus updating incidents and bookmarks
Microsoft Sentinel Contributor	Everything Responder does, plus creating and updating analytics rules and watchlists

Microsoft Sentinel (Management) — US Government

Select the Microsoft Sentinel Management (Government) integration in Kindo rather than Microsoft Sentinel (Management), and create its app registration in the Azure Government portal at portal.azure.us. A commercial app registration cannot be used.

Add the same permission, connection fields, and RBAC role as above.

Microsoft Teams

Add the following Microsoft Graph permissions. All of them are Delegated permissions.

Permission	Description	Admin consent required
Channel.ReadBasic.All	Read the names and descriptions of channels	No
ChannelMessage.Read.All	Read user channel messages	Yes
ChannelMessage.Send	Send channel messages	No
Chat.Create	Create chats	No
Chat.Read	Read user chat messages	No
Chat.ReadBasic	Read names and members of user chat threads	No
ChatMessage.Send	Send user chat messages	No
Files.Read.All	Read all files that user can access	No
Files.ReadWrite.All	Have full access to all files user can access	No
offline_access	Maintain access to data you have given it access to	No
OnlineMeetings.Read	Read user’s online meetings	No
OnlineMeetingTranscript.Read.All	Read all transcripts of online meetings.	Yes
Team.ReadBasic.All	Read the names and descriptions of teams	No
User.Read	Sign in and read user profile	No
User.ReadBasic.All	Read all users’ basic profiles	No

Microsoft Teams — meeting transcripts

Permissions alone are not enough

Microsoft Graph access to meeting transcripts is off by default in every tenant. Until an admin turns it on, the transcript tools fail regardless of the permissions granted above.

In the Teams admin center, go to Meetings > Meeting settings. Under Transcript API access, turn Microsoft Graph access On. Then select Configure and turn on Include speaker attribution, so transcripts identify who said what.

The PowerShell equivalent:

Connect-MicrosoftTeams
Set-CsTeamsMeetingConfiguration -EnableGraphTranscriptAccess $true -EnableAttributedTranscripts $true -Identity Global

The setting is tenant-wide, not per user.

OneDrive

Add the following Microsoft Graph permissions. All of them are Delegated permissions.

Permission	Description	Admin consent required
Files.Read	Read user files	No
Files.Read.All	Read all files that user can access	No
Files.ReadWrite.All	Have full access to all files user can access	No
offline_access	Maintain access to data you have given it access to	No
User.Read	Sign in and read user profile	No

Files.Read only covers the signed-in user’s own drive. Reading a drive by ID, including a SharePoint document library, needs Files.Read.All.

SharePoint Online

Add the following Microsoft Graph permissions. All of them are Delegated permissions.

Permission	Description	Admin consent required
Files.Read	Read user files	No
Files.ReadWrite	Have full access to user files	No
offline_access	Maintain access to data you have given it access to	No
Sites.Read.All	Read items in all site collections	No
Sites.ReadWrite.All	Edit or delete items in all site collections	No
User.Read	Sign in and read user profile	No

SharePoint Online — Application mode

Use the SharePoint Online (Application) integration in Kindo, with its own app registration. Steps 1 to 4 apply unchanged.

Add Sites.ReadWrite.All as an Application permission and grant admin consent. Skip Step 5 and the sign-in portion of Step 7: application mode needs no redirect URI. Enter the Tenant ID alongside the client ID and secret in the connection form.

Step 7: Authorize and test

1. Start the connection flow from Kindo.

2. Sign in with the Microsoft account that should authorize the integration.

3. Review the requested permissions.

4. Approve the connection.

5. In Kindo, run a low-risk read action first, such as listing calendars, searching a site, or listing available records.

6. After read access works, test any write actions in a safe test location before using the integration on production data.

Permission reference

Every tool across the Microsoft integrations, with the Microsoft permission it needs, whether it reads or writes, and whether an administrator has to consent. Use it to scope an app registration to exactly the tools you plan to use.

How to read the table:

• Delegated — the integration acts on behalf of a signed-in user. Every integration supports this mode.
• Application — the integration authenticates as the app itself, with no signed-in user. Only Microsoft Azure, Microsoft eDiscovery, Microsoft Entra ID, Microsoft Graph Security, Microsoft Intune, Microsoft Purview Compliance, and SharePoint Online offer it.
• Admin consent — Microsoft always requires tenant-wide admin consent for application permissions. The column shows the delegated requirement.
• Roles — rows labeled as a role are not Entra API permissions. Microsoft Azure, Microsoft Defender for Cloud, and Microsoft Sentinel (Management) authorize through Azure RBAC, and Microsoft Purview Data Governance through Purview collection roles. The signed-in user, or the app itself in application mode, must hold that role as well. Roles are assigned, not consented, so the admin consent column does not apply to them.
• A tool that needs more than one permission has one row per permission.

Note

Microsoft grants most of these permissions at the API level rather than per operation, so several tools in an integration share one permission. Granting it enables every tool listed against it — check the access column for which of those can write.

All integrationsMicrosoft AzureMicrosoft DefenderMicrosoft Defender for CloudMicrosoft eDiscoveryMicrosoft Entra IDMicrosoft Entra ID GovernanceMicrosoft Excel OnlineMicrosoft Graph Security (Microsoft Defender XDR)Microsoft IntuneMicrosoft OutlookMicrosoft Outlook CalendarMicrosoft Purview ComplianceMicrosoft Purview Data GovernanceMicrosoft Sentinel (Management)Microsoft TeamsOneDriveSharePoint Online

AllDelegatedApplication

AllReadWrite

323 of 323 tools

Integration	Tool	Permission	Delegated	Application	Access	Admin consent	What it does
Microsoft Azure	get_management_group	user_impersonation	✓		read	No	Get one Azure management group by ID, optionally with its child groups and subscriptions
Microsoft Azure	get_management_group	ReaderAzure RBAC role	✓	✓	read	—	Get one Azure management group by ID, optionally with its child groups and subscriptions
Microsoft Azure	get_policy_assignment	user_impersonation	✓		read	No	Get one Azure Policy assignment by name at a subscription, resource group, or management group scope
Microsoft Azure	get_policy_assignment	ReaderAzure RBAC role	✓	✓	read	—	Get one Azure Policy assignment by name at a subscription, resource group, or management group scope
Microsoft Azure	get_policy_compliance_summary	user_impersonation	✓		read	No	Summarize Azure Policy compliance counts for a subscription or a single policy assignment
Microsoft Azure	get_policy_compliance_summary	ReaderAzure RBAC role	✓	✓	read	—	Summarize Azure Policy compliance counts for a subscription or a single policy assignment
Microsoft Azure	get_policy_definition	user_impersonation	✓		read	No	Get one Azure Policy definition by name within a subscription
Microsoft Azure	get_policy_definition	ReaderAzure RBAC role	✓	✓	read	—	Get one Azure Policy definition by name within a subscription
Microsoft Azure	get_role_assignment	user_impersonation	✓		read	No	Get one Azure RBAC role assignment by name at a scope
Microsoft Azure	get_role_assignment	ReaderAzure RBAC role	✓	✓	read	—	Get one Azure RBAC role assignment by name at a scope
Microsoft Azure	get_role_definition	user_impersonation	✓		read	No	Get one Azure RBAC role definition by ID at a scope, including its allowed and denied actions
Microsoft Azure	get_role_definition	ReaderAzure RBAC role	✓	✓	read	—	Get one Azure RBAC role definition by ID at a scope, including its allowed and denied actions
Microsoft Azure	get_subscription	user_impersonation	✓		read	No	Get details of one Azure subscription by ID
Microsoft Azure	get_subscription	ReaderAzure RBAC role	✓	✓	read	—	Get details of one Azure subscription by ID
Microsoft Azure	list_management_group_descendants	user_impersonation	✓		read	No	List the management groups and subscriptions beneath a management group
Microsoft Azure	list_management_group_descendants	ReaderAzure RBAC role	✓	✓	read	—	List the management groups and subscriptions beneath a management group
Microsoft Azure	list_management_groups	user_impersonation	✓		read	No	List the Azure management groups visible to the signed-in user
Microsoft Azure	list_management_groups	ReaderAzure RBAC role	✓	✓	read	—	List the Azure management groups visible to the signed-in user
Microsoft Azure	list_noncompliant_resources	user_impersonation	✓		read	No	List resources that are non-compliant with Azure Policy in a subscription
Microsoft Azure	list_noncompliant_resources	ReaderAzure RBAC role	✓	✓	read	—	List resources that are non-compliant with Azure Policy in a subscription
Microsoft Azure	list_policy_assignments	user_impersonation	✓		read	No	List Azure Policy assignments at a subscription, resource group, or management group scope
Microsoft Azure	list_policy_assignments	ReaderAzure RBAC role	✓	✓	read	—	List Azure Policy assignments at a subscription, resource group, or management group scope
Microsoft Azure	list_policy_definitions	user_impersonation	✓		read	No	List built-in and custom Azure Policy definitions available at a scope
Microsoft Azure	list_policy_definitions	ReaderAzure RBAC role	✓	✓	read	—	List built-in and custom Azure Policy definitions available at a scope
Microsoft Azure	list_resource_groups	user_impersonation	✓		read	No	List resource groups in a subscription with their location and tags
Microsoft Azure	list_resource_groups	ReaderAzure RBAC role	✓	✓	read	—	List resource groups in a subscription with their location and tags
Microsoft Azure	list_resources	user_impersonation	✓		read	No	List Azure resources in a subscription or resource group, optionally filtered by type
Microsoft Azure	list_resources	ReaderAzure RBAC role	✓	✓	read	—	List Azure resources in a subscription or resource group, optionally filtered by type
Microsoft Azure	list_role_assignments	user_impersonation	✓		read	No	List Azure RBAC role assignments at a scope, optionally for one principal
Microsoft Azure	list_role_assignments	ReaderAzure RBAC role	✓	✓	read	—	List Azure RBAC role assignments at a scope, optionally for one principal
Microsoft Azure	list_role_definitions	user_impersonation	✓		read	No	List Azure RBAC role definitions available at a scope, optionally custom roles only
Microsoft Azure	list_role_definitions	ReaderAzure RBAC role	✓	✓	read	—	List Azure RBAC role definitions available at a scope, optionally custom roles only
Microsoft Azure	list_subscriptions	user_impersonation	✓		read	No	List the Azure subscriptions the signed-in user can access in the tenant
Microsoft Azure	list_subscriptions	ReaderAzure RBAC role	✓	✓	read	—	List the Azure subscriptions the signed-in user can access in the tenant
Microsoft Azure	query_resources	user_impersonation	✓		read	No	Run an Azure Resource Graph KQL query across subscriptions or management groups
Microsoft Azure	query_resources	ReaderAzure RBAC role	✓	✓	read	—	Run an Azure Resource Graph KQL query across subscriptions or management groups
Microsoft Defender	create_indicator	Ti.ReadWrite	✓		write	Yes	Create or update a Defender for Endpoint threat indicator for an IP, URL, domain, or file hash
Microsoft Defender	delete_indicator	Ti.ReadWrite	✓		write	Yes	Delete a Defender for Endpoint threat indicator by ID
Microsoft Defender	get_alert	Alert.Read	✓		read	Yes	Get a single Defender for Endpoint alert by ID
Microsoft Defender	get_incident	Incident.Read	✓		read	Yes	Get a Defender incident by ID, including its associated alerts
Microsoft Defender	get_indicator	Ti.ReadWrite	✓		read	Yes	Get a single Defender for Endpoint threat indicator by ID
Microsoft Defender	get_investigation	Alert.Read	✓		read	Yes	Get a Defender for Endpoint automated investigation by ID
Microsoft Defender	get_machine	Machine.Read	✓		read	Yes	Get a single Defender for Endpoint device by ID
Microsoft Defender	isolate_machine	Machine.Isolate	✓		write	Yes	Isolate a device from the network with full or selective isolation
Microsoft Defender	list_alerts	Alert.Read	✓		read	Yes	List Defender for Endpoint alerts filtered by status, severity, or an OData filter
Microsoft Defender	list_incidents	Incident.Read	✓		read	Yes	List Defender incidents filtered by status, assignee, or an OData filter
Microsoft Defender	list_indicators	Ti.ReadWrite	✓		read	Yes	List Defender for Endpoint threat indicators, optionally filtered by type or action
Microsoft Defender	list_investigations	Alert.Read	✓		read	Yes	List Defender for Endpoint automated investigations, optionally filtered by state or device
Microsoft Defender	list_machines	Machine.Read	✓		read	Yes	List Defender for Endpoint devices filtered by name, OS, risk score, or health status
Microsoft Defender	run_advanced_query	AdvancedQuery.Read	✓		read	Yes	Run a KQL advanced hunting query against Defender for Endpoint data
Microsoft Defender	run_antivirus_scan	Machine.Scan	✓		write	Yes	Start a quick or full Microsoft Defender Antivirus scan on a device
Microsoft Defender	unisolate_machine	Machine.Isolate	✓		write	Yes	Release a device from network isolation
Microsoft Defender	update_alert	Alert.ReadWrite	✓		write	Yes	Update a Defender for Endpoint alert's status, assignee, classification, or determination
Microsoft Defender	update_incident	Incident.ReadWrite	✓		write	Yes	Update a Defender incident's status, assignee, classification, determination, or tags
Microsoft Defender for Cloud	get_alert	user_impersonation	✓		read	No	Get one Defender for Cloud security alert with its entities, tactics, and remediation steps
Microsoft Defender for Cloud	get_alert	Security ReaderAzure RBAC role	✓		read	—	Get one Defender for Cloud security alert with its entities, tactics, and remediation steps
Microsoft Defender for Cloud	get_compliance_overview	user_impersonation	✓		read	No	Get the passing and failing controls for a regulatory compliance standard in the subscription
Microsoft Defender for Cloud	get_compliance_overview	Security ReaderAzure RBAC role	✓		read	—	Get the passing and failing controls for a regulatory compliance standard in the subscription
Microsoft Defender for Cloud	get_recommendation	user_impersonation	✓		read	No	Get one Defender for Cloud security recommendation (assessment) with its status and remediation
Microsoft Defender for Cloud	get_recommendation	Security ReaderAzure RBAC role	✓		read	—	Get one Defender for Cloud security recommendation (assessment) with its status and remediation
Microsoft Defender for Cloud	get_secure_score	user_impersonation	✓		read	No	Get the subscription's Defender for Cloud secure score with a breakdown by security control
Microsoft Defender for Cloud	get_secure_score	Security ReaderAzure RBAC role	✓		read	—	Get the subscription's Defender for Cloud secure score with a breakdown by security control
Microsoft Defender for Cloud	list_alerts	user_impersonation	✓		read	No	List Defender for Cloud security alerts for the subscription
Microsoft Defender for Cloud	list_alerts	Security ReaderAzure RBAC role	✓		read	—	List Defender for Cloud security alerts for the subscription
Microsoft Defender for Cloud	list_recommendation_findings	user_impersonation	✓		read	No	List the per-resource findings (sub-assessments) for a security recommendation
Microsoft Defender for Cloud	list_recommendation_findings	Security ReaderAzure RBAC role	✓		read	—	List the per-resource findings (sub-assessments) for a security recommendation
Microsoft Defender for Cloud	list_recommendations	user_impersonation	✓		read	No	List Defender for Cloud security recommendations (assessments) for the subscription
Microsoft Defender for Cloud	list_recommendations	Security ReaderAzure RBAC role	✓		read	—	List Defender for Cloud security recommendations (assessments) for the subscription
Microsoft Defender for Cloud	list_security_coverage	user_impersonation	✓		read	No	List enabled Defender for Cloud plans and available regulatory compliance standards
Microsoft Defender for Cloud	list_security_coverage	Security ReaderAzure RBAC role	✓		read	—	List enabled Defender for Cloud plans and available regulatory compliance standards
Microsoft Defender for Cloud	update_alert	user_impersonation	✓		write	No	Set a Defender for Cloud alert's status to Active, InProgress, Resolved, or Dismissed
Microsoft Defender for Cloud	update_alert	Security AdminAzure RBAC role	✓		write	—	Set a Defender for Cloud alert's status to Active, InProgress, Resolved, or Dismissed
Microsoft Entra ID	disable_user_account	User.EnableDisableAccount.All	✓	✓	write	Yes	Disable a user account so the user can no longer sign in
Microsoft Entra ID	disable_user_account	User.Read.All	✓	✓	read	Yes	Disable a user account so the user can no longer sign in
Microsoft Entra ID	enable_user_account	User.EnableDisableAccount.All	✓	✓	write	Yes	Enable a previously disabled user account so the user can sign in again
Microsoft Entra ID	enable_user_account	User.Read.All	✓	✓	read	Yes	Enable a previously disabled user account so the user can sign in again
Microsoft Entra ID	evaluate_conditional_access	Policy.Read.ConditionalAccess	✓	✓	read	No	Evaluate which conditional access policies would apply to a hypothetical user or service principal sign-in
Microsoft Entra ID	evaluate_conditional_access	User.ReadBasic.All	✓		read	No	Evaluate which conditional access policies would apply to a hypothetical user or service principal sign-in
Microsoft Entra ID	evaluate_conditional_access	User.Read.All		✓	read	Yes	Evaluate which conditional access policies would apply to a hypothetical user or service principal sign-in
Microsoft Entra ID	get_authentication_sla_attainment	Reports.Read.All	✓	✓	read	Yes	Read monthly Microsoft Entra authentication SLA attainment for the tenant
Microsoft Entra ID	get_conditional_access_impact_summary	AuditLog.Read.All	✓	✓	read	Yes	Count how many recent sign-ins each conditional access policy allowed, blocked, or skipped
Microsoft Entra ID	get_conditional_access_impact_summary	Policy.Read.ConditionalAccess	✓	✓	read	No	Count how many recent sign-ins each conditional access policy allowed, blocked, or skipped
Microsoft Entra ID	get_conditional_access_policy	Policy.Read.All	✓	✓	read	Yes	Get one conditional access policy with its conditions, grant controls, and session controls
Microsoft Entra ID	get_directory_audit_details	AuditLog.Read.All	✓	✓	read	Yes	Get one directory audit log entry with its full target resource list
Microsoft Entra ID	get_directory_audit_details	Directory.Read.All	✓	✓	read	Yes	Get one directory audit log entry with its full target resource list
Microsoft Entra ID	get_directory_objects_by_ids	Directory.Read.All	✓	✓	read	Yes	Resolve a batch of directory object ids to their user, group, or device objects
Microsoft Entra ID	get_directory_role	RoleManagement.Read.Directory	✓	✓	read	Yes	Get one activated directory role by object id or role template id
Microsoft Entra ID	get_group	Group.Read.All	✓	✓	read	Yes	Get one group by object id
Microsoft Entra ID	get_sign_in_details	AuditLog.Read.All	✓	✓	read	Yes	Get one sign-in log entry with its status, device, and location details
Microsoft Entra ID	get_user	User.Read.All	✓	✓	read	Yes	Get one user by object id or user principal name
Microsoft Entra ID	get_user_inplace_hold_status	User.Read.All	✓	✓	read	Yes	Get the in-place hold policies applied to a user's mailbox
Microsoft Entra ID	get_user_registration_details	AuditLog.Read.All	✓	✓	read	Yes	Get the authentication methods one user has registered and their MFA and passwordless capability
Microsoft Entra ID	get_user_registration_details	User.ReadBasic.All	✓		read	No	Get the authentication methods one user has registered and their MFA and passwordless capability
Microsoft Entra ID	get_user_registration_details	User.Read.All		✓	read	Yes	Get the authentication methods one user has registered and their MFA and passwordless capability
Microsoft Entra ID	get_users_registered_by_method	AuditLog.Read.All	✓		read	Yes	Count users registered for each authentication method, by user type and role
Microsoft Entra ID	list_adfs_application_activity	Reports.Read.All	✓	✓	read	Yes	List AD FS relying parties with sign-in volume and Entra migration readiness
Microsoft Entra ID	list_app_credential_sign_in_activity	AuditLog.Read.All	✓	✓	read	Yes	List application credentials with their last sign-in time and expiry
Microsoft Entra ID	list_application_sign_in_summary	Reports.Read.All	✓		read	Yes	List per-application sign-in counts with success or failure status
Microsoft Entra ID	list_authentication_strengths	Policy.Read.AuthenticationMethod	✓	✓	read	Yes	List authentication strength policies and the method combinations each accepts
Microsoft Entra ID	list_conditional_access_policies	Policy.Read.All	✓	✓	read	Yes	List conditional access policies with their enabled, disabled, or report-only state
Microsoft Entra ID	list_directory_audits	AuditLog.Read.All	✓	✓	read	Yes	List directory audit log entries recording who changed what in the directory
Microsoft Entra ID	list_directory_recommendations	DirectoryRecommendations.Read.All	✓	✓	read	Yes	List Microsoft Entra recommendations and Identity Secure Score improvement actions for the tenant
Microsoft Entra ID	list_directory_role_members	RoleManagement.Read.Directory	✓	✓	read	Yes	List the principals assigned to a directory role
Microsoft Entra ID	list_directory_roles	RoleManagement.Read.Directory	✓	✓	read	Yes	List the directory roles activated in the tenant
Microsoft Entra ID	list_group_members	GroupMember.Read.All	✓	✓	read	Yes	List a group's direct members, optionally narrowed to one directory object type
Microsoft Entra ID	list_group_owners	GroupMember.Read.All	✓	✓	read	Yes	List a group's owners, optionally narrowed to one directory object type
Microsoft Entra ID	list_groups	Group.Read.All	✓	✓	read	Yes	List groups in the directory with optional name, mail, and type filters
Microsoft Entra ID	list_named_locations	Policy.Read.All	✓	✓	read	Yes	List named locations (IP ranges and countries) referenced by conditional access policies
Microsoft Entra ID	list_provisioning_object_summary	AuditLog.Read.All	✓	✓	read	Yes	List provisioning log events for identities synchronized to and from the directory
Microsoft Entra ID	list_provisioning_object_summary	Directory.Read.All	✓	✓	read	Yes	List provisioning log events for identities synchronized to and from the directory
Microsoft Entra ID	list_service_principal_sign_in_activity	AuditLog.Read.All	✓	✓	read	Yes	List each service principal's last sign-in activity as client and resource
Microsoft Entra ID	list_sign_ins	AuditLog.Read.All	✓	✓	read	Yes	List sign-in log entries with status, device, location, and applied conditional access policies
Microsoft Entra ID	list_user_app_role_assignments	AppRoleAssignment.ReadWrite.All	✓		read	Yes	List the application role assignments granted to a user directly or through group membership
Microsoft Entra ID	list_user_app_role_assignments	Directory.Read.All		✓	read	Yes	List the application role assignments granted to a user directly or through group membership
Microsoft Entra ID	list_user_registration_details	AuditLog.Read.All	✓	✓	read	Yes	List the authentication methods each user has registered for MFA and passwordless coverage
Microsoft Entra ID	list_users	User.Read.All	✓	✓	read	Yes	List users in the directory with optional name, mail, and account-state filters
Microsoft Entra ID Governance	activate_lifecycle_workflow	LifecycleWorkflows-Workflow.Activate	✓		write	Yes	Run a lifecycle workflow on demand for specific users
Microsoft Entra ID Governance	apply_access_review_decisions	AccessReview.ReadWrite.All	✓		write	Yes	Apply the reviewer decisions of a completed access review instance
Microsoft Entra ID Governance	create_access_package_assignment_request	EntitlementManagement.ReadWrite.All	✓		write	Yes	Create an access package assignment request to add, remove, or update a user's access
Microsoft Entra ID Governance	create_group_assignment_request	PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup	✓		write	Yes	Create a PIM request to assign, activate, or remove privileged group membership or ownership
Microsoft Entra ID Governance	create_group_eligibility_request	PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup	✓		write	Yes	Create a PIM request to grant, extend, or remove eligibility for privileged group membership or ownership
Microsoft Entra ID Governance	create_role_assignment_request	RoleAssignmentSchedule.ReadWrite.Directory	✓		write	Yes	Create a PIM request to assign, activate, or deactivate a privileged directory role
Microsoft Entra ID Governance	create_role_eligibility_request	RoleEligibilitySchedule.ReadWrite.Directory	✓		write	Yes	Create a PIM request to grant, extend, renew, or remove eligibility for a directory role
Microsoft Entra ID Governance	get_access_package	EntitlementManagement.Read.All	✓		read	Yes	Get one access package by id
Microsoft Entra ID Governance	get_access_review_definition	AccessReview.Read.All	✓		read	Yes	Get one access review schedule definition with its scope, reviewers, and recurrence
Microsoft Entra ID Governance	get_lifecycle_workflow	LifecycleWorkflows-Workflow.ReadBasic.All	✓		read	Yes	Get one lifecycle workflow with its tasks, execution conditions, and scope
Microsoft Entra ID Governance	list_access_package_assignments	EntitlementManagement.Read.All	✓		read	Yes	List access package assignments and their state
Microsoft Entra ID Governance	list_access_package_catalogs	EntitlementManagement.Read.All	✓		read	Yes	List access package catalogs
Microsoft Entra ID Governance	list_access_packages	EntitlementManagement.Read.All	✓		read	Yes	List access packages, optionally filtered by catalog
Microsoft Entra ID Governance	list_access_review_decisions	AccessReview.Read.All	✓		read	Yes	List the reviewer decisions recorded for an access review instance
Microsoft Entra ID Governance	list_access_review_definitions	AccessReview.Read.All	✓		read	Yes	List access review schedule definitions
Microsoft Entra ID Governance	list_access_review_instances	AccessReview.Read.All	✓		read	Yes	List the review instances of an access review definition
Microsoft Entra ID Governance	list_group_assignment_schedules	PrivilegedAssignmentSchedule.Read.AzureADGroup	✓		read	Yes	List active PIM membership and ownership assignments for privileged groups
Microsoft Entra ID Governance	list_group_eligibility_schedules	PrivilegedEligibilitySchedule.Read.AzureADGroup	✓		read	Yes	List PIM eligibility for privileged group membership and ownership
Microsoft Entra ID Governance	list_lifecycle_workflow_runs	LifecycleWorkflows-Reports.Read.All	✓		read	Yes	List the run history of a lifecycle workflow with processing status and user counts
Microsoft Entra ID Governance	list_lifecycle_workflows	LifecycleWorkflows-Workflow.ReadBasic.All	✓		read	Yes	List lifecycle workflows, optionally filtered by joiner, mover, or leaver category
Microsoft Entra ID Governance	list_role_assignment_schedules	RoleAssignmentSchedule.Read.Directory	✓		read	Yes	List active PIM assignments of privileged directory roles
Microsoft Entra ID Governance	list_role_definitions	RoleManagement.Read.Directory	✓		read	Yes	List directory role definitions and their ids
Microsoft Entra ID Governance	list_role_eligibility_schedules	RoleEligibilitySchedule.Read.Directory	✓		read	Yes	List PIM eligibility for privileged directory roles
Microsoft Excel Online	add_table_rows	Files.ReadWrite	✓		write	No	Append rows of values to an Excel table
Microsoft Excel Online	add_worksheet	Files.ReadWrite	✓		write	No	Add a worksheet to an Excel workbook
Microsoft Excel Online	clear_range	Files.ReadWrite	✓		write	No	Clear contents, formats, or both from a cell range in a worksheet
Microsoft Excel Online	close_session	Files.ReadWrite	✓		write	No	Close an Excel workbook session
Microsoft Excel Online	create_session	Files.ReadWrite	✓		write	No	Create a persistent or non-persistent Excel workbook session
Microsoft Excel Online	create_table	Files.ReadWrite	✓		write	No	Create a table from a cell range on a worksheet
Microsoft Excel Online	create_workbook	Files.ReadWrite	✓		write	No	Create an empty Excel workbook in the signed-in user's OneDrive
Microsoft Excel Online	delete_worksheet	Files.ReadWrite	✓		write	No	Delete a worksheet from an Excel workbook
Microsoft Excel Online	get_range	Files.ReadWrite	✓		read	No	Read values, formulas, and number formats from a cell range in a worksheet
Microsoft Excel Online	get_table_data	Files.ReadWrite	✓		read	No	Get the columns and rows of an Excel table
Microsoft Excel Online	get_used_range	Files.ReadWrite	✓		read	No	Get the used range of a worksheet with its address, values, and formulas
Microsoft Excel Online	get_worksheet	Files.ReadWrite	✓		read	No	Get a worksheet in an Excel workbook by name or ID
Microsoft Excel Online	list_drive_items	Files.Read	✓		read	No	List files and folders in a OneDrive folder
Microsoft Excel Online	list_named_items	Files.ReadWrite	✓		read	No	List the named ranges and constants defined in an Excel workbook
Microsoft Excel Online	list_tables	Files.ReadWrite	✓		read	No	List the tables in an Excel workbook or on one worksheet
Microsoft Excel Online	list_worksheets	Files.ReadWrite	✓		read	No	List the worksheets in an Excel workbook
Microsoft Excel Online	search_workbooks	Files.Read	✓		read	No	Search the signed-in user's OneDrive for Excel workbooks by name
Microsoft Excel Online	update_range	Files.ReadWrite	✓		write	No	Write values, formulas, or number formats to a cell range in a worksheet
Microsoft Graph Security (Microsoft Defender XDR)	confirm_risky_users_compromised	IdentityRiskyUser.ReadWrite.All	✓	✓	write	Yes	Confirm one or more risky users as compromised, setting their risk level to high
Microsoft Graph Security (Microsoft Defender XDR)	confirm_risky_users_safe	IdentityRiskyUser.ReadWrite.All	✓	✓	write	Yes	Confirm one or more risky users as safe, setting their risk level to none
Microsoft Graph Security (Microsoft Defender XDR)	create_alert_comment	SecurityAlert.ReadWrite.All	✓	✓	write	Yes	Add a comment to a Defender XDR security alert
Microsoft Graph Security (Microsoft Defender XDR)	create_incident_comment	SecurityIncident.ReadWrite.All	✓	✓	write	Yes	Add a comment to a Defender XDR security incident
Microsoft Graph Security (Microsoft Defender XDR)	dismiss_risky_users	IdentityRiskyUser.ReadWrite.All	✓	✓	write	Yes	Dismiss the risk of one or more risky users, resetting their risk level to none
Microsoft Graph Security (Microsoft Defender XDR)	get_alert	SecurityAlert.Read.All	✓	✓	read	Yes	Get a single Defender XDR security alert by ID, including its evidence
Microsoft Graph Security (Microsoft Defender XDR)	get_incident	SecurityIncident.Read.All	✓	✓	read	Yes	Get a single Defender XDR security incident by ID, optionally with its related alerts
Microsoft Graph Security (Microsoft Defender XDR)	get_risky_user	IdentityRiskyUser.Read.All	✓	✓	read	Yes	Get a single risky user from Entra ID Protection by ID
Microsoft Graph Security (Microsoft Defender XDR)	list_alerts	SecurityAlert.Read.All	✓	✓	read	Yes	List Defender XDR security alerts filtered by severity, status, source, assignee, or date
Microsoft Graph Security (Microsoft Defender XDR)	list_incidents	SecurityIncident.Read.All	✓	✓	read	Yes	List Defender XDR security incidents filtered by severity, status, classification, assignee, or date
Microsoft Graph Security (Microsoft Defender XDR)	list_risky_users	IdentityRiskyUser.Read.All	✓	✓	read	Yes	List risky users from Entra ID Protection filtered by risk level, risk state, or user
Microsoft Graph Security (Microsoft Defender XDR)	list_secure_score_control_profiles	SecurityEvents.Read.All	✓	✓	read	Yes	List Microsoft Secure Score control profiles with their scores and improvement actions
Microsoft Graph Security (Microsoft Defender XDR)	list_secure_scores	SecurityEvents.Read.All	✓	✓	read	Yes	List daily Microsoft Secure Score snapshots for the tenant
Microsoft Graph Security (Microsoft Defender XDR)	run_hunting_query	ThreatHunting.Read.All	✓	✓	read	Yes	Run a KQL advanced hunting query against Defender XDR data
Microsoft Graph Security (Microsoft Defender XDR)	update_alert	SecurityAlert.ReadWrite.All	✓	✓	write	Yes	Update a Defender XDR alert's status, assignee, classification, or determination
Microsoft Graph Security (Microsoft Defender XDR)	update_incident	SecurityIncident.ReadWrite.All	✓	✓	write	Yes	Update a Defender XDR incident's status, assignee, classification, determination, or custom tags
Microsoft Intune	get_compliance_policy	DeviceManagementConfiguration.Read.All	✓	✓	read	Yes	Get one Intune device compliance policy by ID
Microsoft Intune	get_device_configuration	DeviceManagementConfiguration.Read.All	✓	✓	read	Yes	Get one Intune device configuration profile by ID
Microsoft Intune	get_managed_device	DeviceManagementManagedDevices.Read.All	✓	✓	read	Yes	Get one Intune managed device with its hardware, OS, compliance, and enrollment details
Microsoft Intune	get_mobile_app	DeviceManagementApps.Read.All	✓	✓	read	Yes	Get one Intune managed app by ID
Microsoft Intune	list_compliance_policies	DeviceManagementConfiguration.Read.All	✓	✓	read	Yes	List Intune device compliance policies
Microsoft Intune	list_compliance_policy_device_statuses	DeviceManagementConfiguration.Read.All	✓	✓	read	Yes	List per-device compliance status for an Intune compliance policy
Microsoft Intune	list_device_configuration_device_statuses	DeviceManagementConfiguration.Read.All	✓	✓	read	Yes	List per-device deployment status for an Intune device configuration profile
Microsoft Intune	list_device_configurations	DeviceManagementConfiguration.Read.All	✓	✓	read	Yes	List Intune device configuration profiles
Microsoft Intune	list_managed_devices	DeviceManagementManagedDevices.Read.All	✓	✓	read	Yes	List Intune managed devices, optionally filtered by name, OS, compliance state, or user
Microsoft Intune	list_mobile_app_device_statuses	DeviceManagementApps.Read.All	✓	✓	read	Yes	List per-device install status for an Intune managed app
Microsoft Intune	list_mobile_apps	DeviceManagementApps.Read.All	✓	✓	read	Yes	List Intune managed apps, optionally filtered by name or app type
Microsoft Intune	retire_managed_device	DeviceManagementManagedDevices.PrivilegedOperations.All	✓	✓	write	Yes	Retire an Intune managed device, removing company data while keeping personal data
Microsoft Intune	sync_managed_device	DeviceManagementManagedDevices.PrivilegedOperations.All	✓	✓	write	Yes	Force an Intune managed device to check in for the latest policies
Microsoft Intune	wipe_managed_device	DeviceManagementManagedDevices.PrivilegedOperations.All	✓	✓	write	Yes	Factory-reset an Intune managed device, optionally keeping enrollment or user data
Microsoft Outlook	create_event	Calendars.ReadWrite	✓		write	No	Create a calendar event, optionally as a Teams online meeting
Microsoft Outlook	delete_event	Calendars.ReadWrite	✓		write	No	Delete a calendar event
Microsoft Outlook	find_meeting_times	Calendars.Read.Shared	✓		read	No	Suggest meeting times when the given attendees are free
Microsoft Outlook	get_contact	Contacts.Read	✓		read	No	Get a single contact from the user's Outlook contacts
Microsoft Outlook	get_event	Calendars.Read	✓		read	No	Get a calendar event with its attendees, location, and body
Microsoft Outlook	get_message	Mail.Read	✓		read	No	Read the full body and attachment metadata of one email message
Microsoft Outlook	get_schedule	Calendars.ReadBasic	✓		read	No	Get free/busy availability for one or more users in a time window
Microsoft Outlook	list_calendars	Calendars.ReadBasic	✓		read	No	List the user's calendars
Microsoft Outlook	list_contacts	Contacts.Read	✓		read	No	List email addresses from the user's saved Outlook contacts
Microsoft Outlook	list_emails	People.Read	✓		read	No	List the people the user most often communicates with and their email addresses
Microsoft Outlook	list_events	Calendars.Read	✓		read	No	List calendar events, optionally within a date range or matching a search
Microsoft Outlook	list_mail_folders	Mail.ReadBasic	✓		read	No	List the mail folders in the user's mailbox
Microsoft Outlook	list_messages	Mail.Read	✓		read	No	List or search email messages in the user's mailbox
Microsoft Outlook	respond_to_event	Calendars.ReadWrite	✓		write	No	Accept, decline, or tentatively accept a meeting invitation
Microsoft Outlook	send_email	Mail.Send	✓		write	No	Send an email with optional attachments as the signed-in user
Microsoft Outlook	update_event	Calendars.ReadWrite	✓		write	No	Update the subject, time, location, attendees, or body of a calendar event
Microsoft Outlook Calendar	create_event	Calendars.ReadWrite	✓		write	No	Create a calendar event, optionally as a Teams online meeting
Microsoft Outlook Calendar	delete_event	Calendars.ReadWrite	✓		write	No	Delete a calendar event
Microsoft Outlook Calendar	find_meeting_times	Calendars.Read.Shared	✓		read	No	Suggest meeting times when the given attendees are free
Microsoft Outlook Calendar	get_event	Calendars.Read	✓		read	No	Get a calendar event with its attendees, location, and body
Microsoft Outlook Calendar	get_schedule	Calendars.ReadBasic	✓		read	No	Get free/busy availability for one or more users in a time window
Microsoft Outlook Calendar	list_calendars	Calendars.ReadBasic	✓		read	No	List the user's calendars
Microsoft Outlook Calendar	list_events	Calendars.Read	✓		read	No	List calendar events, optionally within a date range or matching a search
Microsoft Outlook Calendar	respond_to_event	Calendars.ReadWrite	✓		write	No	Accept, decline, or tentatively accept a meeting invitation
Microsoft Outlook Calendar	update_event	Calendars.ReadWrite	✓		write	No	Update the subject, time, location, attendees, or body of a calendar event
Microsoft Purview Compliance	assign_sensitivity_label	Files.ReadWrite.All	✓	✓	write	No	Assign a sensitivity label to a file in OneDrive or SharePoint
Microsoft Purview Compliance	compute_protection_scopes	ProtectionScopes.Compute.User	✓		read	Yes	Determine which Purview DLP policies apply to the signed-in user's activities
Microsoft Purview Compliance	compute_protection_scopes	ProtectionScopes.Compute.All		✓	read	Yes	Determine which Purview DLP policies apply to the signed-in user's activities
Microsoft Purview Compliance	create_audit_log_query	AuditLogsQuery.Read.All	✓	✓	read	Yes	Start an audit log search across Microsoft 365 services for a date range and filters
Microsoft Purview Compliance	get_alert	SecurityAlert.Read.All	✓	✓	read	Yes	Get a security alert by ID with its evidence and MITRE ATT&CK techniques
Microsoft Purview Compliance	get_audit_log_query	AuditLogsQuery.Read.All	✓	✓	read	Yes	Get the status and details of an audit log search
Microsoft Purview Compliance	get_incident	SecurityIncident.Read.All	✓	✓	read	Yes	Get a security incident by ID, optionally with its related alerts
Microsoft Purview Compliance	list_alerts	SecurityAlert.Read.All	✓	✓	read	Yes	List security alerts from Purview DLP and other Microsoft security services
Microsoft Purview Compliance	list_audit_log_records	AuditLogsQuery.Read.All	✓	✓	read	Yes	List the records returned by a completed audit log search
Microsoft Purview Compliance	list_incidents	SecurityIncident.Read.All	✓	✓	read	Yes	List security incidents from Purview DLP and other Microsoft security services
Microsoft Purview Compliance	list_sensitivity_labels	InformationProtectionPolicy.Read	✓		read	No	List the Purview sensitivity labels available to the signed-in user
Microsoft Purview Compliance	list_sensitivity_labels	InformationProtectionPolicy.Read.All		✓	read	Yes	List the Purview sensitivity labels available to the signed-in user
Microsoft Purview Compliance	process_content	Content.Process.User	✓	✓	read	Yes	Evaluate text against Purview DLP policies for the signed-in user and return enforcement actions
Microsoft Purview Compliance	run_hunting_query	ThreatHunting.Read.All	✓	✓	read	Yes	Run a KQL advanced hunting query against Microsoft Defender XDR data
Microsoft Purview Compliance	update_alert	SecurityAlert.ReadWrite.All	✓	✓	write	Yes	Update the status, assignee, classification, or details of a security alert
Microsoft Purview Compliance	update_incident	SecurityIncident.ReadWrite.All	✓	✓	write	Yes	Update the status, severity, assignee, classification, or details of a security incident
Microsoft Purview Data Governance	add_entity_classifications	Purview.DelegatedAccess	✓		write	No	Add one or more classifications to a Purview data asset
Microsoft Purview Data Governance	add_entity_classifications	Data CuratorPurview collection role	✓		write	—	Add one or more classifications to a Purview data asset
Microsoft Purview Data Governance	assign_glossary_term	Purview.DelegatedAccess	✓		write	No	Assign a Purview glossary term to one or more data assets
Microsoft Purview Data Governance	assign_glossary_term	Data CuratorPurview collection role	✓		write	—	Assign a Purview glossary term to one or more data assets
Microsoft Purview Data Governance	create_glossary_term	Purview.DelegatedAccess	✓		write	No	Create a term in a Purview business glossary
Microsoft Purview Data Governance	create_glossary_term	Data CuratorPurview collection role	✓		write	—	Create a term in a Purview business glossary
Microsoft Purview Data Governance	create_or_update_collection	Purview.DelegatedAccess	✓		write	No	Create or update a Purview collection used to organize data assets
Microsoft Purview Data Governance	create_or_update_collection	Collection AdminPurview collection role	✓		write	—	Create or update a Purview collection used to organize data assets
Microsoft Purview Data Governance	create_or_update_data_source	Purview.DelegatedAccess	✓		write	No	Register or update a data source in Purview for scanning
Microsoft Purview Data Governance	create_or_update_data_source	Data Source AdministratorPurview collection role	✓		write	—	Register or update a data source in Purview for scanning
Microsoft Purview Data Governance	create_or_update_entity	Purview.DelegatedAccess	✓		write	No	Create or update a data asset in the Purview data map
Microsoft Purview Data Governance	create_or_update_entity	Data CuratorPurview collection role	✓		write	—	Create or update a data asset in the Purview data map
Microsoft Purview Data Governance	create_or_update_scan	Purview.DelegatedAccess	✓		write	No	Create or update a scan definition for a Purview data source
Microsoft Purview Data Governance	create_or_update_scan	Data Source AdministratorPurview collection role	✓		write	—	Create or update a scan definition for a Purview data source
Microsoft Purview Data Governance	create_relationship	Purview.DelegatedAccess	✓		write	No	Create a relationship between two Purview data assets
Microsoft Purview Data Governance	create_relationship	Data CuratorPurview collection role	✓		write	—	Create a relationship between two Purview data assets
Microsoft Purview Data Governance	delete_collection	Purview.DelegatedAccess	✓		write	No	Delete an empty Purview collection by name
Microsoft Purview Data Governance	delete_collection	Collection AdminPurview collection role	✓		write	—	Delete an empty Purview collection by name
Microsoft Purview Data Governance	delete_entity	Purview.DelegatedAccess	✓		write	No	Delete a data asset from the Purview data map by GUID
Microsoft Purview Data Governance	delete_entity	Data CuratorPurview collection role	✓		write	—	Delete a data asset from the Purview data map by GUID
Microsoft Purview Data Governance	delete_relationship	Purview.DelegatedAccess	✓		write	No	Delete a relationship between Purview data assets by GUID
Microsoft Purview Data Governance	delete_relationship	Data CuratorPurview collection role	✓		write	—	Delete a relationship between Purview data assets by GUID
Microsoft Purview Data Governance	get_classification_def	Purview.DelegatedAccess	✓		read	No	Get a Purview classification type definition by name
Microsoft Purview Data Governance	get_classification_def	Data ReaderPurview collection role	✓		read	—	Get a Purview classification type definition by name
Microsoft Purview Data Governance	get_collection	Purview.DelegatedAccess	✓		read	No	Get a Purview collection by name, including its parent path
Microsoft Purview Data Governance	get_collection	Data ReaderPurview collection role	✓		read	—	Get a Purview collection by name, including its parent path
Microsoft Purview Data Governance	get_data_source	Purview.DelegatedAccess	✓		read	No	Get a registered Purview data source by name
Microsoft Purview Data Governance	get_data_source	Data Source AdministratorPurview collection role	✓		read	—	Get a registered Purview data source by name
Microsoft Purview Data Governance	get_entity	Purview.DelegatedAccess	✓		read	No	Get the full definition of a Purview data asset by GUID
Microsoft Purview Data Governance	get_entity	Data ReaderPurview collection role	✓		read	—	Get the full definition of a Purview data asset by GUID
Microsoft Purview Data Governance	get_entity_by_qualified_name	Purview.DelegatedAccess	✓		read	No	Get a Purview data asset by its type and fully qualified name
Microsoft Purview Data Governance	get_entity_by_qualified_name	Data ReaderPurview collection role	✓		read	—	Get a Purview data asset by its type and fully qualified name
Microsoft Purview Data Governance	get_entity_classifications	Purview.DelegatedAccess	✓		read	No	List the classifications assigned to a Purview data asset
Microsoft Purview Data Governance	get_entity_classifications	Data ReaderPurview collection role	✓		read	—	List the classifications assigned to a Purview data asset
Microsoft Purview Data Governance	get_glossary	Purview.DelegatedAccess	✓		read	No	Get a Purview business glossary by GUID, including its terms and categories
Microsoft Purview Data Governance	get_glossary	Data ReaderPurview collection role	✓		read	—	Get a Purview business glossary by GUID, including its terms and categories
Microsoft Purview Data Governance	get_glossary_term	Purview.DelegatedAccess	✓		read	No	Get a Purview glossary term by GUID, including its definition and assigned assets
Microsoft Purview Data Governance	get_glossary_term	Data ReaderPurview collection role	✓		read	—	Get a Purview glossary term by GUID, including its definition and assigned assets
Microsoft Purview Data Governance	get_lineage	Purview.DelegatedAccess	✓		read	No	Get the upstream and downstream data lineage graph for a Purview data asset
Microsoft Purview Data Governance	get_lineage	Data ReaderPurview collection role	✓		read	—	Get the upstream and downstream data lineage graph for a Purview data asset
Microsoft Purview Data Governance	get_relationship	Purview.DelegatedAccess	✓		read	No	Get a relationship between Purview data assets by GUID
Microsoft Purview Data Governance	get_relationship	Data ReaderPurview collection role	✓		read	—	Get a relationship between Purview data assets by GUID
Microsoft Purview Data Governance	get_scan	Purview.DelegatedAccess	✓		read	No	Get a scan definition for a Purview data source by name
Microsoft Purview Data Governance	get_scan	Data Source AdministratorPurview collection role	✓		read	—	Get a scan definition for a Purview data source by name
Microsoft Purview Data Governance	list_child_collection_names	Purview.DelegatedAccess	✓		read	No	List the names of child collections under a Purview collection
Microsoft Purview Data Governance	list_child_collection_names	Data ReaderPurview collection role	✓		read	—	List the names of child collections under a Purview collection
Microsoft Purview Data Governance	list_collections	Purview.DelegatedAccess	✓		read	No	List all collections in the Purview account
Microsoft Purview Data Governance	list_collections	Data ReaderPurview collection role	✓		read	—	List all collections in the Purview account
Microsoft Purview Data Governance	list_data_sources	Purview.DelegatedAccess	✓		read	No	List all data sources registered in Purview
Microsoft Purview Data Governance	list_data_sources	Data Source AdministratorPurview collection role	✓		read	—	List all data sources registered in Purview
Microsoft Purview Data Governance	list_glossaries	Purview.DelegatedAccess	✓		read	No	List the business glossaries in Purview
Microsoft Purview Data Governance	list_glossaries	Data ReaderPurview collection role	✓		read	—	List the business glossaries in Purview
Microsoft Purview Data Governance	list_glossary_terms	Purview.DelegatedAccess	✓		read	No	List the terms in a Purview business glossary
Microsoft Purview Data Governance	list_glossary_terms	Data ReaderPurview collection role	✓		read	—	List the terms in a Purview business glossary
Microsoft Purview Data Governance	list_scan_history	Purview.DelegatedAccess	✓		read	No	List the run history of a Purview scan with status and results
Microsoft Purview Data Governance	list_scan_history	Data Source AdministratorPurview collection role	✓		read	—	List the run history of a Purview scan with status and results
Microsoft Purview Data Governance	list_scans	Purview.DelegatedAccess	✓		read	No	List the scan definitions for a Purview data source
Microsoft Purview Data Governance	list_scans	Data Source AdministratorPurview collection role	✓		read	—	List the scan definitions for a Purview data source
Microsoft Purview Data Governance	list_type_headers	Purview.DelegatedAccess	✓		read	No	List Purview type definition headers, optionally filtered by category
Microsoft Purview Data Governance	list_type_headers	Data ReaderPurview collection role	✓		read	—	List Purview type definition headers, optionally filtered by category
Microsoft Purview Data Governance	run_scan	Purview.DelegatedAccess	✓		write	No	Trigger a full or incremental scan run for a Purview data source
Microsoft Purview Data Governance	run_scan	Data Source AdministratorPurview collection role	✓		write	—	Trigger a full or incremental scan run for a Purview data source
Microsoft Purview Data Governance	search_entities	Purview.DelegatedAccess	✓		read	No	Search the Purview data catalog for data assets by keyword, filter, and facet
Microsoft Purview Data Governance	search_entities	Data ReaderPurview collection role	✓		read	—	Search the Purview data catalog for data assets by keyword, filter, and facet
Microsoft Purview Data Governance	update_glossary_term	Purview.DelegatedAccess	✓		write	No	Update a Purview glossary term's name, description, or status
Microsoft Purview Data Governance	update_glossary_term	Data CuratorPurview collection role	✓		write	—	Update a Purview glossary term's name, description, or status
Microsoft Purview Data Governance	update_relationship	Purview.DelegatedAccess	✓		write	No	Update an existing relationship between Purview data assets
Microsoft Purview Data Governance	update_relationship	Data CuratorPurview collection role	✓		write	—	Update an existing relationship between Purview data assets
Microsoft Sentinel (Management)	add_incident_comment	user_impersonation	✓		write	No	Add a comment to a Microsoft Sentinel incident
Microsoft Sentinel (Management)	add_incident_comment	Microsoft Sentinel ResponderAzure RBAC role	✓		write	—	Add a comment to a Microsoft Sentinel incident
Microsoft Sentinel (Management)	create_bookmark	user_impersonation	✓		write	No	Create a Microsoft Sentinel hunting bookmark from a KQL query
Microsoft Sentinel (Management)	create_bookmark	Microsoft Sentinel ResponderAzure RBAC role	✓		write	—	Create a Microsoft Sentinel hunting bookmark from a KQL query
Microsoft Sentinel (Management)	get_incident	user_impersonation	✓		read	No	Get one Microsoft Sentinel incident with its severity, status, owner, and classification
Microsoft Sentinel (Management)	get_incident	Microsoft Sentinel ReaderAzure RBAC role	✓		read	—	Get one Microsoft Sentinel incident with its severity, status, owner, and classification
Microsoft Sentinel (Management)	get_watchlist	user_impersonation	✓		read	No	Get metadata for one Microsoft Sentinel watchlist by alias
Microsoft Sentinel (Management)	get_watchlist	Microsoft Sentinel ReaderAzure RBAC role	✓		read	—	Get metadata for one Microsoft Sentinel watchlist by alias
Microsoft Sentinel (Management)	list_bookmarks	user_impersonation	✓		read	No	List hunting bookmarks in the Microsoft Sentinel workspace
Microsoft Sentinel (Management)	list_bookmarks	Microsoft Sentinel ReaderAzure RBAC role	✓		read	—	List hunting bookmarks in the Microsoft Sentinel workspace
Microsoft Sentinel (Management)	list_incident_alerts	user_impersonation	✓		read	No	List the security alerts grouped into a Microsoft Sentinel incident
Microsoft Sentinel (Management)	list_incident_alerts	Microsoft Sentinel ReaderAzure RBAC role	✓		read	—	List the security alerts grouped into a Microsoft Sentinel incident
Microsoft Sentinel (Management)	list_incident_entities	user_impersonation	✓		read	No	List the entities (accounts, hosts, IPs, files, URLs) related to a Microsoft Sentinel incident
Microsoft Sentinel (Management)	list_incident_entities	Microsoft Sentinel ReaderAzure RBAC role	✓		read	—	List the entities (accounts, hosts, IPs, files, URLs) related to a Microsoft Sentinel incident
Microsoft Sentinel (Management)	list_incidents	user_impersonation	✓		read	No	List Microsoft Sentinel incidents in the workspace, optionally filtered by severity and status
Microsoft Sentinel (Management)	list_incidents	Microsoft Sentinel ReaderAzure RBAC role	✓		read	—	List Microsoft Sentinel incidents in the workspace, optionally filtered by severity and status
Microsoft Sentinel (Management)	list_threat_intelligence_indicators	user_impersonation	✓		read	No	List threat intelligence indicators in the Microsoft Sentinel workspace
Microsoft Sentinel (Management)	list_threat_intelligence_indicators	Microsoft Sentinel ReaderAzure RBAC role	✓		read	—	List threat intelligence indicators in the Microsoft Sentinel workspace
Microsoft Sentinel (Management)	list_watchlist_items	user_impersonation	✓		read	No	List the rows of a Microsoft Sentinel watchlist
Microsoft Sentinel (Management)	list_watchlist_items	Microsoft Sentinel ReaderAzure RBAC role	✓		read	—	List the rows of a Microsoft Sentinel watchlist
Microsoft Sentinel (Management)	list_watchlists	user_impersonation	✓		read	No	List watchlists in the Microsoft Sentinel workspace
Microsoft Sentinel (Management)	list_watchlists	Microsoft Sentinel ReaderAzure RBAC role	✓		read	—	List watchlists in the Microsoft Sentinel workspace
Microsoft Sentinel (Management)	update_incident	user_impersonation	✓		write	No	Update a Microsoft Sentinel incident's title, severity, or status, or close it with a classification
Microsoft Sentinel (Management)	update_incident	Microsoft Sentinel ResponderAzure RBAC role	✓		write	—	Update a Microsoft Sentinel incident's title, severity, or status, or close it with a classification
Microsoft Teams	create_chat	Chat.Create	✓		write	No	Create a one-on-one or group chat with users in the organization
Microsoft Teams	create_chat	User.Read	✓		read	No	Create a one-on-one or group chat with users in the organization
Microsoft Teams	download_file_to_kindo_library	Files.ReadWrite.All	✓		read	No	Download a Teams, SharePoint, or OneDrive file into the Kindo library
Microsoft Teams	get_channel_messages	ChannelMessage.Read.All	✓		read	Yes	Read messages from a Teams channel
Microsoft Teams	get_channel_messages	Channel.ReadBasic.All	✓		read	No	Read messages from a Teams channel
Microsoft Teams	get_chat_messages	Chat.Read	✓		read	No	Read messages from a one-on-one or group chat
Microsoft Teams	get_current_user	User.Read	✓		read	No	Get the profile of the signed-in user
Microsoft Teams	get_drive_file	Files.Read.All	✓		read	No	Get metadata and a download link for a file in a Teams or SharePoint drive
Microsoft Teams	get_meeting_transcript	OnlineMeetingTranscript.Read.All	✓		read	Yes	Get the text of a Teams meeting transcript
Microsoft Teams	get_meeting_transcript	OnlineMeetings.Read	✓		read	No	Get the text of a Teams meeting transcript
Microsoft Teams	get_sharepoint_file	Files.ReadWrite.All	✓		read	No	Get metadata and a download link for a file from its SharePoint or OneDrive URL
Microsoft Teams	list_channel_files	Files.Read.All	✓		read	No	List files and folders in a Teams channel
Microsoft Teams	list_channels	Channel.ReadBasic.All	✓		read	No	List the channels in a team
Microsoft Teams	list_chats	Chat.ReadBasic	✓		read	No	List the signed-in user's one-on-one and group chats
Microsoft Teams	list_meeting_transcripts	OnlineMeetingTranscript.Read.All	✓		read	Yes	List the transcripts available for a Teams meeting
Microsoft Teams	list_meeting_transcripts	OnlineMeetings.Read	✓		read	No	List the transcripts available for a Teams meeting
Microsoft Teams	list_teams	Team.ReadBasic.All	✓		read	No	List the teams the signed-in user has joined
Microsoft Teams	search_messages	Chat.Read	✓		read	No	Search the signed-in user's Teams chat and channel messages by keyword
Microsoft Teams	search_messages	ChannelMessage.Read.All	✓		read	Yes	Search the signed-in user's Teams chat and channel messages by keyword
Microsoft Teams	search_users	User.ReadBasic.All	✓		read	No	Find users in the organization by name or email prefix
Microsoft Teams	send_adaptive_card	ChannelMessage.Send	✓		write	No	Post an Adaptive Card to a Teams channel or chat
Microsoft Teams	send_adaptive_card	ChatMessage.Send	✓		write	No	Post an Adaptive Card to a Teams channel or chat
Microsoft Teams	send_adaptive_card	Channel.ReadBasic.All	✓		read	No	Post an Adaptive Card to a Teams channel or chat
Microsoft Teams	send_channel_message	ChannelMessage.Send	✓		write	No	Send a plain-text message to a Teams channel
Microsoft Teams	send_channel_message	Channel.ReadBasic.All	✓		read	No	Send a plain-text message to a Teams channel
Microsoft Teams	send_chat_message	ChatMessage.Send	✓		write	No	Send a plain-text message to a one-on-one or group chat
Microsoft Teams	send_html_message	ChannelMessage.Send	✓		write	No	Send an HTML-formatted message to a Teams channel or chat
Microsoft Teams	send_html_message	ChatMessage.Send	✓		write	No	Send an HTML-formatted message to a Teams channel or chat
Microsoft Teams	send_html_message	Channel.ReadBasic.All	✓		read	No	Send an HTML-formatted message to a Teams channel or chat
Microsoft eDiscovery	activate_custodian	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Re-activate a released custodian in an eDiscovery case
Microsoft eDiscovery	add_case_member	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Add a user or role group as a member of an eDiscovery case
Microsoft eDiscovery	add_to_review_set	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Add the results of an eDiscovery search to a review set
Microsoft eDiscovery	apply_custodian_hold	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Place a legal hold on one or more custodians in an eDiscovery case
Microsoft eDiscovery	apply_noncustodial_hold	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Place a legal hold on a non-custodial data source in an eDiscovery case
Microsoft eDiscovery	close_case	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Close an active eDiscovery case
Microsoft eDiscovery	create_case	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Create an eDiscovery case
Microsoft eDiscovery	create_custodian	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Add a custodian to an eDiscovery case by email address
Microsoft eDiscovery	create_hold_site_source	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Add a SharePoint site to a legal hold policy
Microsoft eDiscovery	create_hold_user_source	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Add a user mailbox to a legal hold policy
Microsoft eDiscovery	create_legal_hold	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Create a legal hold policy in an eDiscovery case
Microsoft eDiscovery	create_noncustodial_data_source	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Add a SharePoint site or mailbox as a non-custodial data source in an eDiscovery case
Microsoft eDiscovery	create_review_set	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Create a review set in an eDiscovery case
Microsoft eDiscovery	create_search	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Create a KQL search in an eDiscovery case
Microsoft eDiscovery	delete_case	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Delete an eDiscovery case
Microsoft eDiscovery	delete_hold_site_source	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Remove a SharePoint site from a legal hold policy
Microsoft eDiscovery	delete_hold_user_source	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Remove a user mailbox from a legal hold policy
Microsoft eDiscovery	delete_legal_hold	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Delete a legal hold policy from an eDiscovery case
Microsoft eDiscovery	estimate_search_statistics	eDiscovery.Read.All	✓	✓	read	Yes	Estimate the item count and size matched by an eDiscovery search
Microsoft eDiscovery	export_review_set	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Start an export of the items in an eDiscovery review set
Microsoft eDiscovery	export_search_result	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Start an export of the results of an estimated eDiscovery search
Microsoft eDiscovery	get_case	eDiscovery.Read.All	✓	✓	read	Yes	Get an eDiscovery case by ID
Microsoft eDiscovery	get_custodian	eDiscovery.Read.All	✓	✓	read	Yes	Get a custodian in an eDiscovery case, including hold status
Microsoft eDiscovery	get_legal_hold	eDiscovery.Read.All	✓	✓	read	Yes	Get a legal hold policy in an eDiscovery case
Microsoft eDiscovery	get_noncustodial_data_source	eDiscovery.Read.All	✓	✓	read	Yes	Get a non-custodial data source in an eDiscovery case
Microsoft eDiscovery	get_search	eDiscovery.Read.All	✓	✓	read	Yes	Get a search in an eDiscovery case
Microsoft eDiscovery	list_case_members	eDiscovery.Read.All	✓	✓	read	Yes	List the users and role groups that are members of an eDiscovery case
Microsoft eDiscovery	list_case_operations	eDiscovery.Read.All	✓	✓	read	Yes	List long-running operations such as exports and holds in an eDiscovery case
Microsoft eDiscovery	list_cases	eDiscovery.Read.All	✓	✓	read	Yes	List eDiscovery cases in the tenant
Microsoft eDiscovery	list_custodians	eDiscovery.Read.All	✓	✓	read	Yes	List custodians in an eDiscovery case
Microsoft eDiscovery	list_hold_site_sources	eDiscovery.Read.All	✓	✓	read	Yes	List SharePoint sites covered by a legal hold policy
Microsoft eDiscovery	list_hold_user_sources	eDiscovery.Read.All	✓	✓	read	Yes	List user mailboxes covered by a legal hold policy
Microsoft eDiscovery	list_legal_holds	eDiscovery.Read.All	✓	✓	read	Yes	List legal hold policies in an eDiscovery case
Microsoft eDiscovery	list_noncustodial_data_sources	eDiscovery.Read.All	✓	✓	read	Yes	List non-custodial data sources in an eDiscovery case
Microsoft eDiscovery	list_review_sets	eDiscovery.Read.All	✓	✓	read	Yes	List review sets in an eDiscovery case
Microsoft eDiscovery	list_searches	eDiscovery.Read.All	✓	✓	read	Yes	List searches in an eDiscovery case
Microsoft eDiscovery	release_custodian	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Release a custodian from an eDiscovery case
Microsoft eDiscovery	release_noncustodial_data_source	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Release a non-custodial data source from an eDiscovery case
Microsoft eDiscovery	remove_case_member	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Remove a user or role group from an eDiscovery case
Microsoft eDiscovery	remove_custodian_hold	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Remove a legal hold from one or more custodians in an eDiscovery case
Microsoft eDiscovery	remove_noncustodial_hold	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Remove a legal hold from a non-custodial data source in an eDiscovery case
Microsoft eDiscovery	reopen_case	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Reopen a closed eDiscovery case
Microsoft eDiscovery	retry_hold_policy	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Retry a legal hold policy to re-apply the hold to its mailboxes and sites
Microsoft eDiscovery	update_case	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Update the name, description, or external ID of an eDiscovery case
Microsoft eDiscovery	update_legal_hold	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Update the description or content query of a legal hold policy
Microsoft eDiscovery	update_noncustodial_index	eDiscovery.ReadWrite.All	✓	✓	write	Yes	Trigger re-indexing of a non-custodial data source in an eDiscovery case
OneDrive	copy_item	Files.ReadWrite.All	✓		write	No	Copy a file or folder to another folder in a drive
OneDrive	create_folder	Files.ReadWrite.All	✓		write	No	Create a folder in a drive
OneDrive	create_sharing_link	Files.ReadWrite.All	✓		write	No	Create a view, edit, or embed sharing link for a file or folder
OneDrive	delete_item	Files.ReadWrite.All	✓		write	No	Move a file or folder to the drive's recycle bin
OneDrive	download_file_to_kindo_library	Files.Read.All	✓		read	No	Download a OneDrive file into the Kindo library
OneDrive	get_drive	Files.Read.All	✓		read	No	Get a drive's metadata, quota, and owner by id
OneDrive	get_my_drive	Files.Read	✓		read	No	Get the signed-in user's default OneDrive
OneDrive	list_children	Files.Read.All	✓		read	No	List the files and folders inside a folder in a drive
OneDrive	list_drives	Files.Read	✓		read	No	List the drives available to the signed-in user
OneDrive	upload_file	Files.ReadWrite.All	✓		write	No	Upload a file into a folder in a drive
SharePoint Online	create_folder	Files.ReadWrite	✓		write	No	Create a folder in a SharePoint document library
SharePoint Online	create_folder	Sites.ReadWrite.All		✓	write	Yes	Create a folder in a SharePoint document library
SharePoint Online	create_list_item	Sites.ReadWrite.All	✓	✓	write	No	Create an item with column values in a SharePoint list
SharePoint Online	get_drive_item	Files.Read	✓		read	No	Get metadata for a file or folder in a SharePoint document library by ID or path
SharePoint Online	get_drive_item	Sites.Read.All		✓	read	Yes	Get metadata for a file or folder in a SharePoint document library by ID or path
SharePoint Online	get_list	Sites.Read.All	✓	✓	read	No	Get a SharePoint list by ID or internal name
SharePoint Online	get_site	Sites.Read.All	✓	✓	read	No	Get a SharePoint site by ID or by hostname and site path
SharePoint Online	list_drive_items	Files.Read	✓		read	No	List files and folders in a SharePoint document library or one of its folders
SharePoint Online	list_drive_items	Sites.Read.All		✓	read	Yes	List files and folders in a SharePoint document library or one of its folders
SharePoint Online	list_drives	Files.Read	✓		read	No	List the document libraries of a SharePoint site
SharePoint Online	list_drives	Sites.Read.All		✓	read	Yes	List the document libraries of a SharePoint site
SharePoint Online	list_list_items	Sites.Read.All	✓	✓	read	No	List items in a SharePoint list, optionally with column values and an OData filter
SharePoint Online	list_lists	Sites.Read.All	✓	✓	read	No	List the lists in a SharePoint site
SharePoint Online	list_sites	Sites.Read.All	✓	✓	read	No	List the SharePoint sites the signed-in user can access
SharePoint Online	search_drive_items	Files.Read	✓		read	No	Search a SharePoint document library for files and folders by keyword
SharePoint Online	search_drive_items	Sites.Read.All		✓	read	Yes	Search a SharePoint document library for files and folders by keyword
SharePoint Online	search_sites	Sites.Read.All	✓	✓	read	No	Search SharePoint sites by keyword
SharePoint Online	upload_file	Files.ReadWrite	✓		write	No	Upload a file into a SharePoint document library, fetching its bytes from a signed URL
SharePoint Online	upload_file	Sites.ReadWrite.All		✓	write	Yes	Upload a file into a SharePoint document library, fetching its bytes from a signed URL

Notes on service principals

If you look for an integration’s app under App registrations and only find it under Enterprise applications, you are looking at its service principal.

• An app registration is the blueprint — the global definition of an application. It lives only in the tenant where the app was created.
• An enterprise application (service principal) is an instance of that blueprint inside each tenant that uses the app. It is the app’s actual account in your directory.

What you see in your tenant depends on how you use Kindo:

• Kindo SaaS: the app registration lives in Kindo’s tenant. The first time you authorize an integration, Entra ID creates a service principal in your tenant under Enterprise applications, and that is what you authenticate against on every subsequent connection. You will not see an app registration in your tenant.
• Self-managed Kindo: you create the app registration in your own tenant by following the steps on this page. When the app is first authorized, Entra ID still creates a matching service principal under Enterprise applications.

In both cases, the service principal is what Microsoft Entra ID uses to let the app operate in your tenant:

• It holds the permission grants. When a user or admin consents, the grant is recorded against the service principal. It is the ledger of what the app is allowed to access in your tenant.
• It is the identity that tokens are issued to. When Entra ID issues the app an access token for your tenant, the service principal is the actor that token represents.
• It is your admin’s control point. Your admin manages the app under Enterprise applications: assign or restrict users, apply Conditional Access policies, disable the app, or revoke its access — all without touching the underlying registration.
• It is where sign-in and audit activity lands. Sign-in logs and consent events for the app in your tenant attach to the service principal.

Troubleshooting

Problem	What to check
Microsoft says the redirect URI is invalid	Make sure the redirect URI in Entra exactly matches the callback URL shown in Nango, including https:// and /oauth/callback.
The consent screen does not show the expected permissions	Confirm the permissions were added to the same app registration whose client ID you entered in Nango. Reconnect after changing permissions.
Kindo reports Unauthorized or cannot refresh the connection	Recreate the connection and confirm the integration includes offline_access when delegated refresh is required.
Kindo reports Forbidden	The signed-in user may not have access to the Microsoft resource, admin consent may be missing, or the app may not have the required permission.
A write action fails but read actions work	The app may have read-only permissions. Add only the specific write permission required by the integration.
Microsoft eDiscovery (Application mode) reports Unauthorized	The app also needs to be registered in Microsoft Purview’s RBAC layer — see Application mode.
Microsoft Graph Security risky-user tools report access denied	Requires a Microsoft Entra ID P2 (or Microsoft 365 E5) license.
Microsoft Intune tools report authentication failed	Requires an active Microsoft Intune license.
Microsoft Defender tools report access denied	Requires an active Microsoft Defender for Endpoint subscription.
Microsoft Entra ID Governance’s PIM or Lifecycle Workflows tools report a licensing error	PIM requires Microsoft Entra ID P2; Lifecycle Workflows requires the separate Microsoft Entra ID Governance license.
Microsoft Purview Data Governance tools report access errors even though the permissions are granted and admin-consented	The signed-in user is also missing a Purview collection role (Data Curator, Data Source Administrator, or Collection Admin) — see the Microsoft Purview Data Governance section above.
SharePoint Online (Application mode) site or file search reports access denied	The app holds Sites.Selected, which Microsoft does not support on these APIs. Grant Sites.Read.All or Sites.ReadWrite.All as an Application permission — see Application mode.

Security guidance

• Use least-privilege permissions for every Microsoft integration.
• Rotate client secrets according to your organization’s policy.
• Remove unused app registrations and old client secrets.
• Keep a record of which Kindo integration uses each Entra app registration.

Related guides

• Connect ServiceNow