Notatka
Dostęp do tej strony wymaga autoryzacji. Może spróbować zalogować się lub zmienić katalogi.
Dostęp do tej strony wymaga autoryzacji. Możesz spróbować zmienić katalogi.
Last updated by the developer on: October 8, 2026
General information
Information provided by to Microsoft:
| Information | Response |
|---|---|
| App name | Mesh |
| ID | lucidlabsau.mesh |
| Company's website | https://lucidlabs.com.au |
| App's Terms of Use | https://lucidlabs.com.au/terms |
| Core functionality of the app | Mesh by Lucid Labs: Azure-hosted Microsoft 365 and Azure tenant audits, an integration service and MCP tools for organisations and managed service providers. It uses delegated Microsoft Graph and Azure Resource Manager access with tenant-controlled consent, read-only audit collection and a sensitivity-label-aware DLP check on outbound sends. |
| Company headquarter location | Australia |
| App info page | https://lucidlabs.com.au/products/mesh |
| What is the hosting environment or service model used to run your app? | Saas |
| Which hosting cloud providers does the app use? | Azure |
| Is AI functionality part of the app's features or workflows? | Yes |
| Online Service interfaces | Microsoft identity platform (OAuth 2.0, OIDC, OBO, federated credentials). Microsoft Graph v1.0 and beta: delegated, plus read-only application permissions for audits. Exchange Online and SharePoint Online, read-only. Azure Resource Manager, Key Vault, Dataverse, Power Platform, Power BI, Fabric and Partner Center APIs. Marketplace SaaS Fulfillment and Metering APIs and webhook. MCP over HTTPS. No EWS. |
Questions
Questions or updates to any of the information you see here? Contact us!
How the app handles data
This information has been provided by about how this app collects and stores organizational data and the control that your organization will have over the data the app collects.
| Information | Response |
|---|---|
| Does the app or underlying infrastructure process any data relating to a Microsoft customer or their device? | Yes |
| What data is processed by your app? | Customer's sent email, Teams chats, meeting transcripts, Claude Code prompts and git commits, read via delegated Microsoft Graph after subscription activation. Processed ephemerally in Azure Container Apps; raw text deleted immediately after analysis. |
| Does the app support TLS 1.2 or higher? | Yes |
| Does the app or underlying infrastructure store any Microsoft customer data? | Yes |
| What data is stored in your databases? | User account record (Entra object ID, email, tenant), subscription state, encrypted voice profile blob (RSA-OAEP via Azure Key Vault), encrypted report metadata, per-run audit log. No raw customer communications retained. |
| If underlying infastructure processes or stores Microsoft customer data, where is this data geographically stored? | Australia |
| Do you have an established data rentention and disposal process? | Yes |
| How long is data retained after account termination? | Less than 30days |
| Do you have an established data access management process? | Yes |
| Do you transfer customer data or customer content to third parties or sub-processors? | No |
Questions
Questions or updates to any of the information you see here? Contact us!
This information has been provided by Mesh about the security practices this app employs.
| Information | Response |
|---|---|
| Do you perform annual penetration testing on the app? | Yes |
| Does the app have a documented disaster recovery plan, including a backup and restore strategy? | Yes |
| Does your environment use traditional anti-malware protection or application controls? | ApplicationControls, TraditionalAntiMalware |
| Do you have an established process for indentifying and risk ranking security vulnerabilities? | Yes |
| Do you have a policy that governs your service level agreement (SLA) for applying patches? | Yes |
| Do you carry out patch management activities according to your patching policy SLAs? | Yes |
| Does your enviroment have any unsupported operating systems or software? | No |
| Do you conduct quarterly vulnerability scanning on your app and the infastructure that supports it? | Yes |
| Do you have a firewall installed on your external network boundary? | Yes |
| Do you have an established change management process used to review and approve change requests before they are deployed to production? | Yes |
| Is an additional person reviewing and approving all code change requests submitted to production by the original developer? | Yes |
| Do secure coding practices take into account common vulnerability classes such as OWASP Top 10? | Yes |
| Multifactor Authentication (MFA) enabled for: | CodeRepositories, DNSManagement, Credential |
| Do you have an established process for provisioning, modification, and deletion of employee accounts? | Yes |
| Do you have Intrusion Detection and Prevention (IDPS) software deployed at the perimeter of the network boundary supporting your app? | Yes |
| Do you have event logging set up on all system components supporting your app? | Yes |
| Are all logs reviewed on a regular cadence by human or automated tooling to detect potential security events? | Yes |
| When a security event is detected are alerts automatically sent to an employee for triage? | Yes |
| Do you have a formal information security risk management process established? | Yes |
| Do you have a formal security incident response process documented and established? | Yes |
| Do you report app or service data breaches to supervisory authorities and individuals affected by the breach within 72 hours of detection? | Yes |
Questions
Questions or updates to any of the information you see here? Contact us!
This information has been provided by regarding the compliance standards their app requires and the certifications they have achieved.
| Information | Response |
|---|---|
| Does the app comply with the Health Insurance Portability and Accounting Act (HIPAA)? | N/A |
| Does the app comply with Health Information Trust Alliance, Common Security Framework (HITRUST CSF)? | N/A |
| Has the organization achieved a Service Organization Controls (SOC 1) Certification? | N/A |
| Has the organization achieved a Service Organization Controls (SOC 2) Certification? | No |
| Has the organization achieved a Service Organization Controls (SOC 3) Certification? | No |
| Do you carry out annual PCI DSS assessments against the app and its supporting environment? | N/A |
| Is the app International Organization for Standardization (ISO 27001) certified? | No |
| Does the app comply with International Organization for Standardization (ISO 27018)? | N/A |
| Does the app comply with International Organization for Standardization (ISO 27017)? | N/A |
| Does the app comply with International Organization for Standardization (ISO 27002)? | N/A |
| Is the app Federal Risk and Authorization Management Program (FedRAMP) compliant? | No |
| Does the app comply with Family Educational Rights and Privacy Act (FERPA)? | N/A |
| Does the app comply with Children's Online Privacy Protection Act (COPPA)? | N/A |
| Does the app comply with Sarbanes-Oxley Act (SOX)? | N/A |
| Does the app comply with NIST 800-171? | N/A |
| Has the app been Cloud Security Alliance (CSA Star) certified? | No |
Questions
Questions or updates to any of the information you see here? Contact us!
This information has been provided by about the privacy posture of their app.
| Information | Response |
|---|---|
| Do you have GDPR or other privacy or data protection requirements or obligations (such as CCPA)? | Yes |
| Does the app have an external-facing privacy notice that describes how it collects, uses, shares, and stores customer data? | Yes |
| Privacy Policy URL | https://lucidlabs.com.au/privacy |
| Does the app perform automated decision making, including profiling that could have a legal effect or similar impact? | No |
| Does the app process customer data for a secondary purpose not described in the privacy notice (i.e. marketing, analytics)? | No |
| Do you process special categories of sensitive data (i.e. racial or ethnic origin, political opinion, religious or philosophical beliefs, genetic or biometric data, health data) or categories of data subject to breach notification laws? | No |
| Does the app collect or process data from minors (i.e., individuals under the age of 16)? | No |
| Does the app have capabilities to delete an individual's personal data upon request? | Yes |
| Does the app have capabilities to restrict or limit the processing of an individual's personal data upon request? | Yes |
| Does the app provide individuals the ability to correct or update their personal data? | Yes |
| Are regular data security and privacy reviews performed (for example, Data Protection Impact Assessments or privacy risk assessments) to identify risks related to the processing of personal data for the app? | Yes |
Questions
Questions or updates to any of the information you see here? Contact us!
| Information | Response |
|---|---|
| Does your application integrate with Microsoft identity platform (Microsoft Entra ID) for single-sign on, API access, etc.? | Yes |
| Have you reviewed and complied with all applicable best practices outlined in the Microsoft identity platform integration checklist? | Yes |
| Does your app use the latest version of MSAL (Microsoft Authentication Library) or Microsoft Identity Web for authentication? | Yes |
| Does your app support Conditional Access policies? | Yes |
| List the types of policies supported | App authenticates via Entra ID OIDC; Conditional Access policies enforced by the customer's tenant apply transparently. Supported: MFA enforcement, sign-in risk, device compliance, named locations, sign-in frequency, session controls. App does not bypass or override tenant policies. |
| Does your app support Continuous Access Evaluation (CAE) | Yes |
| Does your app store any credentials in code? | No |
| Apps and add-ins for Microsoft 365 might use additional Microsoft APIs outside of Microsoft Graph. Does your app or add-in use additional Microsoft APIs? | Yes |
Data access using Microsoft Graph
Graph Permission Permission Type Justification Microsoft Entra App ID AccessReview.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: AccessReview.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 Application.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: Application.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 AuditLog.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: AuditLog.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 AuthenticationContext.Read.All application Read-only. Lists Conditional Access authentication contexts so the audit can report contexts published to apps or labels but enforced by no Conditional Access policy. Policy.Read.All is not accepted for this endpoint app-only. Configuration only. 2d681baf-94f6-4385-9fc3-b947b1c98db6 ConsentRequest.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: ConsentRequest.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 DelegatedAdminRelationship.Read.All application Read-only, application permission used by the Mesh tenant audit. Before each scheduled or on-demand audit of a managed client, Mesh reads the GDAP relationships between the MSP and that client and refuses to run the audit unless an active relationship with the required roles exists. Requested by incremental consent only when an MSP enables managed-client audits. Mesh never creates, changes or ends a relationship. 2d681baf-94f6-4385-9fc3-b947b1c98db6 DeviceLocalCredential.ReadBasic.All application Read-only, basic properties only. Lists devices with a Windows LAPS password backed up to Entra and when it was last backed up, to report LAPS coverage and rotation. This variant cannot return passwords; the password-returning DeviceLocalCredential.Read.All is deliberately not requested. 2d681baf-94f6-4385-9fc3-b947b1c98db6 DeviceManagementConfiguration.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: DeviceManagementConfiguration.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 DeviceManagementManagedDevices.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: DeviceManagementManagedDevices.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 DeviceManagementRBAC.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: DeviceManagementRBAC.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 DeviceManagementServiceConfig.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: DeviceManagementServiceConfig.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 Directory.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: Directory.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 DirectoryRecommendations.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: DirectoryRecommendations.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 Domain-InternalFederation.Read.All application Read-only. Reads the federation configuration of each federated domain to report signing-certificate expiry, the federated IdP MFA behaviour and federation that should not be there (a known tenant-takeover pattern). The certificate is reduced to its expiry date and not stored. 2d681baf-94f6-4385-9fc3-b947b1c98db6 EntitlementManagement.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: EntitlementManagement.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 IdentityRiskEvent.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: IdentityRiskEvent.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 IdentityRiskyUser.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: IdentityRiskyUser.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 InformationProtectionPolicy.Read.All application Read-only. Lists the sensitivity labels defined for the organisation so the audit can report whether any label exists before assessing labelling of sites and files. Reads label definitions and policy settings only, never labelled content. 2d681baf-94f6-4385-9fc3-b947b1c98db6 MultiTenantOrganization.Read.All application Read-only. Lists the tenant's multi-tenant organisation and its member tenants with role and join state, so the audit can report pending, removed or unrecognised members of a cross-tenant trust that also drives user synchronisation. Configuration metadata only; no user content is read. 2d681baf-94f6-4385-9fc3-b947b1c98db6 NetworkAccess.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: NetworkAccess.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 OnPremDirectorySynchronization.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: OnPremDirectorySynchronization.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 OrgSettings-AppsAndServices.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: OrgSettings-AppsAndServices.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 OrgSettings-Forms.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: OrgSettings-Forms.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 Organization.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: Organization.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 Place.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: Place.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 PlaceDevice.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: PlaceDevice.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 Policy.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: Policy.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 Policy.Read.DeviceConfiguration application Read-only. Reads the tenant's device registration policy: who may join or register devices, whether MFA is required to join, the device quota and whether Windows LAPS is enabled. Policy.Read.All is not accepted for this endpoint app-only. Configuration only. 2d681baf-94f6-4385-9fc3-b947b1c98db6 Policy.Read.PermissionGrant application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: Policy.Read.PermissionGrant collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 ReportSettings.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: ReportSettings.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 Reports.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: Reports.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 RoleManagement.Read.Directory application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: RoleManagement.Read.Directory collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 RoleManagementAlert.Read.Directory application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: RoleManagementAlert.Read.Directory collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 SecurityAlert.Read.All application Read-only. Reads Microsoft Defender XDR alerts (severity, status, classification, creation time) to report high-severity alerts left open and alerts classified as true positives. Alert metadata only; the audit never changes an alert. 2d681baf-94f6-4385-9fc3-b947b1c98db6 SecurityIdentitiesHealth.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: SecurityIdentitiesHealth.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 SecurityIncident.Read.All application Read-only. Reads Microsoft Defender XDR incidents (severity, status, assignment, creation time) to report whether high-severity incidents stay open or unassigned, that is, whether anyone works the security queue. Incident metadata only; the audit never updates or closes an incident. 2d681baf-94f6-4385-9fc3-b947b1c98db6 ServiceHealth.Read.All application Read-only. Reads Microsoft 365 service health issues open at audit time, so anomalies in a workload can be read against an active Microsoft incident rather than reported as tenant misconfiguration. Service status only; no tenant data. 2d681baf-94f6-4385-9fc3-b947b1c98db6 ServiceMessage.Read.All application Read-only. Reads Message centre posts (title, category, act-by date) to report Microsoft changes the tenant must act on within 30 days, such as retirements. Per-admin read state is not requested. Microsoft-published announcements only; no tenant data. 2d681baf-94f6-4385-9fc3-b947b1c98db6 SharePointTenantSettings.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: SharePointTenantSettings.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 Sites.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: Sites.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 ThreatHunting.Read.All application Read-only, application permission used by the Mesh tenant audit in the customer's tenant after admin consent: ThreatHunting.Read.All collects the configuration the audit reports on. It never writes. 2d681baf-94f6-4385-9fc3-b947b1c98db6 User-LifeCycleInfo.Read.All application Read-only. Reads users' employeeLeaveDateTime with their enabled state to report accounts still enabled after their recorded leave date. Directory.Read.All does not return this property. No other personal data is read beyond the user principal name already in scope. 2d681baf-94f6-4385-9fc3-b947b1c98db6 AccessReview.Read.All delegated Read access review definitions, instances and decisions when the signed-in administrator asks Mesh to report on access reviews. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 AccessReview.ReadWrite.All delegated Record access review decisions and accept recommendations when the signed-in reviewer asks Mesh to do so. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 AppCatalog.Read.All delegated Operate delegated Microsoft Teams chat, channel, team and app-catalog workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Application.Read.All delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 AuditLog.Read.All delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Bookings.Read.All delegated Operate delegated Microsoft Bookings service and appointment workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 BookingsAppointment.ReadWrite.All delegated Operate delegated Microsoft Bookings service and appointment workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Calendars.Read.Shared delegated Read calendars shared with the signed-in user to find meeting times and check team availability. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Calendars.ReadWrite delegated Operate delegated calendar, meeting and meeting-artifact workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 ChannelMessage.Read.All delegated Operate delegated Microsoft Teams chat, channel, team and app-catalog workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 ChannelMessage.Send delegated Operate delegated Microsoft Teams chat, channel, team and app-catalog workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Chat.ReadWrite delegated Operate delegated Microsoft Teams chat, channel, team and app-catalog workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 CloudPC.Read.All delegated Read Windows 365 Cloud PC provisioning policies and service plans for the signed-in administrator. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Contacts.ReadWrite delegated Support authorised delegated Microsoft 365 operational workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 ContentActivity.Write delegated Apply Purview, records-management and DLP policy checks to user-requested content workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 CrossTenantInformation.ReadBasic.All delegated Resolve a tenant ID or domain to its basic tenant information when the signed-in administrator works with a partner or client tenant. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 DelegatedAdminRelationship.ReadWrite.All delegated Create, review, extend and end GDAP relationships and access assignments for an MSP administrator, as that administrator requests. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 DeviceManagementApps.Read.All delegated Read or manage Intune device-management configuration for authorised tenant admin workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 DeviceManagementApps.ReadWrite.All delegated Manage Intune app assignments when the signed-in Intune administrator requests it. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 DeviceManagementConfiguration.Read.All delegated Read or manage Intune device-management configuration for authorised tenant admin workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 DeviceManagementConfiguration.ReadWrite.All delegated Read or manage Intune device-management configuration for authorised tenant admin workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 DeviceManagementManagedDevices.PrivilegedOperations.All delegated Run Intune device actions such as sync, restart, retire or wipe, only when the signed-in Intune administrator requests and confirms them. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 DeviceManagementManagedDevices.Read.All delegated Read or manage Intune device-management configuration for authorised tenant admin workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 DeviceManagementRBAC.Read.All delegated Read or manage Intune device-management configuration for authorised tenant admin workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 DeviceManagementServiceConfig.Read.All delegated Read or manage Intune device-management configuration for authorised tenant admin workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 DeviceManagementServiceConfig.ReadWrite.All delegated Manage Intune enrolment configuration and Apple tokens when the signed-in Intune administrator requests it. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Directory.Read.All delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Domain.Read.All delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Files.ReadWrite.All delegated Read and write delegated SharePoint Online and OneDrive files/sites for user-requested document workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Group.ReadWrite.All delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 IdentityRiskEvent.Read.All delegated Read Entra ID Protection risk detections for the signed-in security administrator. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 IdentityRiskyServicePrincipal.Read.All delegated Read risky service principals from Entra ID Protection for the signed-in security administrator. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 IdentityRiskyUser.Read.All delegated Read risky users and their risk history for the signed-in security administrator. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 IdentityRiskyUser.ReadWrite.All delegated Confirm a user compromised or dismiss user risk when the signed-in security administrator requests and confirms it. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 InformationProtectionPolicy.Read delegated Apply Purview, records-management and DLP policy checks to user-requested content workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Mail.ReadWrite delegated Operate delegated Exchange Online mail and mailbox workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Mail.Send delegated Operate delegated Exchange Online mail and mailbox workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 MailboxSettings.Read delegated Operate delegated Exchange Online mail and mailbox workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 MailboxSettings.ReadWrite delegated Set the signed-in user's working hours, automatic replies and mailbox settings when they ask. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 OnlineMeetingArtifact.Read.All delegated Operate delegated calendar, meeting and meeting-artifact workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 OnlineMeetingTranscript.Read.All delegated Read transcripts of meetings the signed-in user can access, to draft minutes and follow-up actions. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 OnlineMeetings.ReadWrite delegated Operate delegated calendar, meeting and meeting-artifact workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Organization.ReadWrite.All delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 People.Read delegated Identify users and support delegated people, profile and presence workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 PeopleSettings.Read.All delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Place.Read.All delegated Read Microsoft Places data for workplace/location workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Policy.Read.All delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Policy.ReadWrite.ConditionalAccess delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Policy.ReadWrite.CrossTenantAccess delegated Manage cross-tenant access partner settings when the signed-in administrator requests and confirms it. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Policy.ReadWrite.CrossTenantCapability delegated Manage cross-tenant capability settings when the signed-in administrator requests and confirms it. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Presence.Read.All delegated Identify users and support delegated people, profile and presence workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 PrivilegedAccess-CustomExt.Read.All delegated Read PIM custom extensions for the signed-in administrator. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup delegated Activate the signed-in user's own eligible PIM for Groups membership when they request it. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 PrivilegedEligibilitySchedule.Read.AzureADGroup delegated List the PIM for Groups eligibilities of the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 ProtectionScopes.Compute.User delegated Apply Purview, records-management and DLP policy checks to user-requested content workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 RecordsManagement.ReadWrite.All delegated Apply Purview, records-management and DLP policy checks to user-requested content workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Reports.Read.All delegated Read Microsoft 365 reports for authorised tenant reporting workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 RoleAssignmentSchedule.Read.Directory delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 RoleAssignmentSchedule.ReadWrite.Directory delegated Activate the signed-in user's own eligible Entra role through PIM when they request it. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 RoleEligibilitySchedule.Read.Directory delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 RoleManagement.Read.Directory delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 RoleManagement.ReadWrite.Directory delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 SecurityAlert.Read.All delegated Read Microsoft security alerts for authorised tenant security workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 SecurityAlert.ReadWrite.All delegated Comment on and update Defender XDR alerts when the signed-in security analyst requests it. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 ServiceHealth.Read.All delegated Read Microsoft 365 service health for the signed-in administrator. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 ServiceMessage.Read.All delegated Read Microsoft 365 message centre posts for the signed-in administrator. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Sites.ReadWrite.All delegated Read and write delegated SharePoint Online and OneDrive files/sites for user-requested document workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Synchronization.Read.All delegated Read provisioning and synchronisation job status for the signed-in administrator. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Tasks.ReadWrite delegated Operate delegated Planner and task workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 Team.ReadBasic.All delegated Operate delegated Microsoft Teams chat, channel, team and app-catalog workflows requested by the signed-in user. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 ThreatHunting.Read.All delegated Run Defender advanced hunting queries the signed-in security analyst writes. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 User.Read delegated Identify users and support delegated people, profile and presence workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 User.Read.All delegated Identify users and support delegated people, profile and presence workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 User.ReadBasic.All delegated Identify users and support delegated people, profile and presence workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 User.ReadWrite.All delegated Support authorised Entra ID tenant administration, governance, audit, role and policy workflows. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 eDiscovery.Read.All delegated List eDiscovery cases and holds for the signed-in compliance administrator. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 eDiscovery.ReadWrite.All delegated Enable or release an eDiscovery hold when the signed-in compliance administrator requests and confirms it. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 offline_access delegated Maintain delegated user sessions without repeatedly prompting for consent. 2e1605e4-f00c-4355-9d3d-2b8c5dd2abf2 User.Read delegated Identify users and support delegated people, profile and presence workflows. ee116437-b252-4a7c-8b16-f0bb2d0d5f49 delegated Identify the signed-in user in the Mesh portal by email address. ee116437-b252-4a7c-8b16-f0bb2d0d5f49 openid delegated Sign the user in to the Mesh portal with OpenID Connect. ee116437-b252-4a7c-8b16-f0bb2d0d5f49 profile delegated Show the signed-in user's name in the Mesh portal. ee116437-b252-4a7c-8b16-f0bb2d0d5f49
This application does not have Additional APIs.
Questions
Questions or updates to any of the information you see here? Contact us!