Admin consent for a read-only Microsoft 365 app, explained

What consent means

When a third-party app wants to read data across your Microsoft 365 tenant, Microsoft will not let an ordinary user approve it. An administrator has to grant admin consent, once, for the whole organization. The consent screen lists every permission the app is asking for. Nothing is granted that is not on that screen.

Consent creates an enterprise application in your tenant. That object is yours: you can inspect it, restrict it, or delete it. The vendor holds a key that only works while that object exists and its permissions stand.

For the Bus-Factor Report, access is a read-only Microsoft Entra application that a Global Admin consents to. Every permission it requests is an application permission, every one requires admin consent, and every one is read-only. Nothing it asks for can write, send, or delete.

Reading scopes

Scope names follow a pattern: the resource, then the verb, then the reach. User.Read.All means read every user in the directory. Anything containing Write is a request to change things; a read-only report has no reason to ask for one. Here is what we request and why.

• User.Read.All: users, job titles, manager chain, and account state. The manager chain needs User.Read.All; User.ReadBasic.All alone does not include it.
• User.ReadBasic.All: display names and emails, to match group members and owners to people.
• AuditLog.Read.All: the last sign-in date, where your license provides it.
• GroupMember.Read.All: group and Team membership and owners.
• Application.Read.All and RoleManagement.Read.Directory: who owns enterprise apps and who holds admin roles.
• Sites.Read.All: SharePoint site owners.
• Calendars.ReadBasic.All: organizer, attendees, and title of recurring meetings. It is the narrower calendar scope: Microsoft excludes event bodies, attachments, and extensions from it. The collector requests only organizer, attendees, and title.
• Mail.ReadBasic.All: mail metadata for 90 days. Microsoft designed this scope to exclude message bodies and attachments; the collector narrows it further to sender, recipients, date, and thread.

Revoking

You can take consent back at any time without calling the vendor. In the Microsoft Entra admin center, browse to Entra ID > Enterprise apps > All applications and select the app. Under Permissions, the Admin consent tab lists what was granted; select the ... control next to a permission and choose Revoke permission.

To remove the app entirely, open its Properties page and select Delete. Microsoft keeps a deleted enterprise app in a recycle bin for 30 days, so you can restore it if you change your mind. Either way, new access is cut off as soon as you act. You need at least the Cloud Application Administrator role to do this.

How to evaluate a vendor asking for it

Ask five questions. Is every scope read-only? Does each scope map to a feature you can name? Is there a published list of what is never read? How long is the data kept, and where does it go when the job is done? Is the publisher verified by Microsoft, so the consent screen shows a real company rather than an unverified name?

Then compare the answers to the consent screen. A vendor whose screen asks for more than its documentation explains is telling you something. Ours is published on the data-handling page, and it says what we never read in plain words: "Message bodies, attachments, or subject lines." If the product ever does something not listed there, that is a bug and a breach of the statement.