Can't find what you're looking for? Access our previous PDF-based library.
26 min read
️ Updated Apr 29, 2026This section details the minimum rights and privileges required for configuring the specific components for auditing and the steps which are needed to complete the configuration for a successful setup.
1. Active Directory, Group Policy and Exchange On-Premises
1.1 What’s Available with the Least Privilege Model?
All AD/GPO/Exchange Modification reports, i.e. States and Changes.
Real time alerts and Schedules.
Full reporting under Web Console.
AD and GPO Backups.
AD and GPO State Reports.
Lepide Active Directory Cleaner.
Lepide User Password Expiration Reminder.
All AD/GPO Risk Analysis Reports.
Agent-Less Auditing
1.2 What’s Not Available with the Least Privilege Model?
AD and GPO Restore.
Non-Owner Mailbox Auditing under Exchange.
Health Monitoring.
Automatic Enabling of the Native Auditing from the DCs. (This is a one time process and can be done manually)
Automatic Event Log Management of the DCs.
Data Discovery and Classification of Exchange Mailboxes.
Agent Based Auditing.
1.3 Minimum Rights Required
A Domain User Account.
This account should have Db_owner/Db_creator rights over the SQL databases. An SQL account with the mentioned privileges can also be used.
This account should be a member of the Event Log Readers group inside AD.
This account should be a member of the Administrators Group on the Lepide Server.
This account should be a member of Organization Management group inside AD for Exchange Auditing.
1.4 Setting up the Account Privileges
Create a user account in Active Directory and add it under the Event Log Readers group.
Add this user account under the Local Admin Group on the Lepide Server. To do this, follow the steps below:
In the Run window, type mmc and press Enter.
The Microsoft Management Console screen will be displayed
From the File Menu, choose Add/Remove Snap-IN
The Add or Remove Snap-ins dialog box is displayed
Choose Local Users and Groups
Click Add
The Choose Target Machine dialog box is displayed
Select Local computer
Click Finish
Click OK
When the Choose Target Machine wizard is closed, the Local Users and Group node is added to the console:
Select Administrator from the middle pane and double click
The Administrators Properties dialog box is displayed:
From the Administrators Properties window, add the newly created user with default access rights.
Log in to the Lepide Server using the newly created user credentials.
Open ADSIEdit and provide access rights to the newly created user using the different naming context of Active Directory.
To do this, follow these steps:
From the Run window, type ADSIEDIT.msc and press Enter:
Right click on the ADSI Edit node and Select Connect to….
From the Connection Settings dialog box, select Default naming context and click OK
The Default Naming context node will be added to the console.
Expand Default naming context node and right click on the domain name node as shown below:
From the Properties window, add the newly created user with default access rights:
Repeat the steps above to add another naming context.
Please do not give any permissions to RootDSE, as the rights will not be accepted.
From the Properties dialog box, select Organization Management:
Give Full Control access rights to this account on the installation folder (C:\Program Files (x86)\LepideAuditor Suite).
Configure the Lepide service with the newly created user.
In SQL, create a login by adding the newly created user and selecting DB Creator as the role.
For Active Directory Cleaner, select Delegation Control for this user account:
The Delegation of Control Wizard will start:
Click Next
Click Add to add a user
Select Create a custom task to delegate
Select User Objects and Computer Objects from the list
Click Next
Select the Permissions to delegate
Click Next
The last step of the Wizard will appear with a summary of delegation of control you have set up:
Click Finish
NOTE: A new account must be created for using Active Directory Cleaner and then the Lepide server should be logged on with the same account.
2. Windows File Server Auditing
2.1 What’s Available?
All File Server Modification reports i.e. States and Changes.
Permission Analysis.
Alerting and Scheduling.
Full reporting under Web Console.
2.2. What’s Not Available?
All the features that are available on a Full Privileged Model are also available with the Least Privileged Model. The only difference is the specific rights and configuration that is required to be done.
2.3. Minimum Rights Required
A Domain User Account.
This account should have db_owner and db_creator rights over the SQL databases. An SQL account with the mentioned privileges can also be used.
This account should be a member of the Local Administrators Group on the File Server.
This account should be a member of the Local Administrators Group on the Lepide Server.
This account should have List Folder/Read Data, Traverse Folder/Execute File and Read Permissions rights on the Shares which are to be audited.
This account should be used to Logon to the Lepide Server to Configure the File Server for Auditing.
The SYSTEM account should have Modify rights on the folder where the agent is installed.
2.4. Adding the Windows File Server with Least Privileges
Follow the steps below to add a File Server with the Least Privileges:
Create a Shared Folder on the File Server and assign Modify rights to the Domain User account.
Add the file server with the Name or IP and provide the path to the Shared folder in the column Share Path instead of selecting Use Admin$ for Agent. Also, provide the user account created in the fields given at the bottom of the window.
The next steps are similar to the Full Privilege Model installation.
Permission Analysis can also be done in the same way once the rights are adjusted according to the section https://lepide.atlassian.net/wiki/spaces/LEPKB/pages/edit-v2/3837722625#2.2.-What%E2%80%99s-Not-Available%3F above.
3. NetApp Cluster Mode
Everything, except the Permission Analysis Module is available for NetApp Filers in the Least Privilege Model.
3.1 Minimum Rights Required
A Domain User Account.
This account should have db_owner and db_creator rights over the SQL databases. An SQL account with the mentioned privileges can also be used.
This account should have Change Permission on the C$ in NetApp.
This account should have Modify Rights on the Audit Log Volume.
This account should be a member of the Local Administrators Group on the Lepide Server.
This account should be used to Logon to the Lepide Server to Configure the File Server for Auditing.
3.2 Adding the NetApp Cluster Mode with Least Privileges
To add the NetApp Filer Cluster Mode for auditing, the native auditing should be enabled manually, and it should meet the following pre-requisites:
The minimum Log File Size (rotate-size) should be 1 MB.
The format of auditing should be XML.
The size of selected audit log volume should be at least 2 GB.
The rotate limit should be applied to the auditing configuration.
On the first page, provide the IP address and the domain user account. Please ensure to Uncheck the I have Management Access option.
In the Least Privilege Model, the ShareInfo.txt file is not created itself by the solution. The users will have to create this file manually in a txt format and should have the entries like this for every Share:
SharePath#JunctionPath#ShareName
Share Path: This can be taken from the OnTap Manager in the Share section.
Junction Path: This can be taken from the OnTap Manager in the Volume section
On the next page, please provide the audit log volume details along with the version of the NetApp and the location of the ShareInfo.txt file.
All the other steps are the same as the Full Privilege Model where the next step is to put in the SQL server details where the audit logs will be stored.
4. Exchange Online
4.1 Prerequisites
The following are prerequisites to add an Exchange Online component to the Lepide Data Security Platform:
The Lepide Server and Agent's Machine need to be logged in with Admin User
The Lepide Server and Agent's Machine are required to be Remote signed
Dot Net Framework 4.6.2 Developer Pack is required on the Lepide Server and Agent's Machine.
Tls 1.2 is required for the Lepide Server and Agent's Machine
4.2 Configure the Exchange Online Component
4.2.1 Register an App and Generate the Client ID, Secret Key and ThumbPrint for Exchange Online Auditing
For information on this please use the following link and follow the steps described:
https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps
Note: The user should copy Client ID and Thumbprint as needed for Login Information.
4.2.2 Permissions for Auditing Exchange Online
API Name | Claim Value | Type | Permissions | Role |
Microsoft Graph |
MailboxSettings.Read | Application | Allows the app to read user's mailbox settings without a signed-in user. Does not include permission to send mail. |
|
Microsoft Graph | User.Read.All | Application | Allows the app to read user profiles without a signed in user. | Exchange Administrator |
Microsoft Graph | AuditLog.Read.All | Application | Allows the app to read and query your audit log activities, without a signed-in user. |
|
Office 365 Exchange Online | Exchange.ManageAsApp | Application | Allows the app to manage the organization's Exchange environment without any user interaction. This includes mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles directly to the app. |
|
Office 365 Exchange Online | MailboxSettings.ReadWrite | Delegated | Allows the app to read, update, create, and delete your mailbox settings. |
|
Office 365 Management APIs | ActivityFeed.Read | Delegated | Read activity data for your organization |
|
Office 365 Management APIs | ActivityFeed.ReadDlp | Application | Read activity data for your organization |
|
4.2.3 Assigning the Role to the Application
Log into the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Select view button below Manage Microsoft Entra ID
Under Roles and Administrators select Global Reader and double click on it to Add assignments
In Add Assignments go to Select Member(s) then click add and select the newly created Application then click Next
Then the Assignment Type will be eligible. Unlock permanently eligible and selection assignment duration and click Assign
Under Roles and Administrators assign Exchange Administrator by following above steps.
NOTE: Global Reader: This is required for providing permission to the Application so that it can read different audit log events by using different technologies
4.2.4 How to Generate the Client ID, Secret Key and Thumbprint for Exchange Online Data Discovery & Classification
For information on this please use the following link and follow the steps described:
https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps
Note: The user should copy Client ID and Thumbprint as needed for Login Information.
4.2.5 Permissions for Data Discovery & Classification of Exchange Online
API Name | Claim Value | Type | Permissions | Role |
Microsoft Graph | Calendars.ReadWrite | Application | Allows the app to create, read, update, and delete events of all calendars without a signed-in user. |
Global Reader |
Microsoft Graph | Contacts.ReadWrite | Application | Allows the app to create, read, update, and delete all contacts in all mailboxes without a signed-in user. |
|
Microsoft Graph | Directory.ReadWrite.All | Application | Allows the app to read and write data in your organization's directory, such as users, and groups, without a signed-in user. Does not allow user or group deletion. |
|
Microsoft Graph | Mail.ReadWrite | Application | Allows the app to create, read, update, and delete mail in all mailboxes without a signed-in user. Does not include permission to send mail. |
|
Microsoft Graph | MailboxSettings.ReadWrite | Application | Allows the app to create, read, update, and delete user's mailbox settings without a signed-in user. Does not include permission to send mail. |
|
Microsoft Graph | Tasks.ReadWrite.All | Application | Allows the app to create, read, update and delete all users’ tasks and task lists in your organization, without a signed-in user |
|
Microsoft Graph | User.ReadWrite.All | Application | Allows the app to read and update user profiles without a signed in user. |
|
Office 365 Exchange Online | Exchange.ManageAsApp | Application | Allows the app to manage the organization's Exchange environment without any user interaction. This includes mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles directly to the app. |
|
Office 365 Exchange Online | MailboxSettings.ReadWrite | Application | Allows the app to read, update, create, and delete your mailbox settings. |
|
4.2.6 Assigning the Role to the Application
Log into the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Select view button below Manage Microsoft Entra ID
Under Roles and Administrators select Global Reader and double click on it to Add assignments
In Add Assignments go to Select Member(s) then click add and select the newly created Application then click Next
Then the Assignment Type will be eligible. Unlock permanently eligible and selection assignment duration and click Assign
Under Roles and Administrators assign Exchange Administrator by following the above steps.
4.2.7 How to Generate Client ID, Secret Key and Thumbprint for Exchange Online Current Permission Analysis
For information on this please use the following link and follow the steps described:
https://learn.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps
Note: The user should copy Client ID and Thumbprint as needed for Login Information.
4.2.8 Steps to Grant Permissions
Login to the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Open Microsoft Entra ID
Click on App Registration from the right panel
Click on view all application in the directory
Search and then click the newly created application
Click on API Permission from the right panel
Click on Add a Permission
Then grant below mentioned Permissions for Exchange online Auditing, DDC or CPA
4.2.9 Permissions for Current Permissions Analysis of Exchange Online
API Name | Claim Value | Type | Permissions | Role |
Office 365 Exchange Online | Exchange.ManageAsApp | Application | Allows the app to manage the organization's Exchange environment without any user interaction. This includes mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles directly to the app. |
Global Reader |
4.2.10 Assigning the Role to the Application
Log into the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Select view button below Manage Microsoft Entra ID
Under Roles and Administrators select Global Reader and double click on it to Add assignments
In Add Assignments go to Select Member(s) then click add and select the newly created Application then click Next
Then the Assignment Type will be eligible. Unlock permanently eligible and selection assignment duration and click Assign
Under Roles and Administrators assign Exchange Administrator by following above steps.
5. SharePoint Online
5.1 Prerequisites
To add SharePoint Online to the Lepide Data Security Platform for Auditing, an app must be registered on the Microsoft 365 portal.
Login to the Microsoft 365 Tenant needs to be done by a User with a Global Administrator account. This is because if the user does not have global admin rights, then they will not be able to grant admin consent permissions to the Tenant.
Without Global Admin rights, the Grant permission option in Microsoft will be grayed out.
5.2 Configure the SharePoint Online Component
5.2.1 Register an App and Generate the Client ID and Secret Key for SharePoint Online Auditing
For information on this please use the following link and follow the steps described:
Create or Update Client IDs and Secrets
Note: The user should copy Client ID and Thumbprint as needed for Login Information.
5.2.2 Steps to Grant Permissions
Login to the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Open Microsoft Entra ID
Click on App Registration from the right panel
Click on view all application in the directory
Search and then click the newly created application
Click on API Permission from the right panel
Click on Add a Permission
5.2.3 Permissions for Auditing SharePoint Online
Least Privileges Permissions
API Name | Claim Value | Type | Permissions | Role |
Microsoft Graph API’s | Sites.Read.All | Delegated | Read items in all site collections | |
Office 365 Management APIs | ActivityFeed.Read | Delegated | Read activity data for your organization |
|
Office 365 Management APIs | ActivityFeed.Read | Application | Read activity data for your organization |
|
Office 365 Management APIs | ActivityFeed.ReadDlp | Delegated | Read DLP policy events | NONE |
Office 365 Management APIs | ActivityFeed.ReadDlp | Application | Read DLP policy events |
|
Now add the components with Client ID and Secret Key
5.2.4 How to Generate Client ID, Secret Key and Thumbprint for SharePoint Online Data Discovery & Classification
For information on this please use the following link and follow the steps described:
Create or Update Client IDs and Secrets
Note: The user should copy Client ID and Thumbprint as needed for Login Information.
5.2.5 Steps to Grant Permissions
Login to the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Open Microsoft Entra ID
Click on App Registration from the right panel
Click on view all application in the directory
Search and then click the newly created application
Click on API Permission from the right panel
Click on Add a Permission
Then grant below mentioned Permissions for Exchange online Auditing, DDC or CPA
5.2.6 Permissions for Data Discovery and Classification of SharePoint Online
API Name | Claim Value | Type | Permissions | Role |
Office 365 SharePoint Online | Sites.FullControl.All | Application | Allows the app to have full control of all site collections without a signed in user. |
NONE |
Office 365 SharePoint Online | User.Read.All | Application | Allows the app to read user profiles without a signed in user. |
|
5.2.7 How to Generate the Client ID, Secret Key and Thumbprint for SharePoint Online Current Permission Analysis
For information on this please use the following link and follow the steps described:
Create or Update Client IDs and Secrets
Note: The user should copy Client ID and Thumbprint as needed for Login Information.
5.2.8 Steps to Grant Permissions
Login to the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Open Microsoft Entra ID
Click on App Registration from the right panel
Click on view all application in the directory
Search and then click the newly created application
Click on API Permission from the right panel
Click on Add a Permission
Then grant below mentioned Permissions for Exchange online Auditing, DDC or CPA
5.2.9 Permissions for Current Permission Analysis (CPA) of SharePoint Online
API Name | Claim Value | Type | Permissions | Role |
Office 365 SharePoint Online | Sites.FullControl.All | Application | Allows the app to have full control of all site collections without a signed in user. |
NONE |
Office 365 SharePoint Online | User.Read.All | Application | Allows the app to read user profiles without a signed in user. |
|
6. Microsoft 365 Components
The Microsoft 365 (M365) Component in the Lepide Data Security Platform covers the following four components of M365:
OneDrive
Entra ID
Teams
Copilot
All the reports and functionalities available for M365 auditing with the Least Privilege model are the same as with the Full Privilege model.
6.1 Prerequisites
To add OneDrive, Entra ID, Teams or Copilot components to the Lepide Data Security Platform for Auditing, an app must be registered on the Microsoft 365 portal.
Login to the Microsoft 365 Tenant needs to be done by a User with a Global Administrator account. This is because if the user does not have global admin rights, then they will not be able to grant admin consent permissions to the Tenant.
Without Global Admin rights, the Grant permission option in Microsoft will be grayed out.
6.2 OneDrive
6.2.1 Register an App and Generate the Client ID and Secret Key for OneDrive Auditing
For information on this please use the following link and follow the steps described:
Create or Update Client IDs and Secrets
Note: The user should copy Client ID and Thumbprint as needed for Login Information.
Click on the API permission tab for the given Client ID and select Add a Permission
6.2.2 Steps to Grant Permissions
Login to the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Open Microsoft Extra ID
Click on App Registration from the right panel
Click on view all application in the directory
Search and then click the newly created application
Click on API Permission from the right panel
Click on Add a Permission
6.2.3 Permissions for Auditing of OneDrive
API Name | Claim Value | Type | Permissions | Role |
Office 365 Management APIs |
ActivityFeed.Read | Application | Read activity data for your organization |
|
Office 365 Management APIs | ActivityFeed.ReadDlp | Application | Read DLP policy events | NONE |
Microsoft Graph | AuditLog.Read.All | Application | Allows the app to read and query your audit log activities, without a signed-in user. |
|
NOTE: Every permission change required must be granted admin consent
Now add the components with Client ID and Secret Key
6.2.4 How to Generate the Client ID, Secret Key and Thumbprint for OneDrive Data Discovery and Classification
For information on this please use the following link and follow the steps described:
Create or Update Client IDs and Secrets
Note: The user should copy Client ID and Thumbprint as needed for Login Information.
6.2.5 Steps to Grant Permissions
Login to the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Open Microsoft Entra ID
Click on App Registration from the right panel
Click on view all application in the directory
Search and then click the newly created application
Click on API Permission from the right panel
Click on Add a Permission
Then grant below mentioned Permissions for Exchange online Auditing, DDC or CPA
6.2.6 Permissions for Data Discovery & Classification for OneDrive
API Name | Claim Value | Type | Permissions | Role |
Office 365 SharePoint Online | Sites.FullControl.All | Application | Allows the app to have full control of all site collections without a signed in user. |
NONE |
Office 365 SharePoint Online | User.Read.All | Application | Allows the app to read user profiles without a signed in user. | |
Microsoft Graph | Files.Read.All | Application | Allow app to read files | |
Microsoft Graph | Sites.Read.All | Application | Allow app to read sites info | |
Microsoft Graph | User.Read.All | Application | Allow app to read user info |
6.2.7 Register an App and Generate the Client ID and Secret Key for OneDrive Current Permission Analysis
For information on this please use the following link and follow the steps described:
Create or Update Client IDs and Secrets
Note: The user should copy Client ID and Thumbprint as needed for Login Information.
6.2.7 Steps to Grant Permissions
Login to the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Open Microsoft Entra ID
Click on App Registration from the right panel
Click on view all application in the directory
Search and then click the newly created application
Click on API Permission from the right panel
Click on Add a Permission
Then grant the Permissions mentioned below for Exchange online Auditing, DDC or CPA
6.2.8 Permissions for Current Permission Analysis for OneDrive
API Name | Claim Value | Type | Permissions | Role |
Office 365 SharePoint Online | Sites.FullControl.All | Application | Allows the app to have full control of all site collections without a signed in user. |
NONE |
Office 365 SharePoint Online | User.Read.All | Application | Allows the app to read user profiles without a signed in user. | |
Microsoft Graph | Files.Read.All | Application | Allow app to read files | |
Microsoft Graph | Sites.Read.All | Application | Allow app to read sites info | |
Microsoft Graph | User.Read.All | Application | Allow app to read user info |
6.3 Entra ID
6.3.1 Register an App and Generate the Client ID and Secret Key for Entra ID Auditing
For information on this please use the following link and follow the steps described:
Create or Update Client IDs and Secrets
Note: The user should copy Client ID and Thumbprint as needed for Login Information.
6.3.2 Steps to Grant Permissions
Login to the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Open Microsoft Entra ID
Click on App Registration from the right panel
Click on view all application in the directory
Search and then click the newly created application
Click on API Permission from the right panel
Click on Add a Permission
6.3.3 Permissions for Entra ID Auditing
API Name | Claim Value | Type | Permissions | Role |
Office 365 Management APIs |
ActivityFeed.Read | Delegated | Read activity data for your organization |
|
Office 365 Management APIs | ActivityFeed.ReadDlp | Delegated | Read DLP policy events | NONE |
Office 365 Management APIs | ActivityFeed.Read | Application | Read activity data for your organization |
|
Office 365 Management APIs | ActivityFeed.ReadDlp | Application | Read DLP policy events |
|
Microsoft Graph | AuditLog.Read.All | Application | Allows the app to read and query your audit log activities, without a signed-in user. |
|
Microsoft Graph | Directory.Read.All | Application | Allows the app to read and query your audit log activities, without a signed-in user. |
|
6.3.4 How to Generate the Client ID, Secret Key and Thumbprint for Entra ID Current Permission Analysis
For information on this please use the following link and follow the steps described:
Create or Update Client IDs and Secrets
Note: The user should copy Client ID and Thumbprint as needed for Login Information.
6.3.5 Steps to Grant Permissions
Login to the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Open Microsoft Entra ID
Click on App Registration from the right panel
Click on view all application in the directory
Search and then click the newly created application
Click on API Permission from the right panel
Click on Add a Permission
Then grant the permissions listed below for Exchange Online Auditing, DDC or CPA
6.3.6 Permissions for Current Permission Analysis for Entra ID
API Name | Claim Value | Type | Permissions | Role |
Office 365 Exchange Online | Exchange.ManageAsApp | Application | Allows the app to manage the organization's Exchange environment without any user interaction. This includes mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles directly to the app. |
Global Reader |
6.3.7 Assigning the Role to the Application
Log into the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Select view button below Manage Microsoft Entra ID
Under Roles and Administrators select Global Reader and double click on it to Add assignments
In Add Assignments go to Select Member(s) then click add and select the newly created Application then click Next
Then the Assignment Type will be eligible. Unlock permanently eligible and selection assignment duration and click Assign
6.4 Microsoft Teams
6.4.1 Register an App and Generate the Client ID and Secret Key for Microsoft Teams Auditing
For information on this please use the following link and follow the steps described:
Create or Update Client IDs and Secrets
Note: The user should copy Client ID and Thumbprint as needed for Login Information.
Click on the API permission tab for the given Client ID and select Add a Permission
6.4.2 Steps to Grant Permissions
Login to the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Open Microsoft Entra ID
Click on App Registration from the right panel
Click on view all application in the directory
Search and then click the newly created application
Click on API Permission from the right panel
Click on Add a Permission
6.4.3 Permissions for the Auditing of Teams
Microsoft 365 Management API’s
ActivityFeed.Read | Delegated |
ActivityFeed.ReadDlp | Delegated |
ActivityFeed.Read | Application |
ActivityFeed.ReadDlp | Application |
Microsoft Graph API’s
AuditLog.Read.All | Application |
Now add the components with Client ID and Secret Key
6.5 Microsoft Copilot
6.5.1 Register an App and Generate the Client ID and Secret Key for Microsoft Copilot Auditing
For information on this please use the following link and follow the steps described:
Create or Update Client IDs and Secrets
NOTE: The user should copy Client ID and Secret Key as needed for Login Information
Click on the API Permission Tab for the given Client ID, click on Request API Permissions
6.5.2 Steps to Grant Permissions
Login to the Entra ID Portal (https://portal.Entra ID.com) through Global Admin
Open Microsoft Entra ID
Click on App Registration from the right panel
Click on view all application in the directory
Search and then click the newly created application
Click on API Permission from the right panel
Click on Add a Permission
6.5.3 Permissions for Copilot Auditing
The permissions required for running Copilot Reports are:
Microsoft 365 Management APIs
ActivityFeed.Read | Delegated |
ActivityFeed.ReadDlp | Delegated |
ActivityFeed.Read | Application |
ActivityFeed.ReadDlp | Application |
Microsoft Graph Permissions
AuditLog.Read.All | Delegated |
AuditLog.Read.All | Application |
AuditLogsQuery-OneDrive.Read.All | Application |
AuditLogsQuery-SharePoint.Read.All | Application |
AuditLogsQuery.Read.All | Application |
Directory.Read.All | Application |
Files.Read.All | Application |
InformationProtectionPolicy.Read.All | Application |
Organization.Read.All | Application |
User.Read.All | Application |
7. App used some "most privileged permissions" for the following reasons:
In Data Discovery and Classification, you may encounter many privileges with write permissions.
7.1 Why do apps need these?
Initially, The Tool identify sensitive data using provided patterns or regexes. For this step, no write permissions are required. However, for classification and incremental scanning, the tool needs to add tags to the identified patterns within the metadata of the objects.
For example, in SharePoint Online or OneDrive, a hidden column is created in the list where your data is stored, and information about sensitive data is added for each relevant file. Similarly, for DDC (Data Discovery and Classification) in Exchange online, permissions are required to update metadata or labels associated with the data.
In SharePoint Online and OneDrive, to access data permissions, App require the permission:
Sites.FullControl.All
7.2 Why does the app need this permission?
Because it is necessary to access role assignments and permission details. In SharePoint Online and OneDrive architecture, permissions are stored in a way that only admins or owners can access them. These are secure objects, and to interact with them, the app needs Sites.FullControl.All permission.
For more information, please refer to the following Microsoft documentation:
https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread
https://learn.microsoft.com/en-us/graph/api/site-get-permission?view=graph-rest-1.0&tabs=http
https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread
In Exchange Online (for Audit, Get Permission, and DDC) the app needs Exchange.ManageAsApp permissions.
7.3 Why does the app need this permission?
Because it is necessary to access resources in Exchange. An application object has the Delegated API permission Microsoft Graph > User. Read by default. However, for the application object to access resources in Exchange, it requires the Application API permission Office 365 Exchange Online > Exchange.ManageAsApp.
For more information, please refer to the following Microsoft documentation:
In Exchange auditing, the app requires the MailboxSettings.ReadWrite permission and the Exchange Administrator role to retrieve non-owner mailbox audit events, since these events involve accessing sensitive mailbox data that only admins can view.
If non-owner events are not needed, these permissions can be skipped.
However, for accessing Exchange Admin Center (EAC) audit logs, the Global Reader role is sufficient, as it allows viewing admin activity logs without providing full administrative privileges.
For security purposes, we use Certificate-based Authentication. To set this up, you need to create a certificate following the steps below:
$mycert = New-SelfSignedCertificate -DnsName "YourDomain.onmicrosoft.com" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(4) -KeySpec KeyExchange -FriendlyName "scriptfile"
$mycert | Select-Object -Property Subject, Thumbprint, NotBefore, NotAfter
$mycert | Export-Certificate -FilePath "C:\temp\scriptfile.cer"
$mycert | Export-PfxCertificate -FilePath "C:\temp\scriptfile.pfx" -Password $(ConvertTo-SecureString -String "Password value" -AsPlainText -Force)
Important notes:
Replace "YourDomain.onmicrosoft.com" with your actual domain.
Use a strong password for the PFX file.
After creating the certificate, upload the .cer file into Azure.
Install the certificate on your local machine as a "Local Machine" certificate.
Once the certificate is installed, you can safely delete the local certificate files from your machine for security reasons.
Security Tip:
These certificates are created with the "Not exportable" option, meaning the private key cannot be exported, copied, or transferred out of the system where it was created, enhancing security.