SYAGA Audit
Diagnóisiú Microsoft 365: ar an bpribhléid is lú

Léimid do chuid socruithe.
Ní léimid do shonraí fíor riamh.

Ní roinntear aon fhocal faire. Léimid do chumraíocht le do rochtain féin, ní léimid ríomhphost ná comhad riamh. Gearrann tú an rochtain aon uair is mian leat.

Fógra teanga. Doiciméad: An rud a údaraíonn tú - SYAGA Audit. Sleachta a thaispeántar i mBéarla: 2 as 76. Is é an leagan Fraincise den doiciméad seo an leagan tagartha. Chun leagan i do theanga féin a fháil, scríobh chuig contact@syaga.eu.

Léamh amháin, agus ansin scriostar gach rud

No write is possible: our application holds no write permission, Microsoft would refuse it. The scan runs in your browser; our server only ever sees tokens, never your data in clear text. Your results live in memory: they leave when you tick the discharge box, once you have downloaded your files, and no later than 2 hours after the end of the scan (24 hours for what you send us yourself). Only your billing data remains, which the law requires us to keep for 10 years.

Conas a chruthaímid é
With YOUR access. You sign in with Microsoft (no shared password). The token is transient: the session token is encrypted at rest and does not live longer than 58 minutes, and the technical scan token expires no later than 3 hours after it is issued. And you can cut off access whenever you want, from Microsoft, without asking us. Foinse Microsoft: OAuth ↗
Deimhníonn tusa, cúlghairíonn tusa. Cúlghairm = cliceáil amháin in Entra. Coinnítear taifead de gach rud i do dhialanna iniúchta féin ó Microsoft: feiceann tú féin nach ndearnamar ach léamh. Foinse Microsoft: dialanna iniúchta ↗

The exact detail: what Microsoft is about to ask you

Your journey opens 5 successive Microsoft consent screens (checking your audit log, then the scan, then the Exchange, Teams and Power Platform deep dives). This page details the scan one. Microsoft will list 45 permissions there, one by one. It is long, and that is normal: Microsoft splits its read permissions very finely. Here is the same list, grouped by domain. Compare it line by line: if a permission shows up on the Microsoft screen without appearing here, do not consent. All 45 are read-only (Read): none of them allows writing, changing or deleting anything.

Sign-in and directory3
  • User.Read : Reads your own profile, to know who is running the audit. Nothing else.
  • Directory.Read.All : Reads the directory (accounts, groups, registered applications, domains). This is the bedrock of the diagnostic: who exists, who is an administrator.
  • AdministrativeUnit.Read.All : Reads administrative units, that is how your directory is carved up by site, department or subsidiary.
Policies and consents5
  • Policy.Read.All : Reads your conditional access, password and authentication method policies.
  • Policy.Read.PermissionGrant : Reads the rule that decides whether a user can, alone, authorise a third-party application.
  • ConsentRequest.Read.All : Reads application requests awaiting your approval.
  • AuthenticationContext.Read.All : Reads your authentication contexts, the assurance tiers attached to sensitive actions.
  • Agreement.Read.All : Reads the terms of use you present to your users at sign-in.
Logs and reports3
  • AuditLog.Read.All : Reads the audit log and sign-in history. This is what reveals intrusion attempts, and it is also what lets you check afterwards everything we read.
  • Reports.Read.All : Reads usage reports (MFA actually in use, dormant licences).
  • ReportSettings.Read.All : Reads a single setting: whether your reports are anonymised.
Roles and privileged access5
  • RoleManagement.Read.Directory : Reads directory role assignments, so who is an administrator today.
  • RoleManagement.Read.All : Reads PIM-eligible roles, so who can become an administrator on demand.
  • RoleManagementAlert.Read.Directory : Reads PIM alerts (too many standing administrators, privileged accounts without MFA).
  • PrivilegedAccess.Read.AzureADGroup : Reads privilege elevation obtained through group membership. A classic blind spot.
  • DelegatedAdminRelationship.Read.All : Reads delegated administration relationships, so which providers hold privileged access to your tenant.
Access governance3
  • AccessReview.Read.All : Reads your access reviews, the campaigns that periodically recheck entitlements.
  • EntitlementManagement.Read.All : Reads your access packages and their approvers.
  • LifecycleWorkflows-Workflow.ReadBasic.All : Reads the joiner and leaver automation for your staff.
Identity protection3
  • IdentityRiskEvent.Read.All : Reads Microsoft risk detections (sign-in from an anonymous address, credentials found in a leak).
  • IdentityRiskyUser.Read.All : Reads the list of accounts Microsoft flags as risky.
  • IdentityRiskyServicePrincipal.Read.All : The same thing for application identities, not people.
Security and Defender4
  • SecurityEvents.Read.All : Reads your Microsoft secure score and the detail of its controls.
  • SecurityAlert.Read.All : Reads security alerts.
  • SecurityIncident.Read.All : Reads incidents, that is the alerts Microsoft has grouped together.
  • AttackSimulation.Read.All : Reads your phishing simulation campaigns, if you run any.
Devices and Intune7
  • DeviceManagementManagedDevices.Read.All : Reads the inventory of managed devices (encryption, compliance, OS version).
  • DeviceManagementConfiguration.Read.All : Reads the configuration and compliance profiles being applied.
  • DeviceManagementServiceConfig.Read.All : Reads general Intune settings (enrolment, Autopilot).
  • DeviceManagementApps.Read.All : Reads the applications you distribute and their protection policies.
  • DeviceManagementScripts.Read.All : Reads the scripts pushed to your endpoints. Rarely reviewed, often carrying secrets.
  • DeviceManagementRBAC.Read.All : Reads who holds which rights inside Intune.
  • DeviceLocalCredential.ReadBasic.All metadata only : This is about LAPS, the backup of the local administrator password. We call /directory/deviceLocalCredentials without asking for the credentials field: we see that a backup exists and how old it is, never the password.What Microsoft writes: To access the actual passwords on the device, done by including $select=credentials as part of the query parameters, the app must be assigned the DeviceLocalCredential.Read.All permission and DeviceLocalCredential.ReadBasic.All is insufficient. Microsoft source
SharePoint and OneDrive2
  • SharePointTenantSettings.Read.All : Reads tenant sharing settings (external sharing, anonymous links, expiry).
  • Sites.Read.All : Used to inventory your sites (/sites/getAllSites). Let us be precise, because this is the broadest one on the list: as Microsoft defines it, it would also allow reading documents. Our code only does the inventory, and your audit log shows it request by request. That is exactly why we ask for AuditLog.Read.All: so that you can check it yourself, without taking our word for it.
Teams2
  • TeamworkAppSettings.Read.All : Reads tenant-wide Teams app settings.
  • AppCatalog.Read.All : Reads the catalogue of Teams applications allowed in your tenant.
Compliance and data subject rights2
  • RecordsManagement.Read.All : Reads your retention labels and policies.
  • SubjectRightsRequest.Read.All : Reads your data subject rights requests under the GDPR (access, erasure): that they exist and how they are tracked, not their content.
Backup and encryption2
  • BackupRestore-Configuration.Read.All : Reads your Microsoft 365 backup policies, if any exist.
  • BitlockerKey.ReadBasic.All metadata only : Tells whether a BitLocker recovery key exists for a device and when it was backed up. We call /informationProtection/bitlocker/recoveryKeys without $select=key: the key itself is never returned to us.What Microsoft writes: By default, this operation doesn't return the key property that represents the actual recovery key. To include the key property in the response, use the $select OData query parameter. Including the $select query parameter triggers a Microsoft Entra audit of the operation and generates an audit log. Microsoft source
Network and service health3
  • NetworkAccess.Read.All : Reads your network access configuration (Global Secure Access), if you use it.
  • ServiceHealth.Read.All : Reads the health state of your Microsoft services.
  • ServiceMessage.Read.All : Reads message center posts, the changes Microsoft announces to you.
Forms1
  • OrgSettings-Forms.Read.All : This is about Microsoft Forms: the organisation-level settings of the service (who may create forms, external sharing, collecting responses from outside the organisation). We read those settings, never the content of a form or any response.
Two lines look alike, and that is not a mistake. RoleManagement.Read.Directory is a subset of RoleManagement.Read.All: we keep both because Microsoft documents one for part of the role reads and the other for PIM-eligible roles.
What is NOT requested. No mail permission (Mail.*), no chat permission (Chat.*), and no write permission (ReadWrite). And no offline_access: we keep no access after the diagnostic. Your token lives about one hour, in memory, then it is gone.
The official name and definition of every one of these permissions is public, at Microsoft, not at our place: Microsoft Graph permissions reference
How to check, at Microsoft, that this is really all of it
On the Microsoft screen, before you say yes. The list above is the one Microsoft is about to show you on the scan screen. Compare them. One extra line on the screen that is not on this page, and you refuse: that is the whole point of this page. All 5 screens of the journey read the same way: what Microsoft displays is what counts, not what we write.
After consent, inside your own directory. Entra, then Enterprise applications, then SYAGA Audit, then Permissions. There you read the real list of what was granted, written by Microsoft and not by us. The same screen lets you revoke it. entra.microsoft.com
On the user side too. Your authorised applications, and one-click revocation: myapps.microsoft.com
In your report. The permissions shown in your report are read back from Microsoft (oauth2PermissionGrants), not copied from our own declarations. If the two ever diverged, it would show.
1
An rochtain íosta ar dtús. Ní dheimhnímid ach go bhfuil do dhialann iniúchta gníomhach. Níl aon cheadúnas don iniúchadh iomlán ag an gcéim seo.
2
An t-iniúchadh iomlán ina dhiaidh sin. Ach amháin má tá an dialann gníomhach, molfar duit ansin an léamh don iniúchadh iomlán (eolaire, Exchange, Teams, Purview).
Mionsonraigh mo phróifíl (méid, earnáil), roghnach

Cuirimis aithne ar a chéile ar dtús (roghnach, nóiméad amháin)

Sula dtosaíonn tú an diagnóisiú, inis dúinn cé tú féin. Ag brath ar do mhéid agus do earnáil, níl na hoibleagáidí céanna ort (GDPR, NIS 2, DORA): sin an rud a fhágann do thorthaí cruinn. Cáilímid, ní dhearbhaímid riamh. Sonraí poiblí INSEE, gan aon fhaisnéis íogair anseo.

Foinse: Recherche d'Entreprises, INSEE Sirene, sonraí poiblí oifigiúla.

Rochtain luath: ag an gcéim seo, ní féidir ach le tionónta Microsoft 365 a fuair cuireadh diagnóisic fhíor a rith. Mura bhfuil cuireadh faighte ag do cheannsa fós, stopann an próiseas roimh aon bhailiú agus cuirtear ar an liosta feithimh thú.

Sales are not open in this language yet. The terms you would have to accept here are not fully written in your language, and we will not ask you to accept a text you cannot read. Sales are open in the languages below. You can also write to contact@syaga.eu.

Fógra teanga. Doiciméad: Comhaontú um Phróiseáil Sonraí (DPA). Sleachta a thaispeántar i mBéarla: 4 as 161. Is é an leagan Fraincise den doiciméad seo an leagan tagartha. Chun leagan i do theanga féin a fháil, scríobh chuig contact@syaga.eu.

English · Français

Saor in aisce : do scór + do bhearnaí. An tuarascáil mhionsonraithe agus an dearbhú réasúnaithe: €499 gan CBL, ach amháin más é sin do rogha.

The report is a diagnostic: it states what is observed, it does not fix anything on your behalf.

Conas a chruthaímid é