Permission
What it returns
Why we need it
User.Read.All
The list of user accounts, names and account status
So we can tell who exists and who is disabled
Organization.Read.All
Your tenant's subscribed SKUs and purchased quantities
So we know what you bought, and how much of it
Directory.Read.All
License assignments, groups and service principals
So we know which seat belongs to which person
AuditLog.Read.All
Interactive sign-in timestamps only
So we can identify dormant accounts. No event contents.
Reports.Read.All
Aggregate service usage counters per user
So we can tell an E5 holder is not using E5 features
Application.Read.All
OAuth grants to third-party apps
So we can surface shadow apps already in your tenant