Every permission, in plain language, with the API name next to it.

This page exists to be forwarded to a security team. Nothing here is a summary — it is the complete list of what &License asks for, why it asks, and what it deliberately does not.

Microsoft 365 Google Workspace Optional write scopes

These are optional, and off by default

Requested separately, only when you turn on reclaim or downgrade actions, and revocable independently of the read grant. Never requested on the free tier.

Permission

What it returns

Why we need it

User.ReadWrite.All (M365)

Remove a license assignment from a user

Only when you click Reclaim on a specific seat

Directory.ReadWrite.All (M365)

Change an assigned SKU on a user

Only when you approve a tier downgrade

apps.licensing (Google)

Update license assignment on a user

Only when you click Reclaim on a specific seat

Audit trail

Every write is logged with who approved it and when

So an action can always be traced back to a person

What we never ask for, on any tier

Files in OneDrive, SharePoint, Drive or Box

Teams, Slack or chat messages

Calendar event bodies or attachments

Documents, notes or wiki pages

Anything requiring a content or Mail.Read scope

If a connector ever required a content scope to work, we would not ship that connector.

How to revoke, in one step

Microsoft 365 / Entra

Entra admin center → Enterprise applications → &License Discovery → Delete

Google Workspace

Admin console → Security → API controls → App access control → &License → Remove

Delete stored data

&License → Company settings → Workspace → Delete workspace

Revoking stops new reads immediately. Deleting the workspace removes what we already hold, backups included, within 7 days.

&License

See what you're paying for that nobody uses. Read-only, connected in minutes, priced per user.

Built by the team that runs a 100+ person MSP.

Product

Overview Sample report How it works Pricing

For MSPs

MSP overview Portfolio view MSP pricing

Trust

Security review Scopes we request Data handling Sign in

Security Privacy Terms