Requested permissions
Each Microsoft Graph permission and Google scope Sorvek requests, what it is used for, and why nothing is changed without your decision.
On this page
On the Microsoft side, Sorvek requests only read permissions. On the Google side, all scopes are read-only, except two that Google does not offer in a read-only version; Sorvek uses them to write only during a revocation that you launch yourself in live mode. Corrective actions run in Simulation mode by default and change nothing without your decision.
To see what is granted in your environment: Settings > Data sources, Permissions button of the source.
Microsoft Graph: application permissions
With admin consent, Microsoft's screen shows the exact list. With a BYO app registration (Connect Microsoft 365), the Sorvek wizard shows this table.
| Permission | Required | What Sorvek does with it | Access |
|---|---|---|---|
User.Read.All |
Yes | Reads users (name, email, department, title) to link each SaaS account to a person. | Read |
Directory.Read.All |
Yes | Reads the directory: domains, licences, administrator roles, groups. With BYO, it also proves that the app belongs to your tenant. | Read |
Policy.Read.All |
Yes | Reads Conditional Access, authentication policies and the user consent setting. | Read |
Application.Read.All |
Yes | Reads enterprise applications, their owners and their assignments. | Read |
AuditLog.Read.All |
Yes | Reads sign-in and audit logs (last sign-in, who granted a consent). | Read |
UserAuthenticationMethod.Read.All |
Yes | Reads registered authentication methods, to measure MFA coverage. | Read |
DelegatedPermissionGrant.Read.All |
Yes | Reads the OAuth grants your employees have given to third-party applications. | Read |
Mail.Read |
Yes (email module) | Reads emails to recognize SaaS sign-ups, notifications and invoices. The content is analyzed in memory; the body is not kept (see the exception in Data retained, retention periods and deletion). | Read |
MailboxSettings.Read |
No | Reads forwarding rules and the mailbox type (shared, room, equipment). | Read |
Reports.Read.All |
No | Reads Microsoft 365 usage reports (licences and activity). | Read |
IdentityRiskEvent.Read.All, IdentityRiskyUser.Read.All, IdentityRiskyServicePrincipal.Read.All |
No | Read Entra ID P2 risk signals (events, users, applications). | Read |
Group.Read.All, Domain.Read.All |
No | Read groups and domains, already covered by Directory.Read.All. |
Read |
SharePointTenantSettings.Read.All |
No | Reads SharePoint and OneDrive sharing settings. SaaS discovery does not need it. | Read |
Without User.Read.All or Directory.Read.All, the scan stops. Without another required permission, it continues, but its results may be incomplete: its details, on the Scans page, name the missing permission. A missing optional permission only removes the feature that depends on it.
Delegated permissions
openid, profile, email and User.Read are used to sign you in to Sorvek with your Microsoft account, and to check your administrator role right after consent. They only give access to your own profile.
Optional modules in the BYO wizard
The wizard also offers, read-only: Microsoft Defender (AdvancedQuery.Read.All, Machine.Read.All, Alert.Read.All) and Azure Sentinel (Data.Read on Log Analytics), which SaaS discovery does not use, and the Copilot Studio agent inventory, which goes through a Power Platform registration (PowerShell New-PowerPlatformManagementApp).
Google Workspace: delegation scopes
In the Google console, each scope is written in full: https://www.googleapis.com/auth/ followed by the name below. The copy button in the wizard (Connect Google Workspace) gives the complete list.
| Scope | Module | Required | What Sorvek does with it | Access |
|---|---|---|---|---|
admin.directory.user.readonly |
Directory | Yes | Reads the domain's users and their 2-Step Verification status. | Read |
admin.directory.group.readonly |
Directory | Yes | Reads groups. | Read |
admin.directory.group.member.readonly |
Directory | Yes | Reads group members. | Read |
admin.directory.domain.readonly |
Directory | Yes | Requested, but not used by collection. | Read |
admin.directory.orgunit.readonly |
Directory | No | Not used by collection. | Read |
admin.directory.user.security |
Third-party OAuth apps | Yes | Lists the third-party applications each employee has given access to. Since Google has no read-only version of it, it is also used for a revocation launched in live mode. | Read, write at your request |
admin.reports.audit.readonly |
Logs | Yes | Reads the activity of this access over 180 days: last use and revocations. | Read |
admin.reports.usage.readonly |
Logs | No | Not used by collection. | Read |
gmail.readonly |
Gmail | Yes | Reads email headers (sender, recipients, subject, date, labels). The body is neither requested nor stored. | Read |
apps.alerts |
Security alerts | Yes | Requested, but not used by collection. Google does not offer a read-only version of it. | No writes |
No writes without your decision
- Simulation by default: revoking an OAuth grant, disabling the account of a departing employee or revoking their sessions all go through the same safeguard. Sorvek logs what it would have done, without changing anything.
- Two locks for live mode: a switch held by Sorvek, and your organization's arming on the Destructive actions page, with a confirmation phrase. If either one is closed, everything stays simulated. See OAuth grants and revocation.
- Microsoft: without a write permission, Microsoft refuses any write, even in live mode.
- Google: in live mode, only revoking an OAuth grant writes to your domain.
- Always a human action: an action only happens if an authorized person launches it (by default, the Administrator role: see Roles and access). No scheduled task triggers it.
Can’t find your answer?
Already a customer? The support bubble at the bottom of the app sends your question with its context. Otherwise, write to the Sorvek team.