Microsoft Graph Security roles and permissions

Role Permission Description
Microsoft Secure Scores Reader

Can read all Security and compliance Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.securitycompliance.securescore.read Can read all Security Compliance secure score Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Secure Scores Writer

Can read and execute all Security and compliance Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.securitycompliance.securescore.read Can read all Security Compliance secure score Command Blocks and jobs
command.securitycompliance.securescore.write Can write all Security Compliance secure score Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Security Alerts Reader

Can read all Security and compliance Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.securitycompliance.alerts.read Can read all Security Compliance alerts Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Security Alerts Writer

Can read and execute all Security and compliance Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.securitycompliance.alerts.read Can read all Security Compliance alerts Command Blocks and jobs
command.securitycompliance.alerts.write Can write all Security Compliance alerts Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Threats Assessments Reader

Can read all Security and compliance Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.securitycompliance.threatassessment.read Can read all Security Compliance threat assessment Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)
Microsoft Threats Assessments Writer

Can read and execute all Security and compliance Command Blocks.

command.category.read Can read all corresponding Command Block categories
command.securitycompliance.threatassessment.read Can read all Security Compliance threat assessment Command Blocks and jobs
command.securitycompliance.threatassessment.write Can write all Security Compliance threat assessment Command Blocks and jobs
command.jobs.read Can read related Command Block jobs
command.read Can read all related Command Blocks
organization.readbasic Can read all basic organization properties (list)
report.accesstoken.read Can read Power BI report access token (list)
report.read Can read Power BI reports (list)
user.read Can read all properties of a user (details)
user.readbasic Can read all basic user properties (list)

Related articles

Updated: Feb 29, 2024