Microsoft 365 Application permissions
Overview
MetaDefender for Microsoft 365 requires specific Microsoft Graph and Office 365 Exchange Online API permissions to operate correctly and securely within your Microsoft 365 environment.
When installing and granting consent, your administrator will authorize the following permissions. The table below summarizes each permission and provides a brief description of its purpose.
Exchange Online
API/Permission name | Type | Description |
|---|---|---|
Microsoft Graph | ||
Contacts.Read | Application | Allows solution to read contact information in all mailboxes (used for email processing and routing logic). |
Directory.Read.All | Application | Allows solution to read directory data (users, groups, domains, and more) to determine protection scope and apply mail flow rules & policies. |
Domain.Read.All | Application | Allows solution to read the domains in your tenant to support domain-based routing and configuration. |
Group.Read.All | Application | Allows solution to read all groups (used for applying policies to specific groups). |
GroupMember.Read.All | Application | Allows solution to read group memberships (used to apply policies to group members). |
Mail.ReadWrite | Application | Allows solution to read & write email content in mailboxes for security analysis when protection mode is enabled. |
ProfilePhoto.Read.All | Application | Allows solution to read profile photos of users and groups (used for enhancing the admin portal UX). |
User.Read | Delegated | Allows solution to sign in and read the profile of the signed-in user (basic sign-in and profile read functionality). |
User.Read.All | Application | Allows solution to read all users' full profiles (used to support user-based policies and visibility). |
Office 365 Exchange Online | ||
Exchange.Manage* | Delegated | Allows solution to manage Exchange configuration (e.g., mail flow rules, connectors) when performing setup or adjustments. |
* Only used when selecting automatic integration mode
Teams
API/Permission name | Type | Description |
|---|---|---|
Microsoft Graph | ||
AppCatalog.Read.All | Application | Allows the solution to read apps available in Microsoft Teams app catalogs. |
ChannelMember.Read.All | Application | Allows the solution to read membership information for all Microsoft Teams channels. |
ChannelMessage.Read.All | Application | Allows the solution to read messages in all Microsoft Teams channels. |
Chat.Read.All | Application | Allows the solution to read all one-to-one and group chat messages in Microsoft Teams. |
ChatMember.Read.All | Application | Allows the solution to read membership information for all Microsoft Teams chats. |
Directory.Read.All | Application | Allows solution to read directory data (users, groups, domains, and more) to determine protection scope and apply policies. |
Domain.Read.All | Application | Allows solution to read the domains in your tenant to support domain-based routing and configuration. |
Group.Read.All | Application | Allows solution to read all groups (used for applying policies to specific groups). |
GroupMember.Read.All | Application | Allows solution to read group memberships (used to apply policies to group members). |
ProfilePhoto.Read.All | Application | Allows solution to read profile photos of users and groups (used for enhancing the admin portal UX). |
Sites.ReadWrite.All | Application | Allows the solution to read, create, update, and delete documents and list items across all SharePoint site collections. |
TeamsAppInstallation.ReadWrite | Application | Allows the solution to read, install, upgrade, and uninstall Teams apps for any user, and manage their resource-specific permission grants. |
User.Read | Delegated | Allows solution to sign in and read the profile of the signed-in user (basic sign-in and profile read functionality). |
User.Read.All | Application | Allows solution to read all users' full profiles (used to support user-based policies and visibility). |
Why These Permissions Are Required
These permissions are used to:
Apply and manage Exchange mail flow rules and connectors
Apply and manage Teams subscriptions
Apply protection policies based on users, groups, and domains