AppAlert requests read-only Microsoft Graph permissions for sign-in and inventory reads. These permissions cannot create, rotate, or delete credentials. AppAlert stores credential metadata such as type, expiry date, and owner email addresses, but never receives secret values, private keys, or passwords.
Decide whether to approve access
Before you choose Grant as administrator, confirm that your organization accepts the read-only permissions and stored metadata described below. If another person owns that decision, choose Request admin approval and share the Trust permissions review and assurance material with them.
After approval, return to the connection instructions. AppAlert reports the connection and initial sync state separately.
Revoking consent stops future directory reads and does not delete inventory AppAlert already stores. Read Retention and revocation for the separate deletion process.
Sign-in permission
AppAlert uses the delegated permission User.Read during Microsoft sign-in. It lets AppAlert read the basic profile tied to your account so AppAlert can authenticate you and link you to your organization.
Organization inventory permissions
Application.Read.All lets AppAlert read application registrations, enterprise applications, and credential metadata such as credential type and expiry date.
AppAlert uses Directory.Read.All to read Application Proxy publishing metadata and application owner records needed for complete coverage and owner routing. Microsoft Graph does not currently expose both through the narrower application permission AppAlert uses.
Microsoft lists the current permission definitions in the Microsoft Graph permissions reference.
Agent identity inventory permissions
AppAlert uses AgentIdentity.Read.All to read agent identity inventory. It uses AgentIdentityBlueprint.Read.All to read blueprint definitions. It uses AgentIdentityBlueprintPrincipal.Read.All to read the principals connected to those blueprints and show inherited access relationships.
These permissions are read-only. Agent Identities sit outside the Operations credential queue.
Data AppAlert stores
AppAlert stores application and enterprise application identifiers, display names, owner email addresses, credential types, expiry dates, and sync state. It also stores Application Proxy certificate metadata and supported agent identity inventory.
AppAlert stores alert settings and the notification record needed to show who was warned.
Owner email addresses provide renewal context and support optional owner routing. Organization administrators control that routing in Organization Settings.
Data AppAlert never receives
AppAlert never receives raw secret values, certificate private keys, Microsoft account passwords, or mailbox contents. The granted Microsoft Graph permissions do not allow AppAlert to create, rotate, or delete credentials.
For the full data inventory and storage boundary, read Data handling. For the complete permission list and revocation guidance, read the Trust permissions page.