Sign-in permission
- User.Read
- Delegated permission used to sign you in and read the basic profile tied to your AppAlert account.
Organization inventory permissions
- Application.Read.All
- Reads applications, enterprise applications, credential metadata, and related directory objects needed for the expiry queue.
- Directory.Read.All
- Reads Application Proxy publishing metadata and application owners. Microsoft Graph does not currently expose both through the narrower application permission used by AppAlert.
Agent identity inventory permissions
- AgentIdentity.Read.All
- Reads agent identity inventory without changing it.
- AgentIdentityBlueprint.Read.All
- Reads agent identity blueprint definitions.
- AgentIdentityBlueprintPrincipal.Read.All
- Reads the principals connected to agent identity blueprints so AppAlert can show inherited access relationships.
Consent boundary
Microsoft grants the declared application permissions together through admin consent. AppAlert does not request Microsoft Graph write permissions and cannot create, rotate, or delete credentials in your organization.
A customer administrator can revoke the enterprise application consent in Microsoft Entra at any time. Revocation stops future directory reads.