# Permissions Required

When you run the permissions script during the installation process, you give the Microsoft Graph permissions below to a Managed Identity used by a Container App in the Managed Resource Group. 

<table><thead><tr><th width="217">Permission</th><th width="149.272705078125">Resource Name</th><th width="130">Type</th><th>Reason</th></tr></thead><tbody><tr><td>AuditLog.Read.All </td><td>collector </td><td>Application</td><td>Allows the app to read audit logs to monitor sign-ins and activities for security and compliance (read-only). </td></tr><tr><td>DeviceManagementManagedDevices.Read.All </td><td>collector </td><td>Application</td><td>Allows reading Intune-managed device inventory and status to support reporting and troubleshooting (read-only). </td></tr><tr><td>Directory.Read.All </td><td>collector </td><td>Application</td><td>Allows reading Azure AD directory data (users, groups, apps) to look up identities and relationships (read-only). </td></tr><tr><td>Domain.Read.All </td><td>collector </td><td>Application</td><td>Allows reading domain settings (read-only). </td></tr><tr><td>MailboxSettings.Read </td><td>collector </td><td>Application</td><td>Allows reading users’ mailbox settings (type; read-only; no mail access). </td></tr><tr><td>Policy.Read.All </td><td>collector </td><td>Application</td><td>Allows reading organization conditional access policies (read-only). </td></tr><tr><td>Synchronization.Read.All</td><td>collector </td><td>Application</td><td>Allows reading Azure AD synchronization information such as SCIM </td></tr><tr><td>DeviceManagementServiceConfig.Read.All</td><td>collector</td><td>Application</td><td>Allows reading Microsoft Intune service properties such as Autopilot info (read-only)</td></tr><tr><td>RoleEligibilitySchedule.Read.Directory</td><td>collector</td><td>Application</td><td>Allows reading all eligible role assignments and role schedules (read-only)</td></tr><tr><td>RoleAssignmentSchedule.Read.Directory</td><td>collector</td><td>Application</td><td>Allows reading all active role assignments and role schedules (read-only)</td></tr><tr><td>Directory.Read.All </td><td>updater </td><td>Application</td><td>Allows reading Azure AD directory data (users, groups, apps) to look up identities and relationships (read-only). </td></tr></tbody></table>

### &#x20;Permissions Bsure have in your environment:&#x20;

To monitor jobs and provide updates and new features the solution provider Bsure will be given contributor and owner access during installation to the Managed Resource Group inside the managed application.&#x20;