Cloud Security Center Permissions
Apart from granting the Cloud Security Center application Reader permissions on the monitored subscriptions, some packs within Cloud Security Center require specific permissions to function correctly. Below is a list of the required permissions:
General
| Source |
Permission Name |
Description |
| Microsoft Graph |
CustomDetection.ReadWrite.All |
To manage custom detection rules |
| Log Analytics API |
Data.Read |
To read Log Analytics data |
| Microsoft Graph |
SecurityAlert.Read.All |
To read security alerts |
| Microsoft Graph |
SecurityEvents.Read.All |
To read security events |
| Microsoft Graph |
SecurityIncident.ReadWrite.All |
To read and update security incidents |
| Microsoft Graph |
User.ReadWrite.All |
To read users and their group memberships and disable accounts if necessary |
| WindowsDefenderATP |
Ti.ReadWrite.All |
Read and update Threat Intelligence records |
Workplace Protection
| Source |
Permission Name |
Description |
| MicrosoftThreatProtection |
AdvancedHunting.Read.All |
Used to read the results of a query that retrieves all desktop, laptop and mobile devices |
| Microsoft Graph |
GroupMember.Read.All |
Read the members of a configured VIP or Scoped Identity user group |
| Microsoft Graph |
IdentityRiskEvent.Read.All |
To read risk detections |
| Microsoft Graph |
IdentityRiskyUser.ReadWrite.All |
To read and update risky user identities |
| Microsoft Graph |
MailboxSettings.ReadWrite |
To verify and update mailbox rules |
| Microsoft Graph |
Mail.ReadWrite |
To scan and protect you from malicious emails |
| WindowsDefenderATP |
Machine.Isolate |
To isolate machines |
| WindowsDefenderATP |
Machine.Scan |
To scan machines |
| Microsoft Graph |
Reports.Read.All |
Used to retrieve the Office 365 and Exchange licenses |
| Microsoft Graph |
ThreatHunting.Read.All |
To read threat hunting data |
| Microsoft Graph |
User.RevokeSessions.All |
To revoke user sessions |
Infrastructure Protection
Infrastructure Protection does not require consent on any API permissions. Instead it relies on Reader permissions being granted to the Cloud Security Center application on the monitored subscriptions.
End-of-sale
End-of-sale
The following packs are no longer available for new customers and are now combined into Workplace Protection. For existing customers, these packs will continue to function as before.
Data & Apps Protection
| Source |
Permission Name |
Description |
| Microsoft Graph |
Reports.Read.All |
Used to retrieve the Office 365 and Exchange licenses |
Endpoint Protection
| Source |
Permission Name |
Description |
| MicrosoftThreatProtection |
AdvancedHunting.Read.All |
Used to read the results of a query that retrieves all desktop, laptop and mobile devices |
| WindowsDefenderATP |
Machine.Isolate |
To isolate machines |
| WindowsDefenderATP |
Machine.Scan |
To scan machines |
| Microsoft Graph |
ThreatHunting.Read.All |
To read threat hunting data |
Identity Protection
| Source |
Permission Name |
Description |
| Microsoft Graph |
GroupMember.Read.All |
Read the members of a configured VIP or Scoped Identity user group |
| Microsoft Graph |
IdentityRiskEvent.Read.All |
To read risk detections |
| Microsoft Graph |
IdentityRiskyUser.ReadWrite.All |
To read and update risky user identities |
| Microsoft Graph |
MailboxSettings.ReadWrite |
To verify and update mailbox rules |
| Microsoft Graph |
Mail.ReadWrite |
To scan and protect you from malicious emails |
| Microsoft Graph |
User.RevokeSessions.All |
To revoke user sessions |