What the Microsoft 365 permissions actually grant

The sync reads your tenant's subscribed licences and their renewal dates, directory users and their sign-in activity, Intune and Entra devices, Entra groups, app-registration and enterprise-app credentials, and MFA-registration and risk signals. The Security page also reads Secure Score, Conditional Access and security-defaults policy, and directory roles (for the Global Administrator count), and the AI Adoption report reads Microsoft 365 Copilot usage when you run it. None of it writes anything back. AssetSort cannot send mail as anyone and cannot access mailbox content, files or messages. There is one deliberate exception to "read-only": the Intune retire command you can choose to send when offboarding someone, for Microsoft 365 devices only they use. That's a real command and needs higher-privilege Intune permissions granted on the app registration and separately consented to by your tenant — until that happens the retire isn't sent (the offboarding still completes and says which devices it couldn't reach), and the read-only sync works exactly the same either way. No Microsoft 365 passwords or tokens are stored for your tenant; AssetSort's own app secret lives in Google Secret Manager, never in the application database. Every permission requested is listed for your Global Administrator on Microsoft's own consent screen before anything connects, so you're approving Microsoft's description of the access, not AssetSort's.