Overview
High-level overview
This document specifies the exact permissions required for each service principal PAA uses. Granting more than the listed permissions is unnecessary. Granting less will cause partial or complete scan failures.
Overview
PAA uses two service principals, each scoped to a different Microsoft system:
| Service Principal | System | Used For |
|---|---|---|
| Azure SP | Azure Resource Manager | Health Checks, Drift Detection, Cost Intelligence, RBAC Audit |
| Microsoft 365 SP | Microsoft Graph API | Zero Trust Assessment, M365 Security, Identity Security Scanning |
These are separate App Registrations. A single service principal cannot be used for both purposes.
Summary Reference
| Service Principal | Location | Roles / Permissions |
|---|---|---|
| Azure SP | Azure RBAC | Reader, Security Reader (per subscription, core) + Cost Management Reader (Cost Intelligence) + Monitoring Reader (optional, capacity) |
| M365 SP | Microsoft Graph App Permissions (certificate auth) | Read: Directory.Read.All, Policy.Read.All, RoleManagement.Read.Directory, AccessReview.Read.All, DelegatedAdminRelationship.Read.All, DelegatedPermissionGrant.Read.All, IdentityRiskyUser.Read.All, AuditLog.Read.All, DeviceManagementManagedDevices.Read.All, DeviceManagementConfiguration.Read.All, DeviceManagementApps.Read.All, SecurityEvents.Read.All, SecurityIncident.Read.All, SharePointTenantSettings.Read.All, NetworkAccess.Read.All (Global Secure Access / Zero Trust Network pillar — requires GSA licensing; checks degrade to Manual review if absent). Optional read: Reports.Read.All (assigned-but-inactive M365 license detection). Self-scoped write: Application.ReadWrite.OwnedBy. Plus Exchange.ManageAsApp (Exchange Online) and the Global Reader directory role. Power BI/Fabric checks (CIS Section 9) additionally require Tenant.Read.All granted in the Power BI service (not a Graph app permission; optional — skipped if absent). |
| GitHub App | GitHub Repository Permissions | Contents: Read and write, Metadata: Read |
The M365 service principal authenticates with a certificate that PAA generates and rotates in its Key Vault. The client secret you supply during onboarding is temporary — PAA uses it once to provision the certificate, then discards it.
Application.ReadWrite.OwnedByis self-scoped: it lets PAA manage only its own certificate credential and no other app registration. See M365 Service Principal for detail.
PAA connects from a stable, published egress IP. If you enforce Conditional Access location or IP restrictions, allowlist it for the M365 app registration — see M365 Service Principal.
Troubleshooting
Health Check returns no results or fails immediately
Verify the Azure service principal has Reader on the target subscription. Check that the Tenant ID, Client ID, and Client Secret in Settings > Azure are correct. Use Test Connection to confirm authentication succeeds before running a scan.
Cost Intelligence shows no data
Confirm Cost Management Reader is assigned on the subscription. Some subscription types (Free, Dev/Test) do not support the Cost Management API — this is an Azure limitation and cannot be resolved by adding permissions.
M365 Security or Zero Trust scan shows partial results
Open Settings > Microsoft 365 > Validate & Test Connection. The validation response lists which required permissions are missing. Grant the missing permissions and re-run admin consent. Some checks require Entra ID P2 (AccessReview.Read.All, IdentityRiskyUser.Read.All) and report Manual review rather than failing when P2 is absent.
Guest user stale sign-in detection shows no data
AuditLog.Read.All is missing or admin consent was not granted for it. This permission requires Global Administrator or Privileged Role Administrator to consent.
GitHub sync fails with 403
The GitHub App installation does not have write access to the target repository. Confirm Contents: Read and write is granted in the App’s repository permissions for that specific installation.
Platform Architecture Authority — Crimson Owl Technologies Last updated: June 2026
