Approval & Settings
🛡️ You need Admin rights for this. Anyone can view the page.
Before Clarios can show you anything, it needs your one-time approval to read data from your Microsoft 365 environment. There are two levels:
- Read app: Clarios may read devices, users and domains. This is the basis for every dashboard.
- Write app: Clarios may also do something, e.g. fix a security issue. Optional.
You give both under Settings (bottom of the menu).
Give approval
- Sign in as an administrator.
- Open Settings at the bottom of the menu.
- On the Read app tile, click Grant read access.
- You land at Microsoft. Check the list briefly and click Accept.
- You come back to Clarios. The tile turns green (Consented), and the dashboards fill up over the next while.
- Optional: on the Write app tile, click Enable write mode to allow changes.
✅ Done. Clarios is approved and the data is coming in.
🖼️ Screenshot: The Microsoft “Permissions requested” dialog with “Accept for your organization” (the one-time approval) for the Clarios Read app.
Target file:
assets/getting-started/admin-consent.png
Understanding the status
The Settings page shows three tiles with a coloured marker:
- Consented (green): all good.
- Partial (orange): approved, but a few permissions are still missing (see the Missing permissions tile).
- Drift detected (red): Clarios lost access. Click Re-grant to renew the approval.
- Not consented (grey): not approved yet.
🖼️ Screenshot: The Settings page with the three tiles Read app (green), Write app and Missing permissions. ~1440 px wide, light theme.
Target file:
assets/getting-started/settings-overview.png
Good to know
- Missing permissions lists what’s missing per area. Click Re-consent Read app or Re-consent Write app to catch up.
- Without approval the dashboards stay empty. That’s not a fault, just the missing first step.
Which permissions does Clarios request, and why?
Clarios reads your Microsoft 365 data read-only through the Read app. Microsoft shows you the exact list when you approve. Here it is grouped by purpose so you can see what each area is for.
| Area | What Clarios reads | What it is used for |
|---|---|---|
| Users & directory | Directory, users, groups, organization, administrative units, basic cross-tenant info | Who is in the tenant, sign-in analysis, organization details |
| Devices | Devices, Intune configuration and managed devices, device roles and service config, BitLocker and LAPS keys | Device inventory and recovery keys |
| Policies & security posture | Policies, Conditional Access, directory recommendations, identity risk events, Privileged Access (PIM), role assignments and eligibility | The core CIS and EIDSCA security checks |
| Reports & settings | Reports and report settings, organization settings for Apps & Services and for Forms, SharePoint tenant settings, entitlement management, on-premises directory sync, authentication methods, audit logs, app registrations, domains | Configuration and usage checks |
| Exchange & Purview | Exchange Online and Security & Compliance configuration | The Exchange and Purview checks |
| Microsoft Teams | The “Teams Reader” directory role | The Teams checks |
| Microsoft Defender (optional) | Defender for Identity (sensors and health) and Advanced Hunting | Defender checks, only where the product is licensed |
Everything above is read-only. The optional Write app is separate and only adds the ability to fix issues (remediation); the checks themselves never need it.
💡 New permissions? As we extend the checks (most recently Microsoft Teams, Microsoft Defender, and a few configuration-read permissions for Apps & Services, Forms and reports), the Missing permissions tile turns orange and you re-approve the Read app once. Microsoft Teams additionally needs the one-time “Enable Teams checks” button on the Security Insights page, which grants the Read app the read-only “Teams Reader” role.
Full technical list (for auditors)
Microsoft Graph (application, read-only): AuditLog.Read.All, Application.Read.All, Directory.Read.All, Organization.Read.All, AdministrativeUnit.Read.All, Group.Read.All, User.Read.All, CrossTenantInformation.ReadBasic.All, ExternalUserProfile.Read.All, Domain.Read.All, Device.Read.All, DeviceManagementConfiguration.Read.All, DeviceManagementManagedDevices.Read.All, DeviceManagementRBAC.Read.All, DeviceManagementServiceConfig.Read.All, DeviceLocalCredential.Read.All, BitlockerKey.Read.All, Policy.Read.All, Policy.Read.ConditionalAccess, DirectoryRecommendations.Read.All, IdentityRiskEvent.Read.All, PrivilegedAccess.Read.AzureAD, RoleManagement.Read.All, RoleEligibilitySchedule.Read.Directory, Reports.Read.All, ReportSettings.Read.All, OrgSettings-AppsAndServices.Read.All, OrgSettings-Forms.Read.All, SharePointTenantSettings.Read.All, EntitlementManagement.Read.All, OnPremDirectorySynchronization.Read.All, UserAuthenticationMethod.Read.All, SecurityIdentitiesHealth.Read.All, SecurityIdentitiesSensors.Read.All, ThreatHunting.Read.All.
Office 365 Exchange Online: Exchange.ManageAsApp (used for both the Exchange Online and the Security & Compliance checks).
Microsoft Entra directory role: Teams Reader (read-only, for the Teams checks).
The most recent additions are the seven configuration-read Graph permissions (DeviceManagementRBAC, DeviceManagementServiceConfig, EntitlementManagement, OnPremDirectorySynchronization, OrgSettings-AppsAndServices, OrgSettings-Forms, ReportSettings), the three Microsoft Defender permissions (SecurityIdentitiesHealth, SecurityIdentitiesSensors, ThreatHunting), and the Teams Reader role.
What’s next?
- Who can do what?: the permission levels.
- Admin Panel: switch areas on once approval is in place.