> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/email-security/microsoft-365/permissions.md).

# Required permissions

The Microsoft permissions granted during the [setup](/email-security/microsoft-365.md). Stoïk uses them only to analyze emails and accounts, detect threats, and act quickly in the event of an incident.

| Permission                                                              | Usage                                                                                                                                                                                                         |
| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Read all audit log data                                                 | Allows reading all audit logs across the organization for investigation and monitoring.                                                                                                                       |
| Read audit logs data from all services                                  | Allows the app to read audit logs from all Microsoft 365 services for threat detection and compliance.                                                                                                        |
| Read and write mail in all mailboxes                                    | Grants full read/write access to mail across every user mailbox (used for scanning, remediation, or actions on malicious emails).                                                                             |
| Read and write all user mailbox settings                                | Allows modifying mailbox settings (inbox rules, signatures, forwarding…) for all users.                                                                                                                       |
| Read your organization’s conditional access policies                    | Lets the app read Conditional Access configuration for audit or analysis of security posture.                                                                                                                 |
| Read all usage reports                                                  | Allows accessing organization-wide usage and activity reports (M365 usage analytics).                                                                                                                         |
| Read metadata and detection details for all emails in your organization | Allows the app to access email metadata (headers, detections, threat indicators) without accessing message bodies.                                                                                            |
| Read all users’ full profiles                                           | Grants full read access to users’ directory profiles (name, job info, attributes…).                                                                                                                           |
| Read and write all users’ authentication methods                        | Allows modifying users’ authentication methods (MFA settings, phone, email…).                                                                                                                                 |
| Sign in and read user profiles                                          | Allows the app to sign in as a user and access basic profile data.                                                                                                                                            |
| Read and write all password profiles and reset user passwords           | Allows resetting or updating passwords for all users. Required for post-incident remediation.                                                                                                                 |
| Revoke all sign in sessions for a user                                  | Allows the app to immediately revoke all active user sessions. Used for immediate containment.                                                                                                                |
| Read activity data for your organization                                | Allows Stoïk to read activity feed events in Microsoft 365 to detect suspicious actions or anomalies related to user activity.                                                                                |
| Read and write all applications                                         | Allows the app to read and write all applications and service principals in the directory. Used to analyze configuration, identify anomalies, and remove malicious applications used to maintain persistence. |
| Read and write all devices                                              | Allows the app to read and write device objects in the directory. Used to detect device-code phishing attacks and track compromised devices.                                                                  |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/email-security/microsoft-365/permissions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.