What you are granting, and why

• The diagnostics read and never write. Every Microsoft Graph permission requested by a scan is a Microsoft read permission (the name ends in .Read.All or .Read.Directory).
• You are the controller. For the tenant and subscription data these tools read, you are the data controller and ITSailor acts as your data processor. The processing runs on your instruction, which you give by connecting your tenant or assigning the role. The spend scan of an accounting system is the exception: ITSailor is the controller for that read, as section 7 of the Privacy Policy explains, and keeps only the vendor summary, for ten minutes.
• Identities are digested before logging. Raw names, email addresses, and user principal names are replaced with a one-way digest before anything is written to our logs. The report shown to your administrator still carries real identities, because it is your own tenant and you need them to act.
• You can revoke at any time. Your administrator removes the grant directly with Microsoft, Google, Xero or Intuit, without us, and all further reads stop at once.

Reads directory, licence, and security posture to find dormant accounts, wasted licences, Shadow IT, and standing admin risk.

A Microsoft 365 tenant administrator approves the connection. Nothing below can change your tenant.

Reads the Workspace directory and per-user security state for the same dormant-account, licence, and Shadow IT audit.

A Google Workspace super administrator approves the connection. 1 of the 3 permissions below grants more than a read, marked Broader than read in the table, and each one says what it can do beyond reading.

Not yet available. The SaaS Auditor does not offer this connection today; the spend scan reads a CSV export you upload. When it is switched on, these are the permissions it asks for.

Reads spend bank transactions to list the software vendors your organisation pays, for the spend part of the same audit.

A Xero user with access to the organisation approves the connection. Nothing below can change your tenant.

Not yet available. The SaaS Auditor does not offer this connection today; the spend scan reads a CSV export you upload. When it is switched on, these are the permissions it asks for.

Reads purchase transactions to list the software vendors your organisation pays, for the spend part of the same audit.

A QuickBooks Online user who can connect apps to the company approves the connection. 1 of the 1 permissions below grants more than a read, marked Broader than read in the table, and each one says what it can do beyond reading.

Reads accounts, licences, last successful sign-in, the audit events that record when an account was disabled, delegated consents, app assignments, owned apps and groups, directory and PIM roles and Intune devices, to list what a leaver still holds. Read-only: no permission to change anything is requested.

An administrator who can approve apps for your tenant, such as a Cloud Application Administrator or a Privileged Role Administrator, approves the connection once. After that, a Global Reader signs in to run the check. Nothing below can change your tenant.

Reads Conditional Access, Security Defaults, the Global Administrator role, PIM eligibility, the user consent setting, licences and SharePoint sharing, to check the controls the scan can verify against the ITSailor Tenant Security Baseline.

A Microsoft 365 tenant administrator approves the connection. Nothing below can change your tenant.

Every party that receives personal data from ITSailor, condensed from the Privacy Policy. Most are sub-processors, acting on documented instruction. Some are not, and their rows open by saying so. The policy is the authoritative source and is updated first when this list changes.

The Cost Review for Azure requests no Microsoft Graph permissions. Not a narrow set: none. Access to an Azure subscription does not come from a consented API permission at all, it comes from an RBAC role assignment you make yourself in your own portal and can delete in one click, without telling us.

The role is the built-in Reader, which grants */read and nothing else.

We deliberately do not ask for Cost Management Reader, despite the name suggesting it is the read-only one for cost. Its action list contains the wildcard Microsoft.Support/*, which permits support-ticket creation. We ask for Reader because its action list is read only; a role's name is not proof of what it allows.

Sufficiency was settled by running every read path the collector needs as a principal holding Reader and nothing else, on 2026-08-15: budgets, Advisor, policy assignments, resources, Resource Graph and Cost Management all answered. The Cost Review for Azure never writes to your Azure.