Permissions Lemhi's application receives

The Microsoft permissions Lemhi's application is granted in each client tenant, what Lemhi reads, and quick answers for security reviewers.

Written By The Lemhi Product Team

Last updated 10 days ago

This is the reference to hand your security reviewer before you connect clients to Lemhi. It covers the Microsoft permissions Lemhi's application receives and what Lemhi does and never does with them. The GDAP roles you delegate are in GDAP roles Lemhi needs and why. For encryption, hosting, retention, and sign-in controls, see the full Lemhi Security and Privacy Overview.

Permissions Lemhi's application receives

Two consent events happen. First, every MSP user signs in with a basic grant. Second, your administrator accepts a scanning grant once through Partner Connect. Lemhi then applies that grant to each client tenant you import, using Microsoft's partner pre-consent mechanism and the GDAP roles. All permissions are delegated.

MSP sign-in (every Lemhi user)

Permission	What it enables
User.Read, openid, profile, email	Signs the MSP user in and identifies them. Standard Microsoft sign-in scopes.

Granted to every connected client tenant

Microsoft Graph

Permission	What it enables in Lemhi
User.Read.All	Employee roster: names, departments, licenses, managers.
Directory.Read.All	Groups, verified domains, and service principals used to scope the assessment.
Organization.Read.All	Tenant display name and domains.
Policy.Read.All	Conditional Access and authentication-method configuration.
Reports.Read.All	Aggregated activity counts for email, Teams, SharePoint, and OneDrive. No individual message or file.
SecurityEvents.Read.All	Defender alerts and incidents for the security posture view.
AuditLog.Read.All	Reserved for posture signals, included so a new consent round isn't needed later.
Sites.Read.All	SharePoint site metadata (sharing settings, labels applied to sites).
SharePointTenantSettings.Read.All	Tenant-level sharing and link-expiration policy.
SensitivityLabels.Read.All	Published label definitions. Can't create, apply, or read labeled content.
DelegatedAdminRelationship.Read.All	Lists the GDAP customers you manage, to validate client connections.

Other Microsoft services

Service and permission	What it enables in Lemhi
SharePoint Online: SitesMetadataAdmin.Read.All, TenantReports.Read.All	Per-site metadata and admin usage reports for the Data Governance dashboard.
Exchange Online: Exchange.Manage	Reads Exchange configuration (mail flow rules and related settings). See the note on write-named scopes below.
Defender for Endpoint: Machine.ReadWrite, Vulnerability.Read	Device inventory and unpatched vulnerability findings. See the note below.
Defender (Threat Protection): Incident.Read, AdvancedHunting.Read	Incident records and read-only hunting queries for deeper posture signals.
Azure Resource Manager: user_impersonation	Reads the Azure inventory of Copilot Studio and Azure AI resources for the AI agents view.
Dataverse: user_impersonation	Managed Agents: creates, publishes, and shares a Copilot agent in a client tenant when you ask Lemhi to.
Partner Center: user_impersonation	Records and removes Lemhi's consent for each client in Partner Center, on your behalf.

Granted only when an optional feature is turned on

These permissions are added to the grant only when the matching feature is enabled for your organization. If it's off, the permission isn't requested.

Feature	Permissions	What it enables
Client Configuration	Graph: CopilotPolicySettings.ReadWrite. SharePoint Online: AllSites.FullControl. Teams Tenant Admin API: user_impersonation	Lets your administrators apply Copilot policy, SharePoint site controls, and Teams meeting and calling settings to a client tenant from inside Lemhi. These are write permissions. Lemhi only uses them when an MSP administrator applies a specific change.
Shadow AI sources	Graph: DeviceManagementManagedDevices.Read.All. Defender for Cloud Apps: discovery.read	Finds AI apps installed on Intune-managed devices and AI services seen in Cloud Discovery traffic. Read-only.

A note on write-named scopes

Two baseline permissions have names that suggest write access: Exchange.Manage and Machine.ReadWrite. Microsoft doesn't publish narrower read-only versions for these endpoints. Lemhi calls no write operations through either one.

Lemhi writes into a client tenant in exactly two places, and both run only when your administrator takes the action:

Managed Agents (Dataverse). Lemhi creates and publishes the Copilot agents you build in Lemhi, and nothing else.
Client Configuration, when enabled. Lemhi applies the specific setting change your administrator chose.

Every assessment and scan is read-only.

What Lemhi reads, and what it never reads

Reads: identity and directory data, licensing, configuration and policy definitions, security posture signals, an inventory of existing Copilot and AI agents, and Microsoft's pre-summarized usage reports.

Never reads:

Email contents or previews
SharePoint or OneDrive file contents
Teams chat or channel messages
Calendar details
OneNote, Planner, or Tasks contents
The messages or files behind a DLP or retention match (Lemhi sees that the policy exists, not what it flagged)

Lemhi doesn't subscribe to push notifications of user activity. It reads on demand or on a scheduled scan.

Audit and revocation

Auditable. Lemhi's calls run as your delegated administrator through the GDAP relationship, so they show up in the client's Microsoft 365 audit logs.
Revocable by the client. The client can end the partner relationship at any time: Microsoft 365 admin center > Settings > Partner relationships.
Revocable by you. Disconnect a client in Lemhi to remove Lemhi's consent in that tenant, keeping prior assessment results. Remove Lemhi's consent in your own Entra ID, or disconnect Partner Connect in Lemhi, to cut off every client at once. Disconnecting Partner Connect also deletes the stored refresh credentials behind it.

See Disconnect a client or revoke Lemhi's access for each route.

Quick answers for reviewers

Question	Answer
Does Lemhi need Global Administrator?	No. It needs Cloud Application Administrator, plus five more roles for full coverage (listed in GDAP roles Lemhi needs and why).
Does the client grant Lemhi an admin role?	No. The client approves your GDAP request. Lemhi works through your relationship.
Is it read-only?	Every assessment and scan is. Writes happen only through Managed Agents and, if enabled, Client Configuration, and only when your administrator acts.
Does Lemhi read email, files, chats, or calendars?	No.
Can our existing billing-only GDAP relationship be used?	No. Microsoft doesn't let roles be added to an existing relationship. Create a second relationship with the six roles; the billing one is unaffected.
Do we need to be the client's reseller?	No. GDAP alone is enough.
Where is the data hosted?	Microsoft Azure, United States. Encrypted at rest (AES-256) and in transit (TLS 1.2).
Compliance certifications?	Lemhi is working through its SOC 2 audit in Q1 2027.

This describes Lemhi's permissions as of September 2026, for informational purposes; it is not a contractual commitment.

Was this helpful?

Still need help? Ask the team

Permissions Lemhi's application receives

MSP sign-in (every Lemhi user)

Granted to every connected client tenant

Granted only when an optional feature is turned on

A note on write-named scopes

What Lemhi reads, and what it never reads

Audit and revocation

Quick answers for reviewers

Related