No Microsoft passwords, ever
PosturaIQ authenticates to Microsoft through application consent. It never asks for, transmits, or stores a Microsoft user password, and it never requires a standing global administrator session.
Security & trust
A security product has to hold itself to its own standard.
How PosturaIQ handles Microsoft credentials, tenant isolation, least privilege, auditability, and honest reporting of what the platform has and has not done.
Sign in with your own Microsoft account
Customers sign in to PosturaIQ with their own Microsoft 365 work account, so your organization's MFA and Conditional Access policies apply to every sign-in. PosturaIQ stores no customer passwords.
Least privilege by default
Assessment access collects configuration evidence and never modifies your security configuration. Some evidence-collection permissions carry ReadWrite names because that is the only form Microsoft offers for those APIs; write permission to change configuration is a separate, explicit consent an organization may decline permanently.
Credentials never reach the browser
Microsoft credentials, tokens, and secrets are held on the backend only. No client-side code path can read them, and platform administration screens never display them.
Strict organizational isolation
Every read and write is scoped to the caller's organization on the server. Organization identifiers supplied by the browser are treated as selection hints and validated against membership before use.
Tenant connection isolation
An organization can hold more than one Microsoft tenant connection. Each connection's data — assessments, findings, remediation, license inventory, and reports — is isolated from every other connection. Every request is re-validated on the server against the specific tenant connection being accessed, not organization membership alone, and an assessment can only run against the tenant connection explicitly selected.
Authorization is server-side
Roles, entitlements, and platform administration privileges are resolved on the backend. The UI hides what a user cannot do; the backend is what actually enforces it.
Everything security-relevant is audited
Permission grants, assessment runs, remediation approvals and executions, entitlement changes, and administrative access are recorded as immutable audit events.
Separation of platform and customer
PosturaIQ platform administration is a distinct authorization domain. Being an administrator inside a customer organization grants no platform privileges, and platform staff access is itself audited.
Honest state reporting
PosturaIQ distinguishes between recommended, approved, executed, and validated. It will report that an operation is unavailable rather than imply an action it did not perform.
Assessment permissions
Permissions used to collect configuration and security evidence.
Permissions used by the PosturaIQ assessment engine to securely collect configuration and security evidence from your Microsoft 365 tenant.
PosturaIQ assessment access is designed for evidence collection. Assessment permissions do not allow PosturaIQ to automatically remediate or change your Microsoft 365 security configuration.
PosturaIQ never receives or stores your Microsoft administrator credentials — authorization uses OAuth and all Microsoft 365 communication happens server-side. Some Microsoft permission names include ReadWrite or FullControl even where PosturaIQ only reads configuration or manages its own assessment records. See the sections above for the full credential-handling and least-privilege model.
Microsoft 365 assessment access
Read permissions used to evaluate identity, security, licensing, SharePoint, Exchange, Teams, Defender, and other Microsoft 365 configuration.
Policy.Read.All
Read Microsoft Entra policies, including configuration used by Conditional Access and authentication-related controls.
SecurityEvents.Read.All
Read Microsoft security posture information used by PosturaIQ, including Microsoft Secure Score and Secure Score control profiles.
User.Read.All
Read user accounts and security-relevant user properties required by assessment controls.
GroupMember.Read.All
Read group membership used to evaluate privileged access and policy scoping.
Domain.Read.All
Read verified domains and domain configuration required by assessment controls.
LicenseAssignment.Read.All
Read license assignments used to determine control applicability and assessment coverage.
RoleManagement.Read.Directory
Read Microsoft Entra role definitions and administrative role assignments.
PrivilegedAssignmentSchedule.Read.AzureADGroup
Read privileged assignment schedules used by privileged-access assessment controls.
PrivilegedEligibilitySchedule.Read.AzureADGroup
Read privileged eligibility schedules used by privileged-access assessment controls.
SharePointTenantSettings.Read.All
Read Microsoft Graph-exposed SharePoint and OneDrive tenant configuration used by the SharePoint assessment collector.
Organization.Read.All
Read tenant-level organization configuration and configuration evidence required by supported assessment collectors, including Microsoft configuration snapshot collection.
Exchange Online assessment access
Exchange.ManageAsApp (Office 365 Exchange Online)
Allows PosturaIQ to authenticate to Exchange Online PowerShell for supported read-only configuration collection. PosturaIQ uses Exchange RBAC to restrict Assessment Access to the Exchange configuration required by supported assessment controls.
When Extended Access is enabled, PosturaIQ Assessment Access is added to Exchange Online's built-in View-Only Organization Management role group (View-Only Configuration and View-Only Recipients). It is never assigned Exchange Administrator or Global Administrator.
Exchange.ManageAsApp (Microsoft Exchange Online Protection)
Allows PosturaIQ to connect to Microsoft Purview (Security & Compliance) PowerShell for read-only compliance configuration collection.
SharePoint Online assessment access
Sites.FullControl.All
Microsoft requires this permission for applications to read SharePoint Online tenant administration settings (such as external sharing and access-control configuration). PosturaIQ uses it only to read tenant-level settings. It does not modify sites, content, or sharing configuration.
Microsoft Defender assessment access
PosturaIQ uses Microsoft Graph security APIs to collect supported Microsoft Defender and security-posture evidence.
SecurityEvents.Read.All
Read Microsoft security posture information used by the Defender assessment, including Microsoft Secure Score and Secure Score control profiles.
Additional read-only Microsoft Defender permissions may be required as Defender assessment coverage expands. PosturaIQ requests only the permissions required by supported assessment collectors.
Extended Access (optional)
Security Reader (Microsoft Entra role)
Read-only role assigned to PosturaIQ Assessment Access. Used for Microsoft Purview and Defender for Office 365 configuration evidence.
View-Only Organization Management (Exchange Online role group)
Read-only Exchange Online configuration and recipient access.
Temporary Exchange Administrator (setup only)
Assigned to the separate PosturaIQ Extended Access Setup app only to configure the read-only access above, then explicitly removed once setup completes. In tenants with Microsoft Entra ID P2, this is a time-boxed activation capped at 20 minutes; in tenants without P2, PosturaIQ removes it immediately rather than relying on automatic expiry. Never assigned to Assessment Access.
Prepares upcoming Power BI coverage (Fabric read-only admin APIs)
Fabric setting 'Service principals can access read-only admin APIs', enabled only for the 'PosturaIQ Fabric Read' group. Read-only access to Power BI tenant settings.
Power Platform management application
Registration Microsoft requires to read Power Platform environments, tenant settings and data policies. Microsoft grants it administrative rights; PosturaIQ only reads.
Disconnecting Microsoft 365 removes all PosturaIQ applications and role assignments from your tenant.
Microsoft configuration snapshots
ConfigurationMonitoring.ReadWrite.All
Allows PosturaIQ to create and manage Microsoft configuration snapshot artifacts used to capture point-in-time assessment evidence. This permission allows PosturaIQ to manage Microsoft configuration snapshot objects. It does not grant PosturaIQ permission to modify Microsoft Teams policies or other Microsoft 365 security settings.
Some Microsoft workloads use Microsoft's Unified Tenant Configuration Management service to collect configuration evidence. Initial setup may require Microsoft's Tenant Configuration Management service principal to be assigned the Global Reader role in the customer tenant. The organization's Microsoft Entra security or PIM policies may generate a notification when this role is assigned.
This Global Reader role is assigned to Microsoft's Tenant Configuration Management service principal — not to the PosturaIQ Assessment Access application.
Start with a clear posture baseline.
Create your workspace, connect Microsoft 365 and see where your posture stands. Foundation is free for organizations with up to 500 eligible licensed users.