Skip to content
AccessLens
Permissions

04Access

Permissions

AccessLens follows the principle of least privilege. It requests read-only delegated permissions and never requests write access to your tenant.

Permissions we request

  • Policy.Read.AllTypeDelegatedPurposeRead Conditional Access policies
  • Directory.Read.AllTypeDelegatedPurposeRead user, group, and role information referenced in policies
  • Application.Read.AllTypeDelegatedPurposeResolve application names in policy assignments
  • RoleManagement.Read.DirectoryTypeDelegatedPurposeRead directory role definitions for gap analysis

What we never request

  • Policy.ReadWrite.All: AccessLens cannot create, modify, or delete policies
  • User.ReadWrite.All: AccessLens cannot modify user accounts
  • Application permissions: only delegated (on-behalf-of-user) permissions are used, never app-only background access

Admin consent

Depending on your tenant configuration, an administrator may need to grant consent for AccessLens to read Conditional Access policies. This is a one-time action.

If your organisation requires admin consent for all apps, the first user to sign in will see a “needs admin approval” message. An Entra admin can grant tenant-wide consent from:

Entra admin center path
Entra admin center → Identity → Applications → Enterprise applications → AccessLens → Permissions → Grant admin consent