What permissions does your MDR require?
To deliver our Managed Detection & Response (MDR) service, Attic Security requires a set of Microsoft API permissions in your tenant. These permissions allow our platform and analyst pipeline to read security signals from Microsoft 365, Microsoft Defender XDR and Microsoft Defender for Endpoint, and to perform a defined set of response and remediation actions on your behalf.
Our approach: least privilege
We follow the principle of least privilege. The vast majority of permissions we request are read-only and are used to gather context and run detections.
Write and action permissions are only requested where they are strictly necessary for a specific MDR function. These fall into three categories:
- Detection management — deploying and maintaining the custom detection rules behind your MDR coverage.
- Incident & alert management — updating classification, status and analyst comments during triage and response.
- Remediation actions — a defined set of containment and recovery actions our analysts (or our automated playbooks, with your approval) can take during an incident.
We do not request broad directory write, mailbox content access, or full tenant administrative rights.
Remediation actions we can take
The following remediation actions are explicitly supported and are mapped to the minimum permission required:
| Action | API | Permission |
|---|---|---|
| Isolate a device from the network | Defender for Endpoint | Machine.Isolate |
| Run an antivirus scan on a device | Defender for Endpoint | Machine.Scan |
| Revoke a user's active sign-in sessions | Microsoft Graph | User.RevokeSessions.All |
| Reset a user's password | Microsoft Graph | User.ReadWrite.All |
| Disable malicious inbox rules in a user mailbox | Microsoft Graph | MailboxSettings.ReadWrite |
| Disable malicious transport rules in the tenant | Exchange Online | Exchange.ManageAsApp + scoped Exchange admin role |
Permissions overview
Below is the full list of permissions requested by the Attic Security MDR application. All permissions are application permissions and require admin consent.
Microsoft Graph
| Permission | Type | Access | Description |
|---|---|---|---|
| AuditLog.Read.All | Application | Read | Read all audit log data |
| IdentityRiskEvent.Read.All | Application | Read | Read all identity risk event information |
| IdentityRiskyAgent.Read.All | Application | Read | Read all risky agents information |
| IdentityRiskyServicePrincipal.Read.All | Application | Read | Read all identity risky service principal information |
| IdentityRiskyUser.Read.All | Application | Read | Read all identity risky user information |
| MailboxSettings.ReadWrite | Application | Read/Write | Read and write mailbox settings (used to disable malicious inbox rules) |
| SecurityAlert.Read.All | Application | Read | Read all security alerts |
| SecurityEvents.Read.All | Application | Read | Read your organization's security events |
| SecurityIncident.ReadWrite.All | Application | Read/Write | Read and write to all security incidents (used to update classification, status and comments) |
| ThreatHunting.Read.All | Application | Read | Run hunting queries |
| User.ReadWrite.All | Application | Read/Write | Read all users' full profiles and reset user passwords |
| User.RevokeSessions.All | Application | Action | Revoke a user's active sign-in sessions |
| UserAuthenticationMethod.Read.All | Application | Read | Read all users' authentication methods |
Microsoft Threat Protection
| Permission | Type | Access | Description |
|---|---|---|---|
| AdvancedHunting.Read.All | Application | Read | Run advanced hunting queries |
| CustomDetections.ReadWrite.All | Application | Read/Write | Read and write all custom detection rules (used to deploy and tune MDR detections) |
| Incident.ReadWrite.All | Application | Read/Write | Read and write all incidents (used to update classification, status and comments) |
WindowsDefenderATP (Microsoft Defender for Endpoint)
| Permission | Type | Access | Description |
|---|---|---|---|
| AdvancedQuery.Read.All | Application | Read | Run advanced queries |
| Alert.ReadWrite.All | Application | Read/Write | Read and write all alerts (used to update alert status and comments alongside incidents) |
| Ip.Read.All | Application | Read | Read IP address profiles |
| Machine.Isolate | Application | Action | Isolate a device from the network |
| Machine.Read.All | Application | Read | Read all machine profiles |
| Machine.Scan | Application | Action | Run an antivirus scan on a device |
| RemediationTasks.Read.All | Application | Read | Read all remediation tasks |
| Ti.Read.All | Application | Read | Read all IOCs |
| Url.Read.All | Application | Read | Read URL profiles |
| User.Read.All | Application | Read | Read user profiles |
Office 365 Exchange Online
| Permission | Type | Access | Description |
|---|---|---|---|
| Exchange.ManageAsApp | Application | Action | Manage Exchange as Application (used, combined with a scoped Exchange admin role, to disable malicious transport rules) |
Summary
- All permissions are application permissions, requested as part of a single consent flow and visible at any time under Enterprise Applications in Entra ID.
- The majority are read-only, used to provide visibility into security signals and tenant context.
- Write and action permissions are scoped to specific MDR functions: detection management, incident/alert handling, and a defined set of remediation actions.
- We do not request access to mailbox or file content, broad directory write permissions, or unrestricted tenant administrative rights.
If you have questions about a specific permission, or want to review the consent before granting it, please reach out to your Attic Security contact.