These permissions are granted on the Seculyze app registration in your Microsoft Entra tenant, through API permissions.
Required permissions
Seculyze needs both of the following Microsoft Graph application permissions, with admin consent granted:
Permission | What it is used for |
ThreatHunting.Read.All | Device counts and device changes, read from Defender XDR advanced hunting |
SecurityEvents.Read.All | Microsoft Secure Score and the security-posture findings |
Steps to enable
1. Open the app registration
In the Azure portal, go to Microsoft Entra ID → App registrations and open the app registration you created for Seculyze. Select API permissions in the left-hand menu.
Before you start, the app usually lists only the default User.Read permission.
The app registration name in your tenant will differ from the one shown here.
2. Add a permission
Select + Add a permission, then choose Microsoft Graph under Commonly used Microsoft APIs.
3. Choose Application permissions
When asked what type of permissions your application requires, select Application permissions.
4. Select the permissions
In the Select permissions search box, type SecurityEvent, expand SecurityEvents, and tick SecurityEvents.Read.All.
Then clear the search box, type ThreatHunting, expand ThreatHunting, and tick ThreatHunting.Read.All.
You can select both in the same visit. When both are ticked, select Add permissions at the bottom of the panel.
5. Grant admin consent
Back on the API permissions page, both permissions will now be listed with a Status of Not granted.
Select Grant admin consent for <your organization> and confirm. The Status column changes to a green Granted for <your organization>.
When you are done, the two permissions should be listed with Type Application and Status Granted:
6. Verify in Seculyze
Reload the monthly report page in Seculyze. If the warning about missing Microsoft Graph permissions is gone, the permissions are in place.
It may take up to an hour for these permissions to be properly acknowledged.