Cohesity Alta SaaS Protection Administrator's Guide

Microsoft Graph

Group.Read.All

Read all groups

Allows the app to read group properties and memberships, and read conversations for all groups, without a signed-in user.

Used to read group information

User.Read.All

Read all users' full profiles

Allows the app to read user profiles without a signed-in user.

Used to read user profile details during backup.

Application.ReadWrite.All

Read and write all applications

Allows the app to create, read, update and delete applications and service principals without a signed-in user. Does not allow management of consent grants.

Used to read application settings and to get Token issuance policies and token lifetime policies during backup.

Directory.ReadAll

Read directory data

Allows the app to read all directory data.

Used to read directory data, including user, group, and app information.

Policy.Read.All

Read your organization's policies

Allows the app to read your organization's policies.

Used to read organizational policies during backup.

Microsoft Graph

Directory.ReadWrite.All

Read and write directory data.

Allows the app to read and write data in your organization's directory, such as users, and groups, without a signed-in user. Does not allow user or group deletion.

To restore directory data, including user and group.

User.ReadWrite.All

Read and write all users' full profiles.

Allows the app to read and write user profiles without a signed-in user.

To restore user profile details during recovery workflows.

Group.ReadWrite.All

Read and write all groups.

Allows the app to create groups, read all group properties and memberships, update group properties and memberships, and delete groups. Also allows the app to read and write conversations. All of these operations can be performed by the app without a signed-in user.

To restore groups, group properties and memberships for groups.

Application.ReadWrite.All

Read and write all applications.

Allows the app to create, read, update and delete applications and service principals without a signed-in user. Does not allow management of consent grants.

To create & restore the application registration during recovery processes.

GroupMember.ReadWrite.All

Read and write all group memberships.

Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted.

To update & restore the group membership.

Device.ReadWrite.All

Read and write devices

Allows the app to read and write all device properties without a signed in user. Does not allow device creation, device deletion or update of device alternative security identifiers.

To add group members of Device type during recovery processes.

OrgContact.Read.All

Read organizational contacts.

Allows the app to read all organizational contacts without a signed-in user. These contacts are managed by the organization and are different from a user's personal contacts.

To read the organizational contacts during recovery workflows.

AppRoleAssignment.ReadWrite.All

Manage app permission grants and app role assignments.

Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.

To manage app roles and permission grants during recovery operations.

RoleManagement.ReadWrite.Directory

Read and write all directory RBAC settings.

Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, without a signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.

To restore RBAC settings during recovery workflows.

Policy.ReadWrite.ApplicationConfiguration

Read and write your organization's application configuration policies.

Allows the app to read and write your organization's application configuration policies, without a signed-in user.

To restore application configuration policies during recovery processes.