Return
-
Title
What are the needed permissions to collect from O365? -
Description
When collecting from the Cloud what are the needed permissions for each discovery:- Exchange Online
- Teams
- One Drive
- Azure Active Directory
- Azure Resource
-
Cause
Azure AD:
Tenant error- One or more errors occurred
Risky users collection- “Access denied. Possible use of unlicensed API. Risky Users requires an Azure AD Premium P2 license. Risky Users cannot be collected using MFA Credentials.”
Exchange Online:Office365 Exchange Error:The term 'Get-MailUser' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.The term 'Get-MailContact' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.The term 'Get-DynamicDistributionGroup' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.The term 'Get-UnifiedGroup' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.A parameter cannot be found that matches parameter name 'PublicFolder'.The term 'Get-PublicFolder' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.Teams:Error collecting object.StatusCode: 403, ReasonPhrase: 'Forbidden', Version: 1.1, Content: System.Net.Http.StreamContent, Headers: -
Resolution
The following are the required permissions for each of the different cloud collectors.
NOTE: These permissions have been confirmed correct at the time of writing, however Microsoft does change these roles and permissions from time to time.Exchange Online:
- Global Reader role (Azure) + Security Reader (Office 365 Admin > Roles > Roles Assignment > Exchange) + Recipient Management (also in Exchange) - if discovery account had all these roles, all options in discovery are collected
- Global Reader only - all options except "Mailbox Delegates" are collected
- Global Reader + Security Reader - Collects "Mailbox Delegates" only
- Global Admin - all discovery options work
MS Teams:
- A user having an Office 365 license and access to the Teams being discovered (either as a member or owner) is sufficient to collect all options in a discovery
- NOTE: The discovery doesn't show errors if the user does not have access, it just does not collect any data, while log files contain 403-forbidden error messages.
One Drive:
- A user with an Office 365 license and access to folders being discovered is sufficient to collect all options in discovery
Azure Resource:
- A user with the Reader role (which is different from Global Reader) for a subscription is sufficient to collect all options selected in the discovery. The role could be assigned by selecting Subscriptions -> <Name Of Subscription> -> Access Control (IAM) -> Add Role Assignments
- Global Admin works as well
Azure Active Directory:
- Global Reader role and Report Reader role work just as well as Global Admin. If you encounter errors when the options for 'Groups', 'Roles', 'Devices', 'Collect Users flagged for risk' are selected, the following additional steps may be needed:
- Install the Powershell module for Azure AD using the following commands in the Powershell command line (as Admnistrator) -
- Install-Module -Name AzureAD
- Install-Module MsolService
- If the subscription is not Azure Active Directory premium P2 license, some data is not available to be collected as it is only available in the P2 license.
- Install the Powershell module for Azure AD using the following commands in the Powershell command line (as Admnistrator) -