Securenix · Technix IT AB

Permissions for the security scan

Securenix gives an overview of the security of an organisation's IT environment. The scan has two independent parts: a cloud scan of Microsoft 365 and an on-prem scan of servers and Active Directory.

Both parts are read-only. They collect settings and configuration, but make no changes and read no content in email, files, Teams or SharePoint.

Cloud scan – Microsoft 365

Access is granted when the organisation's Global Administrator approves the Securenix Scan app in Microsoft Entra ID. Before anything is approved, Microsoft shows exactly which permissions are requested. All of them are read permissions.

Permission	Used to read
RoleManagement.Read.Directory	Which administrator roles exist and how many people hold them.
Directory.Read.All	Basic details of users, groups and administrator accounts.
Organization.Read.All	Organisation details and which licences are in place.
SecurityEvents.Read.All	Microsoft Secure Score and recommended improvements.
Policy.Read.All	Settings for sign-in, MFA and Conditional Access.
AuditLog.Read.All	Sign-in activity and which accounts have MFA registered.
Domain.Read.All	The organisation's domains, to check email security (SPF, DKIM, DMARC).
DeviceManagementConfiguration.Read.All	Device security settings in Intune.
DeviceManagementManagedDevices.Read.All	Managed devices and whether they are compliant.
User.Read.All	User accounts, guest accounts and licensed accounts.
SharePointTenantSettings.Read.All	External sharing settings in SharePoint and OneDrive.

The organisation can remove the access at any time in the Microsoft Entra admin center under Enterprise applications → Securenix Scan.

On-prem scan – servers and Active Directory

The on-prem scan is a script that runs in the local environment. It reads the security configuration of Windows servers and Active Directory and sends the result, encrypted, to Securenix. Nothing is installed, no changes are made, and no passwords, files or documents are read.

Permission	Why it is needed
PowerShell run as administrator	Some security settings can only be read with elevated rights.
Local administrator on the servers being reviewed	To read the servers' security configuration.
Read access to Active Directory	To review password rules, accounts and privileged groups.
Network access to the servers (WinRM)	To review several servers from one computer.
Outbound HTTPS to Securenix	To send the result. No inbound connection is needed.

Personal data in Securenix Data processing annex