Permissions We Request
RunDEETS signs in through your organization's Microsoft Entra ID and asks for a small set of Microsoft Graph permissions to do that. This page lists exactly what we request and why — the same reasoning that lives as code comments next to where each permission is actually requested, not a separate justification written for this page.
Requested at Sign-In
These two are requested together, every time you sign in, because Microsoft Entra ID fails sign-in entirely for every user if any scope in the bundle needs admin consent that has not been granted yet — so only permissions safe to bundle into that all-or-nothing request live here.
User.ReadSign you in and read your basic profileThe standard scope behind signing in at all — your name and email, nothing more.
Sites.SelectedAccess the specific SharePoint site your organization grants us — nothing elseThe least-privilege option available for the SharePoint access this app needs, and the one we chose over the broader Sites.ReadWrite.All. Delegated Sites.Selected grants only the intersection of "this app was explicitly granted this one site" and "you already have access to it yourself" — it cannot see or touch any other site in your tenant.
Requested Only When Needed
These are requested separately, only at the moment a specific feature needs them — not bundled into sign-in, so a missing admin consent for one of these never blocks anyone from signing in at all.
OrganizationalBranding.Read.AllRead your organization's branding to prefill your logo in settingsRequested only when the Global Settings form wants to prefill your tenant logo — never bundled into sign-in, since an admin-consent-required scope has no business gating sign-in for a best-effort prefill. Narrower than Organization.Read.All, which would also expose your verified domains, licensing, and security defaults this app has no reason to read.
User.ReadBasic.AllLook up basic profile info for other people in your organizationRequested only when the role-assignment picker opens, so you can find and assign a colleague to a governance role. Narrower than User.Read.All, which would also expose full profile detail like job title and manager; this is capped to id, display name, and email.
Standard Sign-In Scopes
These three are requested automatically by MSAL, the Microsoft sign-in library this app is built on, on every sign-in — not something this app chose to add, and not specific to RunDEETS.
openidConfirm your identityThe standard OpenID Connect scope that identifies who you are.
profileView your basic profileThe standard OpenID Connect scope for basic profile fields like your display name.
offline_accessKeep you signed in without repeated promptsLets your session refresh silently in the background so you are not asked to sign in again every time a short-lived token expires.