# Why do we need permissions in your tenant?

For Scappman to create applications in your Microsoft Endpoint Manager/lntune tenant and use all our logic we need some permissions in your tenant. 

Those permissions and why we need them are described in this table.

<table data-header-hidden><thead><tr><th width="275"></th><th width="119.33333333333331"></th><th></th></tr></thead><tbody><tr><td>Permissions</td><td>Type</td><td>Why?</td></tr><tr><td>Sign in and read user profile</td><td>Delegated</td><td><p>We use your existing Azure AD account to authenticate you and identify which tenant you belong to, without this permission you would not be able to sign in.</p><p><br>Allows users to sign-in to the app, and allows the app to read the profile of signed-in users.</p></td></tr><tr><td>Maintain access to data you have given it access to</td><td>Delegated</td><td><p>The token providing us access to Sign in and read your user profile might expire while your session on our platform hasn't.</p><p></p><p>To seamlessly refresh that token, this permission is required.</p><p><a href="https://learn.microsoft.com/en-us/azure/active-directory/develop/permissions-consent-overview">https://learn.microsoft.com/en-us/azure/active-directory/develop/permissions-consent-overview</a><br></p><p>This does not give the app any additional permissions.​</p></td></tr><tr><td>Read and write Microsoft Intune apps</td><td>Application</td><td>We need this permission to create and update apps in your tenant.</td></tr><tr><td>Read &#x26; write Microsoft Intune devices</td><td>Application</td><td><p>We need this permission for our reports.</p><p></p><p>We use it to identify the device installation status and also to initiate the automatic log file collection in case an installation has failed.</p></td></tr><tr><td>Read &#x26; write all groups</td><td>Application</td><td><p>We need this permission for the assignments of the applications. </p><p></p><p>The read permission is used to list your Azure AD groups that you can use to assign applications. </p><p></p><p>The write permission is used when you select specific users. lntune doesn't support assigning applications to named users, so we create a group, populate that group with the users you've selected and assign that group to the application. </p><p></p><p>This permissions can be removed but then the user assignment is not possible.</p></td></tr><tr><td>Read all groups</td><td>Application</td><td><p>We need this permission for the assignments of the applications. </p><p></p><p>The read permission is used to list your Azure AD groups that you can use to assign applications.</p></td></tr><tr><td>Read organization information</td><td>Application</td><td><p>With this permission we can read how many Microsoft licenses you have with an lntune entitlement that are assigned to users/devices. </p><p></p><p>We'll use that number for billing purposes.</p></td></tr><tr><td>Read all users' full profiles</td><td>Application</td><td><p>We use this permission to list users in Scappman. </p><p></p><p>This is being used for user based application assignment and admin invite.</p></td></tr><tr><td>Read directory data</td><td>Application</td><td><p>We need this permissions to see the available users and groups to assign them to applications. </p><p></p><p>We also need this permission to calculate the number of licenses.</p></td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://support.scappman.com/permissions/app-registration/why-do-we-need-permissions-in-your-tenant.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.