> For the complete documentation index, see [llms.txt](https://support.scappman.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.scappman.com/permissions/app-registration/why-do-we-need-permissions-in-your-tenant.md).

# Why do we need permissions in your tenant?

For Scappman to create applications in your Microsoft Endpoint Manager/lntune tenant and use all our logic we need some permissions in your tenant. 

Those permissions and why we need them are described in this table.

<table data-header-hidden><thead><tr><th width="275"></th><th width="119.33333333333331"></th><th></th></tr></thead><tbody><tr><td>Permissions</td><td>Type</td><td>Why?</td></tr><tr><td>Sign in and read user profile</td><td>Delegated</td><td><p>We use your existing Azure AD account to authenticate you and identify which tenant you belong to, without this permission you would not be able to sign in.</p><p><br>Allows users to sign-in to the app, and allows the app to read the profile of signed-in users.</p></td></tr><tr><td>Maintain access to data you have given it access to</td><td>Delegated</td><td><p>The token providing us access to Sign in and read your user profile might expire while your session on our platform hasn't.</p><p></p><p>To seamlessly refresh that token, this permission is required.</p><p><a href="https://learn.microsoft.com/en-us/azure/active-directory/develop/permissions-consent-overview">https://learn.microsoft.com/en-us/azure/active-directory/develop/permissions-consent-overview</a><br></p><p>This does not give the app any additional permissions.​</p></td></tr><tr><td>Read and write Microsoft Intune apps</td><td>Application</td><td>We need this permission to create and update apps in your tenant.</td></tr><tr><td>Read &#x26; write Microsoft Intune devices</td><td>Application</td><td><p>We need this permission for our reports.</p><p></p><p>We use it to identify the device installation status and also to initiate the automatic log file collection in case an installation has failed.</p></td></tr><tr><td>Read &#x26; write all groups</td><td>Application</td><td><p>We need this permission for the assignments of the applications. </p><p></p><p>The read permission is used to list your Azure AD groups that you can use to assign applications. </p><p></p><p>The write permission is used when you select specific users. lntune doesn't support assigning applications to named users, so we create a group, populate that group with the users you've selected and assign that group to the application. </p><p></p><p>This permissions can be removed but then the user assignment is not possible.</p></td></tr><tr><td>Read all groups</td><td>Application</td><td><p>We need this permission for the assignments of the applications. </p><p></p><p>The read permission is used to list your Azure AD groups that you can use to assign applications.</p></td></tr><tr><td>Read organization information</td><td>Application</td><td><p>With this permission we can read how many Microsoft licenses you have with an lntune entitlement that are assigned to users/devices. </p><p></p><p>We'll use that number for billing purposes.</p></td></tr><tr><td>Read all users' full profiles</td><td>Application</td><td><p>We use this permission to list users in Scappman. </p><p></p><p>This is being used for user based application assignment and admin invite.</p></td></tr><tr><td>Read directory data</td><td>Application</td><td><p>We need this permissions to see the available users and groups to assign them to applications. </p><p></p><p>We also need this permission to calculate the number of licenses.</p></td></tr></tbody></table>