Minimum scope

Table 1: The roles required by the Entra ID application configured for Exchange Reporter Plus to use the Exchange Online reporting, auditing, and alerting modules are listed below.

Module	Role Name	Description
Exchange Online reporting	Global Reader	Get reports on all Microsoft 365 services.
	Security Reader	Get audit logs and mailbox reports.
Exchange Online auditing and alerting	Security Reader	Get audit logs and sign-in reports.

Table 2: Roles and permissions required by the Microsoft Entra ID application configured for Exchange Reporter Plus are given below.

Module	API Name	Permission	Scope
Reporting	Microsoft Graph	User.Read.All	Get user and group member reports.
		Reports.Read.All	Get usage reports.
		Calendars.Read	Get users' calendar details.
		Organization.Read.All	Get license details.
		ReportSettings.Read.All	Enables the configured Entra application to retrieve tenant-level settings from the tenant where it is configured.
	Exchange Online	Exchange.ManageAsApp	Used to execute Exchange Online PowerShell cmdlets via the configured Entra application.
Auditing	Office 365 Management	ActivityFeed.Read	Read the activity data for the organization.
Content Search	Microsoft Graph	Mail.Read	Read the email content in mailboxes.
Migration	Office 365 Exchange Online	Mail.ReadWrite	Migrate the email content in mailboxes to Exchange Online.