Required privileges and permissions

    ManageEngine SecureAI needs privileges at three levels: on the Windows server it is installed on, in each AI application it connects to, and within the product itself. This page lists what is required at each level.

    Privileges on the SecureAI server

    Install SecureAI using an account that has local administrator rights on the server. Administrator rights are required to register SecureAI as a Windows service and to write to the installation directory.

    Run the SecureAI service under an account that has read and write access to the installation directory, the bundled PostgreSQL database, and the Elasticsearch data directory.

    Restrict access to the installation folder to the service account and to administrators. To review this, go to Settings > Security and Storage > Security and Privacy > Security Hardening and click Learn How next to Secure installation folder permissions.

    Privileges for connected applications

    SecureAI discovers and governs AI agents by connecting to each application with its own set of credentials. Configure these under Application Settings, and create the credentials in the corresponding vendor console before you begin.

    Application Credentials required in SecureAI
    Microsoft (Entra ID, Copilot Studio, Microsoft Foundry) Tenant name, application ID, application secret, and the Azure environment your tenant belongs to
    Google (Gemini Enterprise Agent Platform, Google Gemini, and Workspace) Admin email, a service-account key file, the project ID and location for the agent platform, and the Google Workspace customer ID
    Zia Grant type, client ID, client secret, the redirect URL registered in your Zoho OAuth client, and your data center
    Anthropic Claude Admin API Key
    GitHub Copilot Personal access token and the organization name

    Note: Entra ID gates the Microsoft services. You cannot save Copilot Studio or Microsoft Foundry on their own without selecting Entra ID in the same instance.

    Permissions each credential must carry in the vendor console

    Grant these before you configure the connection in SecureAI. A connection can save with incomplete permissions and still return Sync failed, or leave risk indicators unable to run.

    Microsoft

    Assign the following API permissions to the app registration.

    Microsoft Graph, application permissions:

    • Directory.Read.All
    • User.Read.All
    • User.ReadBasic.All
    • AgentIdentity.Read.All
    • AgentIdentity.ReadWrite.All
    • AgentIdentityBlueprint.Read.All
    • AgentIdentityBlueprintPrincipal.Read.All
    • AgentIdUser.ReadWrite.All
    • AgentInstance.Read.All
    • AgentRegistration.Read.All

    Microsoft Graph, delegated permissions:

    • User.Read
    • User.ReadBasic.All

    Other APIs, delegated permissions:

    • Azure Machine Learning Services: user_impersonation
    • Azure Service Management (ARM): user_impersonation
    • Dynamics CRM: user_impersonation
    • Power Platform API: Agent365.Observability.All, Agents.Read, EnvironmentManagement.Environments.Read, EnvironmentManagement.Groups.Read, EnvironmentManagement.Settings.Read

    Also assign the AI Reader directory role in Entra ID to the app registration's service principal.

    Google

    Authorize the following scopes for the service account.

    Gemini Enterprise Agent Platform, granted to the service account acting as itself:

    Google Workspace, granted through domain-wide delegation:

    Google Gemini and AISPM, granted through domain-wide delegation:

    Zia

    Authorize the following scopes on the Zoho OAuth client.

    • ZiaAgents.agents.ALL
    • ZiaAgents.documents.ALL
    • ZiaAgents.tools.ALL
    • ZiaAgents.tools.READ
    • ZiaAgents.workflows.READ
    • ZiaAgents.settings.users.READ
    • ZiaAgents.settings.models.READ

    Anthropic Claude

    Use an organization admin API key, which begins with sk-ant-admin. The key must be created by a user who holds the Admin, Primary Owner, or Owner role.

    GitHub Copilot

    Grant the personal access token the following scopes.

    • admin:org
    • admin:org_hook
    • read:audit_log
    • security_events
    • manage_billing:copilot

    Privileges within SecureAI

    Access inside the product is controlled by roles assigned to help desk technicians under Delegation. SecureAI ships with the following roles:

    Role Access granted
    Super Admin Full control over SecureAI. This role is mandatory and cannot be modified or deleted.
    Access Protection Full access to the Access Protection module.
    Governance Access to the Dashboard, Governance (excluding Risk Assessment), Reports, Delegation, and Settings.
    Risk Assessment Access to Risk Assessment.

    The Reviewer, Approver, and Executor roles are assigned separately to technicians who take part in access certification and workflow.

    To grant a narrower set of privileges, go to Delegation > Help Desk Roles > Create New Role and select the required permissions across the Governance, Access Protection, Reports, and Administration tabs.