Review, revoke and re-grant Microsoft 365 permissions

Before you start

• An ORCA administrator account. The tenant-wide permissions (Directory & people, SharePoint, Opti Cyber) need a Microsoft 365 Global Administrator.
• ORCA connected to your Microsoft 365 tenant. Every permission is granted separately, so you can start with only the ones you need.

Step by step

1. 1

   Open Settings

   Click Settings at the bottom of the left-hand navigation to open your account settings.

2. 2

   Open Integrations

   Under Configuration, open Integrations. This lists every tool ORCA connects to, and is where you control each one.

3. 3

   Open Microsoft 365

   Click the Microsoft 365 row to see exactly what ORCA is connected to and the permissions it holds.

4. 4

   Review the permissions

   Each permission is listed and granted separately. A Global Administrator approves only what you enable, and you can revoke any block on its own.

5. 5

   Grant access

   To authorise a permission, click Grant access. ORCA requests it through Microsoft's standard admin-consent screen, so you see exactly what you are granting before anything is restored.

6. 6

   Revoke a permission

   To withdraw a permission, click Revoke. Here, for example, you remove the Directory and people permission that lets ORCA show your organisation's people.

7. 7

   Confirm in Microsoft Entra

   Microsoft stays the system of record for access. Revoking in ORCA is the first step; you confirm you will also remove it in Microsoft Entra to fully revoke. Final control sits with you in Microsoft, not with ORCA.

8. 8

   Finish

   Click Done. ORCA has now dropped that permission on its side.

Troubleshooting

I clicked Revoke in ORCA but Microsoft still shows the permission as consented.

Revoking in ORCA stops ORCA using the permission, but Microsoft is the system of record. To fully revoke, remove the ORCA enterprise application in Microsoft Entra (Entra admin centre, Enterprise applications), or delete the site grant for a SharePoint site.

I only want ORCA to run security posture checks, nothing else.

Grant Opti Cyber on its own. It is read-only and needs no file, mail or SharePoint access, and Directory & people is not a prerequisite.

Can ORCA read our SharePoint files?

Only on sites an administrator individually grants. Until a site is granted, ORCA has no SharePoint access and cannot even list your sites, and you choose whether each site is read or read and write.

We manage client tenants through GDAP.

ORCA does not use partner-delegated consent. Each client's own Global Administrator must approve each admin permission in their own tenant.

Frequently asked questions

Is each permission optional?

Yes. ORCA requests access in separate blocks, each with its own consent. Grant the ones you want and leave the rest; signing in is the only one always needed.

How do I fully revoke ORCA's access?

Disconnect the block in ORCA to stop ORCA using it, then remove the ORCA enterprise application in Microsoft Entra to remove consent entirely. Microsoft is the system of record for access.

Does revoking in ORCA change anything in Microsoft?

No. ORCA stops using the permission on its side. The consent stays in your Microsoft Entra directory until an administrator removes it there.

Can I control which SharePoint sites ORCA can reach?

Yes. You choose each site and whether it is read or read and write. ORCA supplies the exact command to grant a site and never holds tenant-wide SharePoint control.