Microsoft 365 permissions, in plain terms
ORCA Opti asks for Microsoft 365 access in separate, individually optional blocks. Here is exactly what each one can and cannot do, and how to grant only what you need.
Every block is optional
Access is requested in separate blocks, each with its own consent. Grant the ones you want and leave the rest.
Posture scanning is read-only
Opti Cyber only reads security settings to check them. It never changes your configuration, policies, devices or accounts.
SharePoint is site by site
ORCA can read files only on the specific sites an admin grants. It cannot list or reach any other site.
You can withdraw access
Disconnect a block in ORCA at any time, and remove consent entirely in Microsoft Entra. Microsoft stays the system of record.
Every permission, and what it is for
Eight sets of Microsoft Graph permissions. The first three are consented once by a Global Administrator for the tenant. The rest are consented by each individual user as they connect their own tools.
| Block | Microsoft Graph permission | Consent | What it does |
|---|---|---|---|
| Directory & people | User.Read.All, User.Invite.All | Global Admin | Reads user profiles across the tenant and can create guest invitations for external collaborators an ORCA user adds. |
| SharePoint | Sites.Selected | Global Admin | No access until an admin grants a specific site. After that, reads (or reads and writes) only the sites granted, one at a time. |
| Opti Cyber (Essential 8) | DeviceManagement.*.Read.All, Policy.Read.All, UserAuthenticationMethod.Read.All, RoleManagement.Read.Directory, User.Read.All | Global Admin | Read-only visibility of security configuration (MFA, device management, policies) for posture checks. Changes nothing. |
| Send email | Mail.Send | Per user | Sends mail as the connecting user. Cannot read, search or delete mail. |
| Inbox & Calendar (read) | Mail.Read, Calendars.Read | Per user | Read-only access to the connecting user's own mailbox and calendar. |
| Calendar create & edit | Calendars.ReadWrite | Per user | Creates and edits events on the connecting user's own calendar. |
| OneDrive | Files.ReadWrite.AppFolder | Per user | Reads and writes only a dedicated ORCA app folder. Cannot see the user's own files. |
| Sign in | openid, profile, email, offline_access, User.Read | Per user | The connecting user's own basic profile, so they can sign in. Always required. |
Some tenants restrict user consent. Microsoft then shows “needs admin approval” and an administrator approves the per-user blocks as well.
SharePoint and OneDrive, the detail that matters
This is usually the first question, especially where SharePoint holds sensitive data. The short answer: ORCA reaches only what an admin hands it, site by site.
- ORCA uses Sites.Selected, which has no access on its own. It cannot even list your tenant's sites until an admin grants a specific one.
- On a granted site, ORCA reads file contents. A file is fetched by its item ID only when a user or an ORCA agent works with that document.
- ORCA requests no SharePoint admin or sharing-settings permission. Your sharing posture is out of scope.
- OneDrive access is limited to a dedicated ORCA app folder. ORCA cannot see a user's own OneDrive files.
- Content fetched from a granted site can be read by the AI model when it is used in a request. ORCA does not use your data to train any AI model, and under ORCA's agreement the model provider does not retain it to train theirs.
Grant only what you need
Posture only. Grant Opti Cyber and nothing else. It is read-only and needs no file, mail or SharePoint access. Directory & people is not a prerequisite.
Withhold content access. Leave SharePoint ungranted, and leave Inbox, Calendar, Send email and OneDrive unconnected. Sign-in is the only block needed to use ORCA at all.
Scope each site yourself. You choose every SharePoint site and whether it is read or write. ORCA supplies the exact PowerShell or Graph command and never holds Sites.FullControl.All.
Know the limits. Grants are per site, not per folder. A folder binding inside ORCA is an organisational convenience, not a security boundary, and a grant on a root site covers its whole site collection.
Where ORCA can act, and where it cannot
Opti Cyber and Inbox & Calendar (read) never modify anything. The blocks below can act, each within a narrow, named limit.
| Block | What it can do | What it cannot do |
|---|---|---|
| Send email | Send mail as the connecting user. | Read, search or delete mail. |
| Directory & people | Send guest invitations to external collaborators an ORCA user adds. | Edit or delete accounts, reset passwords, read mailboxes or files. |
| Calendar create & edit | Create and edit events on the connecting user's calendar. | Touch anyone else's calendar. |
| SharePoint (write) | Write files on the sites explicitly granted write access. | Reach any other site. Read-only sites stay read-only. |
| OneDrive | Write inside ORCA's own app folder. | Reach the user's other files. |
Two points worth being plain about: Inbox & Calendar (read) does read the user's own mail and calendar content, and Directory & people creates guest user objects, which is a directory write.
Managing multiple client tenants
Per-tenant consent. Each client's own Global Administrator approves each admin block. ORCA records the tenant ID against that client, and a signed consent flow cannot be replayed against another tenant.
Isolation. Every record is keyed by tenant, and every request checks the user is on that tenant's allowed-users or allowed-domains list. Your staff see a client only if they are listed, and delegated tokens are stored per user, per tenant.
Offboarding. Remove your staff from the client's allowed users or domains, then remove the ORCA enterprise application from their tenant.
GDAP is not supported
ORCA does not use partner-delegated consent. Each client's own Global Administrator must approve every admin block in their own tenant. If you run access through GDAP today, plan for a direct admin consent in each client tenant instead.
Revoking access
In ORCA. An ORCA administrator disconnects a block, which stops ORCA using it. Per-user connections delete the stored token.
In full. Admin consent stays in your Microsoft Entra directory until the ORCA enterprise application is removed, under Entra admin centre, Enterprise applications. A SharePoint site grant is removed by deleting that site's app permission. Microsoft is the system of record, so final control sits with you, not with ORCA.
Want to see it in the product?
Watch the short walkthrough of reviewing, revoking and re-granting ORCA's Microsoft 365 access, or talk to our team about a specific tenant.
Having trouble signing in? Sign-in help