Understanding the Permissions Microsoft Copilot Requires
The Microsoft Copilot connector requests a set of Microsoft Graph and Office 365 Management API permissions. Understand what each one lets AI Security do, so that you can answer your security team before you begin.
Whichever method you use to connect Microsoft Copilot, AI Security ends up with the same set of permissions in your Microsoft tenant. What differs is how they are granted. If you register your own application, you add the permissions yourself and grant admin consent in Microsoft Entra. If you use admin consent, the Forcepoint application already carries them and you approve the whole set in one sign-in.
Microsoft Graph permissions
| Permission | Scope | What it lets AI Security do |
|---|---|---|
| Read all agent identities | AgentIdentity.Read.All | Identifies which Copilot agents are in use in your tenant and what those agents access. AI Security uses this to populate the Identity Landscape, so that agent activity appears alongside user activity rather than as an unknown identity. |
| Read all AI enterprise interactions | AiEnterpriseInteraction.Read.All |
Retrieves the prompts users send to Copilot and the responses Copilot returns. This is the core permission for the connector. Without it, AI Security cannot inspect Copilot conversations for sensitive data or policy violations. This permission alone does not produce data. The Microsoft API behind it returns interactions only for users who hold a Microsoft 365 Copilot license with the **Microsoft Copilot with Graph-grounded chat** service plan enabled. Granting the permission to an unlicensed user returns an empty result rather than an error. See [Checking the Prerequisites Before Connecting Microsoft Copilot](guid-97454977-3c25-4efa-ba22-4d8a4acfce97.md#guid-97454977-3c25-4efa-ba22-4d8a4acfce97). |
| Read files in all site collections | Files.Read.All | Reads the OneDrive and SharePoint files that a Copilot chat uses or references, so that AI Security can determine whether a Copilot response exposed sensitive content the user should not have seen. |
| Read and write files in all site collections | Files.ReadWrite.All | Lets AI Security act on a file when a policy requires remediation. |
| Read all groups | Group.Read.All | Resolves group membership in your tenant, so that you can scope policies to groups and see which teams are involved in an incident. |
| Read all usage reports | Reports.Read.All | Identifies which Microsoft 365 application a user was working in when they interacted with Copilot, such as Word or SharePoint. AI Security uses this to give each interaction its application context. |
| Read items in all site collections | Sites.Read.All | Reads the SharePoint site items that a Copilot chat uses or references, along with their permissions, so that AI Security can assess whether content surfaced by Copilot is overshared. |
| Read and write items in all site collections | Sites.ReadWrite.All | Lets AI Security act on a SharePoint item when a policy requires remediation. |
| Read all users' full profiles | User.Read.All | Resolves the user behind each Copilot interaction, including display name, email address, and department, so that activity is attributed to a person in reports and incidents. |
| Sign in and read user profile | User.Read | Added automatically by Microsoft Entra when an application is registered. It identifies the signed-in administrator during the consent process. Leave it in place. |
Office 365 Management API permission
- Read activity data for your organization —
ActivityFeed.Read - Retrieves the Microsoft 365 unified audit activity feed. AI Security uses this to track the file operations your DLP policies support, including file modified, file downloaded, and sharing changes. It also uses this feed to identify when a Copilot agent modifies a file.
Additional permissions shown during admin consent
If you connect Copilot using admin consent, Microsoft shows two consent screens. The first asks for two sign-in permissions that allow the consent process itself to complete. The second lists the permissions described above.
- View users' basic profile
- Identifies the administrator who is granting consent. Before you select Consent on behalf of your organization, this permission reads as View your basic profile.
- Maintain access to data you have given it access to
- Allows AI Security to refresh its access token, so that the connector keeps working without an administrator signing in again.
Neither permission is requested when you register an application yourself and connect using a client secret.
Scope of these permissions
These permissions are granted at tenant level. A Microsoft Graph application permission cannot itself be narrowed to a subset of users or sites, so the permissions you grant are the same whatever you choose to monitor.
See also: