Security and permissions
Exactly what Pistos Pharos can see, and what it cannot.
Pharos reads configuration and directory metadata so it can tell you which settings are weak. This page lists every permission it requests in each cloud, in full, with the reason.
Early access. Connecting a live tenant is not open yet. This is the permission list the connection will request, published ahead of time so you can review it before you agree to anything.
Microsoft 365
Six read-only Microsoft Graph permissions.
| Permission | What Pharos uses it for |
|---|---|
| Directory.Read.All | Users, groups and their sign-in methods, to find accounts without MFA and count privileged users. Also the list of third-party applications and the delegated permissions people have granted them, so each can be graded and reviewed. |
| Policy.Read.All | Conditional Access and authentication policies, to check legacy sign-in and MFA enforcement. |
| AuditLog.Read.All | Last sign-in time per account, to find dormant accounts. It is not used to read message or file content. |
| Organization.Read.All | Tenant name and verified domains, to label results. |
| RoleManagement.Read.Directory | Who holds Global Administrator and other privileged roles. |
| SharePointTenantSettings.Read.All | Tenant-wide external sharing settings for SharePoint and OneDrive. It does not list or open files. |
Optional
Two more, only if you turn on extended access.
Extended access is a second approval, given to a second application that holds nothing but these two permissions. It is off by default, it is per tenant, and an administrator can turn it off in Pharos or delete the second application in their own tenant. Without it, the Intune checks say they need extended access; they never show as failing.
| Permission | What Pharos uses it for |
|---|---|
| DeviceManagementConfiguration.Read.All | Intune compliance policies and their assignments, and the setting that decides whether a device with no policy counts as compliant. |
| DeviceManagementManagedDevices.Read.All | How many devices are enrolled in Intune for each operating system, so each platform can be checked for a compliance policy. Device names, owners and contents are not read. |
Google Workspace
Five Admin SDK permissions.
| Permission | What Pharos uses it for |
|---|---|
| admin.directory.user.readonly | Users, 2-Step Verification status and admin flags. |
| admin.directory.rolemanagement.readonly | Which accounts hold Super Admin and other admin roles. |
| admin.directory.domain.readonly | Domains on the account, to label results. |
| admin.reports.audit.readonly | Admin and login audit events, to detect weakened settings and OAuth grants. |
| apps.groups.settings | Group sharing settings. Google offers one scope for this API, and it allows changes; Pharos uses it to read. |
Boundaries
What Pharos does not request.
- Permission to read email bodies or attachments.
- Permission to read calendar entries or chat messages.
- Permission to open files in OneDrive, SharePoint or Google Drive.
- Any Microsoft Graph permission that ends in ReadWrite.
- Some checks read your domains’ public DNS records (SPF, DKIM, DMARC). That needs no permission in your tenant.
- Settings Microsoft Graph does not expose, such as Exchange Online mail-flow rules, would need a second, optional consent. It is not requested today, and checks that need it show as “needs extended access”, never as failing.
- Fixes are made by you, in your admin console. Each check gives the steps or a command to run.
- Pharos sees who has a setting and which accounts lack MFA. That is account metadata, so treat the tenant connection as sensitive.
- Connecting needs a Global Administrator (Microsoft) or Super Admin (Google) to approve the permissions.
Control
How to revoke access.
Microsoft 365
In the Microsoft Entra admin center, open Enterprise applications, select Pistos Pharos, then Properties, and delete it. Deleting the application removes its permissions.
Google Workspace
In the Google Admin console, open Security, Access and data control, API controls, then Manage third-party app access, and remove Pistos Pharos.
How long we keep what we read is in the privacy notice. For a security questionnaire or any question this page does not answer, write to hello@pistospharos.com.
See every gap in every Microsoft 365 and Google Workspace tenant.
Pharos is in early access: request a place, and connect with read-only permissions when it opens. Planned pricing starts at $149 a month for every tenant, with no per-seat fees.