Setting up 365 Permissions: connection, read access and first scan

Requirements

• Your organization's Microsoft 365.
• A Global Administrator who allows read access at Microsoft.
• In Conbool, one of the three permissions of the product: view, manage or clean up. The owner grants them through roles.

Setup in three steps

The overview guides you through setup until the first scan is complete.

1. Connect Microsoft 365. The Connect button establishes the connection to Microsoft 365. If it already exists, for example through the directory, the step is done.
2. Allow read access. A Global Administrator allows read access at Microsoft in a second window. Nothing changes in Microsoft 365.
3. Start the first scan. The scan finds all locations, groups, people outside and shares. The overview shows what it is working on.

The third step also offers Allow clean-up. This is the second permission, which lets 365 Permissions change shares. You can skip it and grant it later under Settings → Connection.

The two applications

• Conbool 365 Permissions reads. It requests read permissions for sites, files, groups, users, channel members, the directory, policies and the SharePoint sharing settings. For the complete picture of SharePoint shares, Microsoft requires full control of all sites, called Sites.FullControl.All. 365 Permissions uses it for reading only.
• Conbool 365 Permissions Eingriff cleans up. Without its permission the product stays read-only.

If you consented before October 2026, the Entra portal still lists the applications under their former names “Conbool M365 Governance” and “Conbool M365 Governance Eingriff”. They are the same applications.

Both permissions can be revoked in the Entra portal at any time. 365 Permissions then reads and changes nothing, and the captured state remains visible.

The scan

A scan reads every drive completely to find the shared items. Its duration depends on the number of files: a OneDrive with several hundred thousand items takes considerably longer than a small library. A started scan continues even if the page is closed.

After the first complete scan, Conbool scans daily. Under Settings → Scan the automatic scan can be set to weekly or turned off. After every complete scan the organization-wide settings are checked too.

A change at Microsoft shows with the next scan. After a policy change, 365 Permissions re-evaluates all locations right away.