Permissions and consent
As of: October 2026
This page lists all Microsoft Graph and SharePoint permissions Seamless needs. Seamless only requests the permissions required for the governance features in Microsoft 365. They are granted through the standard Microsoft admin consent, following the principle of least privilege.
Seamless doesn't access customer data beyond the granted permissions, doesn't store content unnecessarily and doesn't use customer data for training or any other purpose.
Types of permissions
- Application: Seamless acts without a signed-in user, for example for automatic checks and provisioning.
- Delegated: Seamless acts on behalf of the signed-in user and only within that user's own permissions.
Microsoft Graph
Application permissions
| Permission | Description |
|---|---|
| AppRoleAssignment.ReadWrite.All | Assign permissions and app roles, for example the Seamless Administrator role. |
| AuditLog.Read.All | Read audit logs. |
| ChannelSettings.Read.All | Read the names, descriptions and settings of all channels. |
| Directory.ReadWrite.All | Read and write directory data such as users and groups. Deleting users or groups is not possible. |
| Group.ReadWrite.All | Create, read, update and delete groups and their memberships. |
| InformationProtectionPolicy.Read.All | Read all published sensitivity labels and label policies of the organisation. |
| Sites.FullControl.All | Full control of all site collections. |
| Tasks.ReadWrite.All | Read and write tasks and task lists of all users. |
| Team.ReadBasic.All | Get a list of all teams. |
| TeamMember.ReadWriteNonOwnerRole.All | Add and remove members of teams. Adding or removing owners or making members owners is not possible. |
| User.ReadWrite.All | Read and write the full profiles of all users. |
Delegated permissions
| Permission | Description |
|---|---|
| AuditLog.Read.All | Read audit logs on behalf of the signed-in user. |
| Channel.ReadBasic.All | Read the names and descriptions of channels. |
| Directory.ReadWrite.All | Read and write directory data on behalf of the signed-in user. Deleting users or groups and resetting passwords is not possible. |
| Files.ReadWrite.AppFolder | Full access to the signed-in user's Seamless app folder, no access to other files. |
| Notes.Read.All | Read all OneNote notebooks the signed-in user has access to. |
| Sites.ReadWrite.All | Edit or delete items in all site collections the signed-in user has access to. |
| Team.ReadBasic.All | Read the names and descriptions of teams. |
| TeamMember.ReadWrite.All | Add and remove members of teams and change their role, on behalf of the signed-in user. |
SharePoint Online
| Permission | Type | Description |
|---|---|---|
| Sites.FullControl.All | Application | Full control of all site collections. |
| AllSites.FullControl | Delegated | Full control of all site collections the signed-in user has access to. |