This article explains how Cye Cloud Posture Solution accesses your Azure environment: the read-only registered application it uses, the Microsoft Graph API permissions it requests, and the Monitoring Reader role you assign.
Overview
Cye Cloud Posture Solution, the Cloud Security Posture Management (CSPM) component of the Cye platform, connects to Azure through a registered application in your tenant with read-only access. The application exists to give the platform visibility into identity, access, and configuration metadata for security posture assessments, without elevated privileges and without direct access to user data. You control the scope by choosing where the Monitoring Reader role is assigned.
Authenticate with a Registered App: A registered application in your tenant with a unique Client ID and secret. Secrets are stored encrypted and isolated in a secure vault.
Read Metadata Only: Application-level, read-only Microsoft Graph API permissions, plus the Monitoring Reader role on the subscriptions or management groups you select. No write permissions and no user-delegated access.
Audit Every Action: All activity is logged in Azure AD sign-in and activity logs.
What the registered application can access
What the registered application can access
The connection follows Azure security best practices: it is auditable, and Cye Cloud Posture Solution never requests permissions to modify resources or access sensitive customer data.
Azure AD Registered Application: Cye Cloud Posture Solution creates a registered app in your tenant.
Client ID & Secret: A unique Client ID and secret are generated during setup.
Secure Credential Storage: Secrets are stored encrypted and isolated in the Cye Cloud Posture Solution secure vault.
Read-only Role Assignments: The app is granted only the necessary read scopes: specific Microsoft Graph API permissions (application-level) and the Monitoring Reader role on selected subscriptions or management groups.
The application performs metadata-level scans and security posture assessments. It does not access PII, secrets, or live data.
Microsoft Graph API permissions
Microsoft Graph API permissions
Cye Cloud Posture Solution requests the following application-level, read-only Graph API permissions to perform its risk analysis. They provide metadata visibility into identity, access, and configuration, without modification rights.
Permission | Description |
| Read all access reviews |
| Read API connectors for authentication flows |
| Read all applications |
| Read all audit log data |
| Read custom security attribute assignments |
| Read Microsoft Intune apps |
| Read Microsoft Intune device configuration and policies |
| Read Microsoft Intune RBAC settings |
| Read directory data |
| Read all external items |
| Read identity providers |
| Read all identity risk event information |
| Read all identity risky user information |
| Read all published labels and label policies |
| Read all hidden group memberships |
| Read organization information |
| Read your organization's policies |
| Read consent and permission grant policies |
| Read privileged access to Azure AD groups |
| Read privileged access to Azure resources |
| Read all programs |
| Read all usage reports |
| Read role management data for all RBAC providers |
| Read Cloud PC RBAC settings |
| Read your organization's security actions |
| Read all security incidents |
| Read threat assessment requests |
| Run hunting queries |
| Read all threat indicators |
| Read all users' authentication methods |
Note: These permissions are application-level, read-only, and used solely to analyze your cloud security posture.
Azure RBAC role: Monitoring Reader
Azure RBAC role: Monitoring Reader
In addition to the Graph API permissions, the registered application requires the Monitoring Reader role on selected Azure subscriptions or management groups. This role allows Cye Cloud Posture Solution to:
Read activity logs.
Inspect diagnostic settings.
Collect metrics and monitoring data.
You control the scope by choosing where the role is assigned.
How setup works
How setup works
During onboarding, Cye Cloud Posture Solution provides a registration script or guide to:
Create the Azure AD application.
Assign the Microsoft Graph permissions listed above.
Assign the Monitoring Reader role.
You generate a Client ID and Client Secret.
Cye Cloud Posture Solution stores the credentials in an encrypted vault.
For step-by-step instructions, see Connecting Your Azure Account (Recommended Way) or Connecting Your Azure Account with a Registered App.
Read-only access and auditing
Read-only access and auditing
Cye Cloud Posture Solution never uses user-delegated access.
Access is used only for metadata and configuration scans.
No resources are modified, deleted, or created.
All activity is logged in Azure AD sign-in and activity logs.
Summary
Summary
Component | Description |
Access Method | Azure AD registered app with client credentials |
Credential Storage | Encrypted and isolated |
Graph API Access | 30+ read-only scopes (see the permissions table above) |
Azure Role |
|
Write Permissions | None |
User Delegation | Not used (app-only authentication) |
Auditability | Via Azure AD sign-in and activity logs |
Wrap-up / Next Steps
Wrap-up / Next Steps
Connect your account: Go to Cloud Accounts > Connect account and follow Connecting Your Azure Account (Recommended Way).
Use a registered app if OAuth is unavailable: Follow Connecting Your Azure Account with a Registered App.
Choose your scope: Assign the Monitoring Reader role at the subscription or management group level in Access control (IAM). The root management group covers the entire directory.