JosL

Totally! That is one of the reasons I didn't want to run it for others and have their data/credentials laying around. I wanted to make it as secure by design as possible. If it runs in your tenant, without MI, and the data stays there, you control it. Since the main tool even surfaces permissions on individual mailbox folders, it does need full access to those mailboxes. Same goes for file-level permission info in e.g. Sharepoint. I did look into minimizing the Exchange required permissions (the API is dumb), but getting the send-as permissions for e.g. distribution groups actually required Exchange Administrator in the default config 😕 That can be fixed by creating a custom admin role in exchange with a specific assignment, so you can actually run with less permissions, but I don't expect a lot of users will be tech-savvy enough to do or want to do that.

hello! You may remember me from OnedriveMapper in the ~2017 - 2020 period (although technically it is still around, I'm happy to say it is dying 🙃) As this forum was THE place people used / discussed it the most, I created an account at the time to better help people with OnedriveMapper, and remembered it just now for something else! Because most of the people here are in EDU, I wanted to share with you that M365Permissions.com is (since recently) free* for ALL UK Public Schools. M365Permissions.com is basically a tool that helps you identify oversharing in/outside your M365 tenant, it indexes ALL permissions even up to the mailbox folder or powerbi report level. Onenote, Power Automate, Azure, it includes it all and makes it searchable and analyzes it for 'bad' permissions e.g. doing Owner permissions for "Anonymous". (that's actually a real world example from a CEO's mailbox....you wouldn't believe it). Because it has all this permission data, you can also use it for other things such as ISO certifications, audits, offboarding checks (unique permissions is really handy there). And the data is/stays yours and in your tenant, so anything else you can come up with... Hope this helps you! And don't hesitate to shout out if I can improve anything Cheers, Jos.

Nice, I didn't know about that and added it as a recommendation on my blog's page about Onedrivemapper, thanks