{"applicationName":"Romy — Read (Entra ID & Intune)","mode":"read-only","requestedScopes":["AuditLog.Read.All","Device.Read.All","DeviceManagementApps.Read.All","DeviceManagementConfiguration.Read.All","DeviceManagementManagedDevices.Read.All","DeviceManagementServiceConfig.Read.All","Directory.Read.All","Group.Read.All","GroupMember.Read.All","Organization.Read.All","Policy.Read.All","Reports.Read.All","RoleManagement.Read.Directory","User.Read.All","UserAuthenticationMethod.Read.All"],"neverRequestedScopes":["Application.ReadWrite.All","AppRoleAssignment.ReadWrite.All","RoleManagement.ReadWrite.Directory","Directory.ReadWrite.All","User.DeleteRestore.All","DeviceManagementManagedDevices.PrivilegedOperations.All","DeviceManagementManagedDevices.ReadWrite.All","GroupMember.ReadWrite.All","User.ReadWrite.All"],"profiles":[{"id":"fleet-read","purpose":"Read-only fleet, digital-experience, application inventory and licence consumption. Feeds modules R01 (DEX), R02 (Cost/FinOps) and R03 (Direct2Resolution).","requiredScopes":["DeviceManagementManagedDevices.Read.All","DeviceManagementApps.Read.All","DeviceManagementConfiguration.Read.All","DeviceManagementServiceConfig.Read.All","Organization.Read.All"],"allowedPaths":["/deviceManagement/managedDevices","/deviceManagement/managedDevices/*","/deviceManagement/managedDevices/*/detectedApps","/deviceManagement/managedDevices/*/deviceCompliancePolicyStates","/deviceManagement/managedDevices/*/deviceConfigurationStates","/deviceManagement/detectedApps","/deviceManagement/detectedApps/*","/deviceManagement/detectedApps/*/managedDevices","/deviceManagement/managedDeviceOverview","/deviceManagement/deviceCompliancePolicies","/deviceManagement/deviceCompliancePolicies/*","/deviceManagement/deviceCompliancePolicies/*/deviceStatuses","/deviceManagement/deviceConfigurations","/deviceManagement/deviceConfigurations/*","/deviceManagement/auditEvents","/deviceAppManagement/mobileApps","/deviceAppManagement/mobileApps/*","/deviceAppManagement/mobileApps/*/assignments","/deviceManagement/userExperienceAnalyticsOverview","/deviceManagement/userExperienceAnalyticsBaselines","/deviceManagement/userExperienceAnalyticsScoreHistory","/deviceManagement/userExperienceAnalyticsDevicePerformance","/deviceManagement/userExperienceAnalyticsDevicePerformance/*","/deviceManagement/userExperienceAnalyticsDeviceStartupHistory","/deviceManagement/userExperienceAnalyticsAppHealthApplicationPerformance","/deviceManagement/userExperienceAnalyticsAppHealthDevicePerformance","/deviceManagement/userExperienceAnalyticsBatteryHealthDevicePerformance","/deviceManagement/userExperienceAnalyticsWorkFromAnywhereMetrics","/subscribedSkus","/organization"],"deniedPaths":["/deviceManagement/managedDevices/*/wipe","/deviceManagement/managedDevices/*/retire","/deviceManagement/managedDevices/*/resetPasscode","/deviceManagement/managedDevices/*/deleteUserFromSharedAppleDevice","/deviceManagement/managedDevices/*/rebootNow","/deviceManagement/managedDevices/*/syncDevice","/deviceManagement/managedDevices/*/remoteLock","/deviceManagement/managedDevices/*/disableLostMode","/deviceAppManagement/mobileApps/*/assign"]},{"id":"identity-read","purpose":"Read-only identity, group, directory-audit, sign-in, conditional-access and role-assignment data. Feeds module R04 (Access & Identity) and the Sentinel baseline.","requiredScopes":["User.Read.All","Group.Read.All","GroupMember.Read.All","Device.Read.All","Directory.Read.All","AuditLog.Read.All","Policy.Read.All","RoleManagement.Read.Directory","UserAuthenticationMethod.Read.All","Reports.Read.All"],"allowedPaths":["/users","/users/*","/users/*/memberOf","/users/*/transitiveMemberOf","/users/*/authentication/methods","/users/*/licenseDetails","/groups","/groups/*","/groups/*/members","/groups/*/owners","/groups/*/transitiveMembers","/devices","/devices/*","/directoryRoles","/directoryRoles/*","/directoryRoles/*/members","/roleManagement/directory/roleAssignments","/roleManagement/directory/roleDefinitions","/auditLogs/directoryAudits","/auditLogs/signIns","/identity/conditionalAccess/policies","/identity/conditionalAccess/policies/*","/oauth2PermissionGrants","/servicePrincipals","/servicePrincipals/*","/servicePrincipals/*/appRoleAssignments","/reports/getOffice365ActiveUserDetail","/reports/getM365AppUserDetail"],"deniedPaths":["/users/*/assignLicense","/users/*/revokeSignInSessions","/users/*/authentication/methods/*/resetPassword","/groups/*/members/$ref","/applications","/applications/*","/directoryRoles/*/members/$ref"]}],"statements":["Diese Anwendung liest. Sie schreibt nicht. Es gibt keinen Codepfad zu einer schreibenden Graph-Operation.","Der Mandant wird aus dem Zugangsschlüssel des Aufrufers aufgelöst, nie aus einem Parameter. Das Sprachmodell kann den Mandanten nicht wählen.","Application.ReadWrite.All wird nie beantragt. Damit kann sich der Agent keine eigenen Rechte geben — das ist überprüfbar, nicht behauptet.","Das Audit-Protokoll enthält Metadaten: wer, was, wann, mit welcher Begründung, welches Ergebnis. Nie Antwortkörper, nie Gerätenamen, nie Nutzernamen.","Sie können die Zustimmung jederzeit in Ihrem eigenen Tenant widerrufen: Entra ID → Unternehmensanwendungen → Romy → Löschen."]}