It reads. It never writes.
There is no write scope anywhere in the SafeScan consent, so the application physically cannot alter your tenant — including when it hands you a script that would.
What SafeScan does read
Four read-only Microsoft Graph scopes. The OAuth screen lists every one of them before you approve it.
Sites.Read.AllRead SharePoint site and permission metadata — who can reach what.User.Read.AllRead user accounts, MFA state and last sign-in for the identity checks.Policy.Read.AllRead Conditional Access, DLP and sharing policy configuration.AuditLog.Read.AllRead the audit-log configuration the compliance checks depend on.
What SafeScan cannot do
Not restricted by policy — impossible, because the permission does not exist in the consent.
- Change a sharing link, a permission or a label
- Delete or move a file, site, team or mailbox
- Create, disable or modify a user or group
- Read the contents of documents, emails or Teams messages
- Edit a Conditional Access, DLP or retention policy
- Run the remediation scripts it generates
Revoke access any time from Microsoft Entra → Enterprise applications → Copilot SafeScan → Remove.
What a scan sees, and what it keeps
Permissions, not content
SafeScan answers “who can reach this”. It reads paths, audiences, inheritance and policy state. The text inside a document is never requested and never stored.
What a scan keeps
The findings themselves: the item, its audience, the severity and the recommended action, plus the per-domain scores that make up the readiness number.
Ending it
Microsoft Entra → Enterprise applications → Copilot SafeScan → Remove. Access stops immediately, and nothing is retained afterwards.
Scripts are yours to run
The PowerShell SafeScan generates never executes from the product. You review it, you run it in your own admin terminal, and it logs its output so the change is auditable.
What a security review usually asks
Nothing to install
No agent, no proxy, no on-premises component and no inbound firewall rule. SafeScan talks to Microsoft Graph, outbound only.
Tenant isolation
Every query is scoped to a single tenant, and multi-tenant customers see each estate in its own workspace. One client's findings are never visible to another.
Evidence you can keep
Findings, scores and history export to PDF and Excel, so an auditor can read the result without being given a licence and a login.
Send this page to your security team.
Read-only scopes, no content access, nothing installed and revocation in one click. If they have a question we have not answered here, ask us directly.
More on Copilot SafeScan
Every page of the SafeScan sub-site, and the way back to the rest of LogiSam.