We only read. Never write.
TSO requests the six Microsoft Graph read scopes below and nothing else. The Graph API physically will not let it delete, move or modify anything in your tenant — even if we wanted it to.
What TSO does read
Exactly these Microsoft Graph scopes — no more, no less. An admin approves them once during onboarding, and the consent screen lists every one before you agree.
Sites.Read.AllRead SharePoint site and drive metadata.Files.Read.AllRead file metadata — name, size, hash, timestamps. Never contents.Reports.Read.AllRead the usage reports Microsoft already generates for the tenant.Directory.Read.AllResolve user and group names for the ownership column.User.Read.AllResolve mailbox owners.Group.Read.AllResolve the group behind a Teams-backed site.
What TSO cannot do
Even with your consent. There is no write scope in the application, so the Graph API refuses these calls.
- Delete files, sites, mailboxes or messages
- Move or rename anything in your tenant
- Modify permissions, sharing links or labels
- Read file contents, email bodies or Teams messages
- Send email or post to Teams on your behalf
- Create or change apps, users, groups or policies
Revoke access any time from Microsoft Entra → Enterprise applications → TSO → Remove.
What is kept, where, and for how long
A scan produces an inventory, not a copy of your content. This is the whole of it.
What is stored
Site and drive metadata, storage figures, activity dates, content hashes and the recommendations derived from them. Enough to rank a finding and point an admin at it.
What is never stored
File contents, email bodies, Teams messages, and anything a Graph read scope does not already expose. There is no code path that fetches a document’s bytes.
Where it lives
Azure UK South by default, in a workspace scoped to your tenant alone. MSPs on the self-hosted plan choose their own Azure region and subscription.
How you end it
Microsoft Entra → Enterprise applications → TSO → Remove. Access stops immediately, and your workspace and its scan data can be deleted on request.
Every finding carries its receipt
Graph endpoint per finding
Each row records the Microsoft Graph endpoint it came from, so your administrators can re-run the call themselves and compare the answer.
Audit trail, exportable
Every Graph call TSO makes against your tenant is logged with a timestamp, and the log can be exported for your own records.
No agents, no inbound ports
Nothing is installed on-premises, no proxy sits in the path, and no firewall rule changes. TSO talks to Microsoft Graph, outbound only.
Hand this page to your security team.
Most sign-offs we see take a day: read-only scopes, no content access, no agents, and revocation in one click from Entra. If they have a question we have not answered, ask us.
More on Tenant Storage Optimisation
Every page of the TSO sub-site, and the way back to the rest of LogiSam.