Security and trust
Read-only by design. Watched like the systems it protects.
A monitoring tool should never become the weakest link in a customer's tenant. Kagemori asks Microsoft for the smallest set of permissions it needs and nothing that could change data.
- Two-factor sign-in required for every Kagemori user.
- Each customer's data in its own database, and partners only ever see their own customers.
- Every action recorded in the audit log.
- Our servers are monitored around the clock, with brute-force blocking, integrity checks and alerts for any change.
- Customers can revoke access at any time by removing the Kagemori app in Microsoft Entra.
| Permission | What Kagemori reads |
|---|---|
| Microsoft Graph | |
| SecurityIncident.Read.All | Defender XDR incidents |
| SecurityAlert.Read.All | Security alerts |
| SecurityEvents.Read.All | Secure Score and security events |
| Score.Read.All | Secure Score history |
| ThreatHunting.Read.All | Email threat statistics (counts only, never content) |
| IdentityRiskyUser.Read.All | Accounts flagged as risky or compromised |
| AuditLog.Read.All | Failed sign-ins, for spray detection |
| Exchange Online | |
| Exchange.ManageAsApp | Mail-flow reports and message trace (sender, recipient, subject, status), with the Security Reader role |
| Defender for Endpoint | |
| Machine.Read.All | Devices, health and risk |
| Vulnerability.Read.All | Vulnerabilities per device |
| SecurityRecommendation.Read.All | Hardening recommendations |
Never requested: write, isolate, remediate, mailbox-content (Mail.Read), files or directory permissions. Kagemori cannot read email bodies or attachments, and cannot change anything in a customer's tenant.
Put a guardian on every tenant.
See Kagemori with your own Microsoft 365 tenant in a 30-minute demo. Connect a test tenant during the call and see real data before it ends.