Configuration Inventory Requirements - SysKit Point

This article lists the requirements necessary to successfully deploy and use the Configuration Inventory module in SysKit Point.

Configuration Inventory Requirements

Connect Service Account

To collect Microsoft Teams-related data, you need to connect a service account in SysKit Point for the Configuration Inventory module.

When preparing the service account, consider the following requirements:

  • service account should have the Teams Administrator Azure AD role assigned

Learn how to connect the service account in SysKit Point by following the instructions from this article.

Please note!
The Configuration Inventory module currently does not support a service account with multi-factor authentication enabled.

Access Configuration Inventory Settings & Reports

Configuration Inventory Settings & Reports are available to SysKit Point Administrators only.

Configuration Inventory App Permissions

Please note!
Permissions described below are automatically granted to SysKit Point by giving consent during the tenant connection process. Permissions are granted only if the Configuration Inventory module is deployed with SysKit Point deployment.

For more information on Configuration Inventory deployment, use this link.

If the Configuration Inventory module is deployed, SysKit Point creates an Azure AD Application named SysKit Point Configuration Inventory when establishing a connection to your tenant.

SysKit Point and the Configuration Inventory module use two types of permissions to access several Microsoft APIs:

  • Application permissions - define what SysKit Point and the Configuration Inventory module can do without a signed-in user.
  • Delegated permissions - define what SysKit Point and the Configuration Inventory module can do in the name of the signed-in user.

The following permissions are required for the SysKit Point Configuration Inventory app registration:

Microsoft Graph

PermissionsTypeReason
Read all administrative unitsApplicationAllows SysKit Point to read administrative units and administrative unit membership.
Read Microsoft Intune appsApplicationAllows SysKit Point to read Intune apps.
Read Microsoft Intune device configuration and policiesApplicationAllows SysKit Point to read Intune device configuration and policies.
Read Microsoft Intune devicesApplicationAllows SysKit Point to read Intune devices.
Read Microsoft Intune configurationApplicationAllows SysKit Point to read Intune configuration.
Read directory dataApplicationAllows SysKit Point to read directory data.
Read all groupsApplicationAllows SysKit Point to read group properties.
Read all groupsDelegatedAllows SysKit Point to read group properties as a signed-in user. Required for Planner.
Read all group membershipsApplicationAllows SysKit Point to read group memberships.
Send mail as any userApplicationAllows SysKit Point to send emails so you can be notified, for example, when a snapshot finishes.
Read your organization's policiesApplicationAllows SysKit Point to read policies.
Have full control of all site collectionsApplicationAllows SysKit Point to collect data from SharePoint. Unfortunately, full control is required, and it will not work with the read permissions.
Sign users inDelegatedAllows SysKit Point to collect data from your environment as the signed-in user.
Read all users' full profilesDelegatedAllows SysKit Point to read your users' profiles and show you reports based on that data.

Azure Active Directory Graph

PermissionsTypeReason
Read directory dataApplicationAllows SysKit Point to read data in your company or school directory, such as users, groups, and apps.
Read all hidden membershipsApplicationAllows SysKit Point to read the memberships of hidden groups and administrative units.

SharePoint

PermissionsTypeReason
Have full control of all site collectionsApplicationAllows SysKit Point to collect data from SharePoint. Unfortunately, full control is required, and it will not work with the read permissions.
Read user profilesApplicationAllows SysKit Point to read user profile properties.

Skype and Teams Tenant Admin API

PermissionsTypeReason
Access Microsoft Teams and Skype for Business data as the signed-in userDelegatedAllows SysKit Point to collect Skype for Business data on behalf of the signed-in user.

PowerApps Service

PermissionsTypeReason
Access the PowerApps Service APIDelegatedAllows SysKit Point to access the PowerApps Service API on behalf of the signed-in user.

Azure Service Management

PermissionsTypeReason
Access Azure Service Management as organization usersDelegatedAllows SysKit Point to collect data about PowerApps.

Office 365 Exchange Online

PermissionsTypeReason
Manage Exchange As ApplicationApplicationAllows SysKit Point to read data from Exchange.


Please note!
The SysKit Point service principal will also be added to the Exchange Administrators role to support the data collection. The Microsoft documentation (found here) states that it's possible with other roles, but from our experience, only the Exchange Administrators role worked for collecting all of the data.