| Slack Basic scope | Explanation |
|---|---|
| im:read | View basic info (like membership and names) for direct message conversations the app is in, but not their message content |
| mpim:read | View basic info for group direct message conversations the app is in, but not their message content |
| users:read | View the list of people in the workspace and their basic profile fields (e.g., name, ID, status) |
| users.profile:read | View detailed user profile information fields for people in the workspace |
| users:read.email | View the email addresses associated with users in the workspace |
| channels:read | View basic information about public channels in the workspace (e.g., names, IDs, topics), but not their messages |
| groups:read | View basic information about private channels the app has access to, but not their messages |
| Security check example | Required scopes |
|---|---|
| Identify Channels with Unknown Too Many Owners | im:read npim:read groups:read channels:read |
| Restriction and Secure Management of Administrative Accounts | users:read users.profile:read users:read.email |
| Slack Enterprise scope | Explanation |
|---|---|
| team:read | View basic workspace information, including the name, email domain, and icon |
| groups:read | View basic information about private channels the app has access to, but not their messages |
| channels:read | View basic information about public channels in the organization (e.g., names, IDs, topics), but not their messages |
| mpim:read | View basic info for group direct message conversations the app is in, but not their message content |
| im:read | View basic info (like membership and names) for direct message conversations the app is in, but not their message content |
| users:read | View the list of people in the organization and their basic profile fields (e.g., name, ID, status) |
| users:read.email | View the email addresses associated with users in the organization |
| users.profile:read | View detailed user profile fields for members in the organization |
| admin.users:read | As an org or workspace admin, view administrative user details across the Enterprise organization (such as users and their roles) for management purposes |
| Okta scope | Explanation |
|---|---|
| okta.users.read | Allows viewing Okta user resources, including users’ profiles and basic attributes, without modifying them |
| okta.roles.read | Allows viewing administrative roles and role assignments that define what privileges principals have in the Okta org |
| okta.apps.read | Allows viewing applications configured in the Okta org, including their metadata and assignments, without managing them |
| okta.groups.read | Allows viewing groups in the Okta org and their memberships, without creating or updating groups |
| okta.policies.read | Allows viewing security and access policies (such as sign-on or password policies) configured in the Okta org |
| okta.eventHooks.read | Allows viewing existing event hook definitions that send Okta events to external endpoints |
| okta.networkZones.read | Allows viewing network zone definitions (for example, IP ranges and locations) used in policies and access decisions |
| Security check example | Required scopes |
|---|---|
| Incomplete onboarding for new identities | okta.users.read |
| Eliminate direct user app assignments | okta.apps.read |
| Admin console access requires MFA | okta.groups.read okta.policies.read |
| Dormant super admins deactivated | okta.roles.read |
| Event hooks registered for key events | okta.eventHooks.read |
| Network zones defined (IP/dynamic) and referenced by policies | okta.networkZones.read |
| Zoom scope | Explanation |
|---|---|
| account:read:admin | View detailed information and settings for the entire Zoom account (such as account profile, features, and configuration) with admin-level read‑only access |
| Security check example | Required scopes |
|---|---|
| Ensure meeting passcode is set to have at least 1 number | account:read:admin |
| Salesforce scope | Explanation |
|---|---|
| API Enabled | Allows access to Salesforce data and functionality using Application Programming Interfaces (APIs), including REST, SOAP, Bulk, and Metadata APIs |
| View Setup and Configuration | Allows users to view administrative settings, setup menus, and metadata without making changes. |
| View All Users | Allows a user to see all user records in the organization, regardless of the established organization-wide sharing defaults or sharing rules. |
| View Health Check | allows users to access and read the Security Health Check page, which evaluates org security settings against best practices. |
| Jira scope | Explanation |
|---|---|
| read:jira-work | View Jira project and issue data (including issues, projects, attachments, and worklogs) that the authorized user has access to, without making any changes |
| Security check example | Required scopes |
|---|---|
| Stop public dashboards | read:jira-work |
| Box scope | Explanation |
|---|---|
| manage_managed_users | Grants an application permission to manage enterprise managed users in Box, including changing their primary login, resetting passwords, and updating their roles |
| Security check example | Required scopes |
|---|---|
| Remove MFA exemptions for all users | manage_managed_users |
| GitHub scope | Explanation |
|---|---|
| read:org | Grants read‑only access to an authenticated user’s organization data on GitHub, including org membership, org projects, and team membership details |
| Security check example | Required scopes |
|---|---|
| Ensure strict base permissions are set for repositories | read:org |
| Confluence scope | Explanation |
|---|---|
| read:space:confluence | View Confluence space details such as name, description, and metadata without modifying the space |
| read:confluence-groups | View Confluence user groups and their basic details for permission and membership lookup |
| read:space.permission:confluence | View the permission assignments and rules configured for a Confluence space without changing them |
| Security check example | Required scopes |
|---|---|
| Keep maximum 5 space admins per space | read:space:confluence read:confluence-groups read:space.permission:confluence |
| Cursor scope | Explanation |
|---|---|
| Admin API Key | Provides programmatic access to administrative features, such as team management and monitoring, for all users within an organization. This feature is available on the Enterprise plan only.
|
| HubSpot scope | Explanation |
|---|---|
| files | Access the File Manager to upload, manage, and retrieve standard files stored in HubSpot |
| files.ui_hidden.read | View or download hidden/private user files, attachments, and system files from all HubSpot tools |
| cms.domains.read | View CMS domain settings and connected domains used for hosting HubSpot content |
| conversations.read | View conversation data such as inbox threads, messages, and associated metadata. |
| crm.objects.users.read | View CRM user records as objects, including their properties, for use in CRM associations and workflows. |
| settings.users.read | View HubSpot user settings and configuration details (for example, assigned permissions and preferences) without changing them |
| Security check example | Required scopes |
|---|---|
| Restrict public indexing of non-site files | files files.ui_hidden.read |
| Require HTTPS only on all connected domains | cms.domains.read |
| Ensure every user has an assigned permission set | settings.users.read crm.objects.users.read |
| Google Workspace scope | Explanation |
|---|---|
| Super admin | Indicates the integration or operation must be authorized by a Google Workspace super admin, who has full access to all Admin console and Admin API capabilities |
| https://www.googleapis.com/auth/admin.directory.user.readonly | Grants read‑only access to users in your domain, including basic profile and organizational information, via the Admin Directory API |
| https://www.googleapis.com/auth/admin.directory.group.readonly | Grants read‑only access to groups in your domain, including group settings and memberships, via the Admin Directory API |
| https://www.googleapis.com/auth/cloud-identity.policies.readonly | Grants read‑only access to Cloud Identity policies (such as access levels and security settings) applied across your organization |
| Security check example | Required scopes |
|---|---|
| Ensure Super Admin account recovery is enabled | https://www.googleapis.com/auth/admin.directory.user.readonly |
| Ensure login challenges are enforced | https://www.googleapis.com/auth/cloud-identity.policies.readonly |
| Ensure creating groups is restricted | https://www.googleapis.com/auth/admin.directory.group.readonly |
| Teams scope | Explanation |
|---|---|
| TeamworkAppSettings.Read.All | Allows an app to read organization-wide Microsoft Teams app settings (such as whether users can request app access), across the tenant with no write access |
| RoleManagement.Read.Directory | Allows an app to read directory role definitions and role assignments (who has which admin roles) in Microsoft Entra ID for the tenant |
| GroupSettings.Read.All | Allows an app to read all Microsoft 365 group settings (for example, creation rules, classification, and usage guidelines) across the organization |
| Policy.Read.All | Allows an app to read all directory and service policies (such as Teams, Exchange, and other Microsoft 365 policies) configured in the organization, without modifying them |
| Entra ID scope | Explanation |
|---|---|
| Policy.Read.All | Allows an app to read all directory policies in the tenant (for example, Conditional Access and other Entra ID policy objects) without modifying them |
| Application.Read.All | Allows an app to read all application registrations and service principals in the directory, including their properties and permissions |
| GroupSettings.Read.All | Allows an app to read all Microsoft 365 and Entra ID group settings across the directory, such as creation, classification, and usage policies |
| RoleManagement.Read.Directory | Allows an app to read directory role templates and role assignments, so it can see which admin roles exist and who is assigned to them |
| OneDrive scope | Explanation |
|---|---|
| SharePointTenantSettings.Read.All | Allows an app read tenant-level configuration settings for SharePoint Online and OneDrive, such as sharing, storage, and compliance settings, without making changes |
| RoleManagement.Read.Directory | Allows an app read Entra ID directory role definitions and assignments, so it can see which admin roles exist and which users or service principals have them |
| Security check example | Required scopes |
|---|---|
| Enforce domain allow-list for external sharing | SharePointTenantSettings.Read.All |
| Limit highly privileged access to least privilege | RoleManagement.Read.Directory |
| SharePoint scope | Explanation |
|---|---|
| SharePointTenantSettings.Read.All | Allows an app to read tenant‑level SharePoint and OneDrive settings (such as sharing and access policies) without changing them |
| RoleManagement.Read.Directory | Allows an app to read directory role definitions and role assignments in Entra ID, so it can see which admin roles exist and who has them |
| Security check example | Required scopes |
|---|---|
| Disable legacy authentication protocols | SharePointTenantSettings.Read.All |
| Ensure the number of Global Administrators is no more than five | RoleManagement.Read.Directory |
| Zendesk scope | Explanation |
|---|---|
| Read | Grants read‑only access to Zendesk resources (GET endpoints only), including permission to sideload related data but not create, update, or delete anything |
| BambooHR scope | Explanation |
|---|---|
| Token with admin privileges | Tthe API token was created by a user with full admin (or equivalent) access, so the token can view and edit all data and settings that this admin user can in the UI |
| Dropbox scope | Explanation |
|---|---|
| members.read | Allows an app to list and read basic information about Dropbox Business team members, such as names, emails, and member IDs, without changing anything |
| team_info.read | Allows an app to read high‑level metadata about the Dropbox Business team, including team name, ID, and overall settings, in a read‑only way |
| sessions.list | Allows an app to list active sessions and devices for users on the team so you can review who is logged in and from where, without terminating sessions |
| team_data.content.read | Allows an app to read team‑owned content (files and folders) across members’ accounts on a Dropbox Business team, but not modify or delete it |
| Security check example | Required scopes |
|---|---|
| Enforce Enterprise Mobility Management for device access | team_info.read |
| Limit highly privileged access to Access Control | members.read |
| Keep total active devices per user ≤ 5 | sessions.list |
| Team folders not set to “not synced” by default | team_data.content.read |
| Datadog scope | Explanation |
|---|---|
user_access_read | Allows viewing Datadog users, their roles, and access settings in the organization, without creating, changing, or deleting them |
| org_management | Allows viewing basic Datadog organization‑level details and which linked organizations can exchange or query data, without modifying org configuration |
| api_keys_read | Allows listing and reading Datadog API keys and application keys configured for the organization, without creating or revoking them |
| integrations_read | Allows viewing configured Datadog integrations and their settings so you can audit which external services are connected, without changing integration configs |
| Security check example | Required scopes |
|---|---|
| Limit highly privileged service accounts to no more than 3 | user_access_read |
| Require all webhooks to use HTTPS and include a custom secret header | integrations_read |
| Enforce SAML strict mode and disable IdP-initiated login | org_management |
| Disable remote config read on API keys unless required | api_keys_read |
| Deel HR scope | Explanation |
|---|---|
| users:read | View people data in Deel HR (users’ core profiles and employment information) without creating or editing it |
| people:read | View detailed worker records via the People APIs (including filters over employees/contractors) in a read‑only way |
| Security check example | Required scopes |
|---|---|
| Ensure personal email is not used as primary for active profiles | people:read |
| Ensure active users have a work email set for login | users:read |
| Miro scope | Explanation |
|---|---|
| organizations:teams:read | Read information about teams in a Miro organization, such as team lists, members, and team settings, without changing anything |
| organizations:read | Read high‑level organization information, including organization metadata and members, typically available only on Miro Enterprise plans |
| boards:read | Read board information and content metadata (e.g., basic board details and objects) without creating or editing boards |
| Security check example | Required scopes |
|---|---|
| No board should grant org/commenter default access | boards:read |
| Disable public link sharing for all teams | organizations:teams:read |
| Configure at least three org classification labels | organizations:read |
| Bitbucket scope | Explanation |
|---|---|
| account | Read access to the connected Bitbucket account, including account details, team memberships, and user settings. This scope allows DoControl to identify account-level misconfigurations across your Bitbucket environment. |
| repository | Read access to repositories within the connected Bitbucket workspace, including repository metadata, visibility settings, and membership. This scope allows DoControl to detect misconfigurations related to repository access and exposure. |
| repository:admin | Read access to repository administrative settings, including branch permissions, access keys, webhooks, and privileges. This scope allows DoControl to identify elevated permission misconfigurations and policy violations at the repository level. |
| Security check example | Required scopes |
|---|---|
| Detect Bitbucket workspace members who have not enabled two-step verification on their account | account |
| Detect Bitbucket repositories that are publicly accessible and exposed outside the organization | repository |
| Detect Bitbucket repositories with no branch permissions configured on the main or master branch | repository:admin |
| Monday.com scope | Explanation |
|---|---|
| me:read | Read access to the profile information of the authenticated user, including name, email, and account details. This scope allows DoControl to identify the connected user context within the Monday.com environment. |
| docs:read | Read access to Monday.com docs, including their content and sharing settings. This scope allows DoControl to detect misconfigurations related to document exposure and access permissions. |
| tags:read | Read access to tags applied across boards and items within the account. This scope allows DoControl to support classification and misconfiguration detection based on how content is labeled and organized. |
| teams:read | Read access to teams within the Monday.com account, including team membership and structure. This scope allows DoControl to identify misconfigurations related to team-level access and permission assignments. |
| users:read | Read access to user profiles and account membership across the organization. This scope allows DoControl to detect misconfigurations related to user provisioning, roles, and access levels. |
| assets:read | Read access to files and assets attached to Monday.com items and boards. This scope allows DoControl to identify exposed or improperly shared files within the environment. |
| boards:read | Read access to boards, their structure, columns, and items. This scope allows DoControl to detect misconfigurations related to board visibility and access controls. |
| accounts:read | Read access to account-level settings and configuration within Monday.com. This scope allows DoControl to monitor for organization-wide misconfigurations and policy gaps. |
| updates:read | Read access to updates and comments posted on Monday.com items. This scope allows DoControl to detect sensitive data exposure within item activity and communication threads. |
| webhooks:read | Read access to webhooks configured within the Monday.com account. This scope allows DoControl to identify unauthorized or misconfigured webhook connections that could expose data externally. |
| workspaces:read | Read access to workspaces and their settings, including membership and visibility. This scope allows DoControl to detect misconfigurations related to workspace access and organizational structure. |
| Security check example | Required scopes |
|---|---|
| Detect Monday.com users who have not completed their profile setup, including missing email verification | me:read |
| Detect Monday.com docs that have been shared externally outside of the organization | docs:read |
| Detect Monday.com boards and items that have no classification tags applied | tags:read |
| Detect Monday.com teams that have no designated owner assigned | teams:read |
| Detect active Monday.com users who have not enabled two-factor authentication on their account | users:read |
| Detect assets attached to Monday.com items that are accessible via public or guest-shared links | assets:read |
| Detect Monday.com boards that are set to public visibility and accessible outside the organization | boards:read |
| Detect Monday.com accounts where guest access is enabled without restrictions at the account level | accounts:read |
| Detect Monday.com items containing updates or comments that include sensitive information shared with external guests | updates:read |
| Detect Monday.com webhooks configured to send data to external or unrecognized URLs | webhooks:read |
| Detect Monday.com workspaces that are open to all account members without restricted access controls | workspaces:read |
| Anthropic scope | Explanation |
|---|---|
| read:spend_limits | Read access to spend limit and budget configurations across the connected Anthropic organization and its workspaces. This scope allows DoControl to identify misconfigurations related to missing, excessive, or improperly scoped spend limits that could expose the organization to unexpected usage costs. |
| read:analytics | Read access to usage and analytics data for the connected Anthropic organization, including API consumption, token usage, and activity trends by user, workspace, and API key. This scope allows DoControl to detect anomalous usage patterns that may indicate compromised credentials or policy violations. |
| read:compliance_activities | Read access to audit and activity logs recording administrative and user actions within the connected Anthropic organization, such as API key creation, role changes, and workspace modifications. This scope allows DoControl to identify unauthorized or high-risk activities and gaps in security oversight. |
| read:compliance_user_data | Read access to user account details within the connected Anthropic organization, including roles, permissions, and account status. This scope allows DoControl to detect misconfigurations related to excessive user privileges, inactive accounts, and improper access assignments. |
| read:compliance_org_data | Read access to organization and workspace-level data for the connected Anthropic account, including workspace structure, membership, and organizational hierarchy. This scope allows DoControl to identify misconfigurations related to unauthorized workspace membership and improper organizational access. |
| read:compliance_org_settings | Read access to organization-wide security and compliance settings for the connected Anthropic account, such as authentication policies, API key management settings, and data retention configurations. This scope allows DoControl to detect misconfigurations related to weak security policies and non-compliant organizational settings. |
| Security check example | Required scopes |
|---|---|
| Detect Anthropic workspaces or API keys with no spend limit configured | read:spend_limits |
| Detect anomalous spikes in API token usage that may indicate a compromised API key | read:analytics |
| Detect high-risk administrative actions (e.g., API key creation, permission escalation) that go unreviewed | read:compliance_activities |
| Detect Anthropic organization users with admin-level privileges who have been inactive for an extended period | read:compliance_user_data |
| Detect Anthropic workspaces with external or unauthorized members added | read:compliance_org_data |
| Detect Anthropic organizations without SSO or multi-factor authentication enforced | read:compliance_org_settings |
| Outlook scope | Explanation |
|---|---|
| MailboxSettings.Read | Read access to mailbox configuration settings across the connected Microsoft 365 organization, including inbox rules, automatic forwarding, and automatic-reply configurations. This scope allows DoControl to identify misconfigurations related to unauthorized or risky forwarding rules that could expose the organization to data exfiltration. |
| User.Read.All | Read access to user account details within the connected Microsoft 365 organization, including mailbox status, license assignment, and account state. This scope allows DoControl to detect misconfigurations related to inactive or disabled accounts that still retain active mailbox access. |
| Directory.Read.All | Read access to directory data for the connected organization, including distribution lists, mail-enabled groups, and directory role assignments. This scope allows DoControl to identify misconfigurations related to unauthorized external membership and improperly scoped group access. |
| Application.Read.All | Read access to registered applications and service principals within the connected organization, including the Microsoft Graph permissions granted to each. This scope allows DoControl to detect risky or unreviewed third-party applications that have been granted mail read or send access. |
| Auditlog.Read.All | Read access to directory and administrative audit logs recording actions within the connected organization, such as mailbox permission changes and admin role assignments. This scope allows DoControl to identify unauthorized or high-risk administrative activity and gaps in security oversight. |
| Policy.Read.All | Read access to directory and administrative audit logs recording actions within the connected organization, such as mailbox permission changes and admin role assignments. This scope allows DoControl to identify unauthorized or high-risk administrative activity and gaps in security oversight. |
| Security check example | Required scopes |
|---|---|
| Detect mailboxes with external auto-forwarding rules configured | MailboxSettings.Read |
| Detect inactive or disabled user accounts that still retain active mailbox access | User.Read.All |
| Detect distribution lists or mail-enabled groups with external or unauthorized members | Directory.Read.All |
| Detect third-party OAuth applications granted mail read or send permissions without admin review | Application.Read.All |
| Detect high-risk administrative actions (e.g., mailbox permission changes, admin role assignment) that go unreviewed | AuditLog.Read.All |
| Detect Microsoft 365 organizations without MFA or Conditional Access enforced for mail access | Policy.Read.All |