Microsoft 365 Permissions¶

When you connect a Microsoft 365 tenant to SaaS Backup, Slide creates three apps in it, named with the prefix Slide Backup. Each app holds only the Microsoft Graph permissions its job needs, and Slide writes data into Microsoft 365 only through the restore app. This page lists every permission each app holds and what Slide uses it for. You see the same permissions in the Microsoft Entra admin center under Enterprise applications, and in security reviews.

App	Used for	What Slide does with it
General	Discovery, connecting the tenant, and renewing its own credential	Reads data
Backup	Backups	Reads data
Restore	Restores to Microsoft 365	Reads and writes data

All of these are application permissions: the apps act as themselves, not as a signed-in user. Each app gets its own access token, so a backup never runs with the restore app's write access.

The only delegated permissions are the ones you approve when you sign in during setup. See Permissions You Approve During Setup.

General App¶

The general app finds what's in the tenant. It can't read mail or Teams messages.

Permission	What Slide uses it for
`User.Read.All`	Find the tenant's users and their licenses
`MailboxSettings.Read`	Tell shared mailboxes apart from user mailboxes
`Group.Read.All`	Find Microsoft 365 groups
`GroupMember.Read.All`	Read who belongs to each group
`Sites.Read.All`	Find SharePoint sites. This permission can also read site and OneDrive files, but discovery uses it only to list sites.
`Team.ReadBasic.All`	Find the tenant's teams
`Organization.Read.All`	Read the tenant's name, domains, and license information when you connect it
`Application.ReadWrite.OwnedBy`	Renew this app's own credential. It can only change apps it owns.

Backup App¶

The backup app reads data so Slide can back it up. Slide never uses it to change your data in Microsoft 365. One of its permissions, MailboxItem.ImportExport.All, also allows importing items into mailboxes, because Microsoft doesn't offer an export-only permission. Slide uses it only to export.

Mail¶

Permission	What Slide uses it for
`MailboxFolder.Read.All`	Read a mailbox's folders
`MailboxItem.Read.All`	Read mail, calendar items, contacts, and tasks
`MailboxItem.ImportExport.All`	Export full copies of mailbox items. Microsoft doesn't offer an export-only permission yet, so Slide holds the import-and-export one and uses it only to export.
`MailboxSettings.Read`	Read mailbox settings, such as automatic replies and inbox rules

OneDrive and SharePoint¶

Permission	What Slide uses it for
`Sites.Read.All`	Read OneDrive files and SharePoint sites

Teams¶

Permission	What Slide uses it for
`Team.ReadBasic.All`	Read each team's name and description
`TeamMember.Read.All`	Read each team's members
`TeamSettings.Read.All`	Read each team's settings
`Channel.ReadBasic.All`	Read each team's channels
`ChannelMember.Read.All`	Read the members of private and shared channels
`ChannelMessage.Read.All`	Read channel messages and replies
`ChannelSettings.Read.All`	Read channel settings
`TeamsTab.Read.All`	Read the list of tabs in each channel
`TeamsActivity.Read.All`	Read Teams activity
`TeamsUserConfiguration.Read.All`	Read users' Teams configuration
`Chat.Read.All`	Read Teams chats. Not used by Slide today.

Entra ID¶

Permission	What Slide uses it for
`User.Read.All`	Read users
`User-LifeCycleInfo.Read.All`	Read each user's leave date
`Group.Read.All`	Read groups
`GroupMember.Read.All`	Read group owners and members
`Directory.Read.All`	Read the rest of the directory, such as users' full profiles
`RoleManagement.Read.Directory`	Read directory roles and who holds them
`Application.Read.All`	Read app registrations and enterprise applications
`DelegatedPermissionGrant.Read.All`	Read the delegated permissions users and admins have granted to apps
`Device.Read.All`	Read devices
`BitlockerKey.Read.All`	Read BitLocker recovery keys
`Policy.Read.All`	Read Conditional Access policies. Slide uses this permission only to read Conditional Access policies.
`AuditLog.Read.All`	Read Entra audit, sign-in, and provisioning logs

Other¶

Permission	What Slide uses it for
`Tasks.Read.All`	Read Planner plans and To Do tasks
`Application.ReadWrite.OwnedBy`	Renew this app's own credential. It can only change apps it owns.

Restore App¶

The restore app writes data back into Microsoft 365. Apart from renewing its own credential, Slide uses it only when you start a restore. It's never used for discovery or backups.

Mail¶

Permission	What Slide uses it for
`User.Read.All`	Look up the mailbox to restore into
`MailboxFolder.ReadWrite.All`	Create the SlideRestore folder that restored mail goes into
`MailboxItem.ImportExport.All`	Import restored mailbox items
`MailboxSettings.ReadWrite`	Restore mailbox settings, such as automatic replies and inbox rules

OneDrive and SharePoint¶

Permission	What Slide uses it for
`Files.ReadWrite.All`	Restore OneDrive and SharePoint files, and give a new document library the original library's permissions
`Sites.ReadWrite.All`	Upload large files, restore SharePoint list items and pages, and remove access a new document library shouldn't have
`Sites.Manage.All`	Recreate SharePoint lists

Teams¶

Permission	What Slide uses it for
`Team.Create`	Recreate a team
`TeamMember.ReadWrite.All`	Restore a team's members
`Channel.Create`	Recreate a channel
`ChannelSettings.ReadWrite.All`	Restore channel settings
`Teamwork.Migrate.All`	Import restored messages with their original dates
`Chat.Create`	Recreate a chat. Not used by Slide today.
`ChatMember.ReadWrite.All`	Restore a chat's members. Not used by Slide today.

Entra ID¶

Permission	What Slide uses it for
`User.ReadWrite.All`	Recreate users and restore their properties
`User.DeleteRestore.All`	Bring back users from Entra's deleted items
`Group.ReadWrite.All`	Recreate groups and restore their owners and members
`Device.ReadWrite.All`	Add devices back as members of restored groups. Slide doesn't create or change devices.
`OrgContact.Read.All`	Add organizational contacts back as members of restored groups
`RoleManagement.ReadWrite.Directory`	Restore directory role assignments
`Application.ReadWrite.All`	Restore app registrations and enterprise applications. See Why Restore Manages App Registrations.
`AppRoleAssignment.ReadWrite.All`	Restore the application permissions granted to apps
`DelegatedPermissionGrant.ReadWrite.All`	Restore the delegated permissions granted to apps. See Why Restore Manages App Registrations.
`Policy.Read.All`	Read Conditional Access policies. Slide uses this permission only to read Conditional Access policies.
`Policy.ReadWrite.ConditionalAccess`	Restore Conditional Access policies

Other¶

Permission	What Slide uses it for
`Tasks.ReadWrite.All`	Restore Planner plans and To Do tasks

Why Restore Manages App Registrations¶

Two of the restore app's permissions cover every app registration in the tenant, not just Slide's own:

Application.ReadWrite.All lets the restore app create and update any app registration in the tenant. Slide needs it to bring back app registrations and enterprise applications that were deleted or changed. The restore app also uses it to renew its own credential.
DelegatedPermissionGrant.ReadWrite.All lets the restore app grant delegated permissions to apps. When Slide restores an app registration, it uses this permission to put back the permissions users and admins had granted to that app. Without it, someone would have to grant each restored app's permissions again by hand.

Both are held only by the restore app. Apart from the restore app renewing its own credential, Slide uses them only during a restore that you start. Microsoft Entra records every change they make in the tenant's Entra audit log.

Permissions You Approve During Setup¶

When you connect a tenant, you sign in to Microsoft and approve these delegated permissions. Slide uses them only during setup, to create the three apps above.

Permission	What Slide uses it for
`Application.ReadWrite.All`	Create the three Slide Backup apps and their credentials
`AppRoleAssignment.ReadWrite.All`	Grant each app the permissions listed on this page
`Directory.Read.All`	Make each app the owner of its own registration, so it can renew its own credential
`DelegatedAdminRelationship.Read.All`	List your clients' tenants. It's requested for every connection, but Slide only uses it when you connect through Multi-Tenant (GDAP).
`openid`, `email`, `profile`, `offline_access`	Sign you in to Microsoft. With Multi-Tenant (GDAP), they also keep you signed in long enough to set up each client tenant: Slide keeps this sign-in for up to an hour after you approve, then discards it.
Partner Center `user_impersonation`	Multi-Tenant (GDAP) only. List your clients in Partner Center and approve Slide's setup app in each client tenant.

Microsoft shows the sign-in permissions on the approval screen as "Sign in as you", "View your email address", "View your basic profile" and "Maintain access to data you have given it access to". Which of them it lists can differ between Single Tenant and Multi-Tenant (GDAP). Partner Center user_impersonation shows as "Access Partner Center", only for Multi-Tenant (GDAP).

Slide's Setup App¶

You approve these permissions for Slide's setup app, which Microsoft shows as Slide SaaS Backup, published by Project Orca inc (a Microsoft-verified publisher). Approving them adds the setup app to the client tenant, where it can briefly show up under Enterprise applications next to the three Slide Backup apps. Its name is close to theirs, but it's a separate app: the three Slide Backup apps are named Slide Backup (general), Slide Backup (backup) and Slide Backup (restore), each followed by an ID. With Single Tenant, you approve the setup app when you sign in. With Multi-Tenant (GDAP), Slide approves it in each client tenant through Partner Center, with every permission above except DelegatedAdminRelationship.Read.All.

Slide uses the setup app only to connect or re-authorize a tenant. It's temporary: it adds the three Slide Backup apps to the client tenant, and Slide removes it once setup is done. Backups and restores never use it, and the three Slide Backup apps renew their own credentials. If any of the three Slide Backup apps is removed from the client tenant, backups and restores fail until you re-authorize the tenant, which adds it again.