Requirements

Everything 1Security needs from your tenant, in one place: the license check that runs at connect time, the admin roles involved, the exact permissions each module requests, and the handful of things that genuinely need a premium Microsoft SKU.

The headline: 1Security runs on a standard Microsoft 365 license. There is no agent to install, no appliance, no log forwarder, and no E5 requirement for the core product.

Microsoft 365 licensing

The one hard requirement

Your tenant needs at least one user with a license that includes SharePoint Online. That is the whole check. 1Security verifies it at connect time and blocks with "Your tenant does not have the required license" if no qualifying subscription is found.

Any of these qualify (the list is matched on subscription SKU, so equivalents and regional variants count too):

What needs nothing extra

These all work on Business Basic - no E5, no add-ons, no premium sign-in logs:

• The full permission graph - users, groups, sites, files, apps, agents, devices.
• Sensitivity scanning with 1Security's own engine (300+ detectors, OCR included).
• Up to three years of activity history, well past Microsoft's default retention.
• Location intelligence - enrichment runs locally, no premium sign-in log add-on.
• Devices, including unregistered and shadow devices.
• Automations and the whole remediation layer.

What needs a premium Microsoft SKU

Four features depend on something Microsoft itself puts behind a higher tier. Each one degrades on its own - the rest of the platform is unaffected.

Admin roles

Directory roles 1Security assigns to itself

Two modules need a Microsoft role on their own service principal, because the underlying API is Exchange-based rather than Graph-based. This is why those modules request RoleManagement.ReadWrite.Directory - it is used to make exactly one assignment, to 1Security's own application:

• Audit module - assigns Exchange Administrator to the audit app's service principal, so it can read the unified audit log configuration through Exchange Online PowerShell.
• Purview module - the same permission pattern, paired with the Content Explorer List Viewer role-group membership above.

Tenant settings

• Unified audit log must be turned on. It is on by default in most tenants. 1Security checks its status and, once the audit module is connected, can turn it on for you - or you can do it yourself first, see Microsoft's guide. Without it, Microsoft records no activity for anyone to read, so the Activity Logs screen stays empty.
• No other tenant configuration is required. No mail flow rules, no conditional access exceptions, no service accounts, no mailbox impersonation.

Permissions, module by module

1Security follows least privilege literally: the base install is read-only, and every capability that needs more permission is a separate consent you grant only if you want the feature. Write access exists in exactly two modules, both opt-in.

Core visibility - read-only, granted at install

Microsoft Graph:

User.Read.All                      Group.Read.All
GroupMember.Read.All               Directory.Read.All
Files.Read.All                     Sites.Read.All
Organization.Read.All              Application.Read.All
Team.ReadBasic.All                 Reports.Read.All
Insights-UserMetric.Read.All       UserAuthenticationMethod.Read.All
AuditLog.Read.All                  SecurityAlert.Read.All
SecurityIncident.Read.All          Sites.FullControl.All
AuditLogsQuery.Read.All            (optional - historical audit backfill only)

SharePoint:

Sites.Read.All
User.Read.All
Sites.FullControl.All

Audit log

Office 365 Management API:  ActivityFeed.Read, ActivityFeed.ReadDlp
Microsoft Graph:            RoleManagement.ReadWrite.Directory

The Graph permission is used only for the Exchange Administrator self-assignment described above.

Purview

Microsoft Graph:  RoleManagement.ReadWrite.Directory

Plus membership of the Content Explorer List Viewer role group in Purview.

Email visibility

Mail.Read
Domain.Read.All

Read-only access to mailbox contents. Message bodies and attachments are read during analysis, not stored.

Mailbox management (optional, write)

Mail.ReadWrite

Granted separately from email visibility - you can read mailboxes without ever allowing changes. Lets an automation quarantine or flag a message rather than only alerting on it. No permanent deletion.

Automations (optional, write)

Microsoft Graph:  Files.ReadWrite.All, Group.ReadWrite.All,
                  GroupMember.ReadWrite.All, User.ReadWrite.All
SharePoint:       Sites.FullControl.All

The only module that can change anything in your tenant. Actions are staged behind review queues and grace periods - see Automations.

Copilot agents (optional)

CopilotPackages.Read.All   (delegated, on the read app)

Delegated rather than application permission, which is why Microsoft validates the license of the single admin who connected the tenant rather than every user. See Agents.

Clients and network

• Browser - Chrome, Edge, Firefox or Safari, last two major versions. Nothing to install: no extension, no desktop agent, no endpoint software.
• Cloud (SaaS) - nothing to open on your side. 1Security calls Microsoft, not your network.
• BYOC and On-Premise - the deployment needs outbound HTTPS (443) to the Microsoft endpoints 1Security calls: login.microsoftonline.com, graph.microsoft.com, manage.office.com, <tenant>.sharepoint.com and <tenant>-my.sharepoint.com, plus the Exchange Online and Security & Compliance PowerShell endpoints (outlook.office365.com, *.compliance.protection.outlook.com) used by the audit and Purview modules. Hardware and Azure resource sizing is in Installation.

When a prerequisite is missing