Permissions

What each thing you do actually needs, how often you need it, and how to hand the one-time permissions back when setup is done.

What signs in

Only the first is ours. The other two are created in your tenant, belong to you, and must stay.

	Maester Cloud Setup Ours	Maester Cloud SSO Yours	Runner app Yours
What it is for	Creates the other two apps and deploys your Azure resources	Signs your users in to Maester Cloud	Reads your tenant so Maester can assess it
Who uses it	You, only while setup is open in your browser	Your users, every time they open the portal	The runner, on every assessment run
Permissions	Microsoft Graph, delegated `openid` `profile` `User.Read` `Application.ReadWrite.All` `AppRoleAssignment.ReadWrite.All` Azure Resource Manager, delegated `user_impersonation`	Exposes, to the portal `access_as_user` Requested when a user signs in `openid` `profile` Microsoft Graph None. It holds no Graph permissions of its own.	Microsoft Graph, application `Directory.Read.All` `Policy.Read.All` `Reports.Read.All` 21 roles in total, every one of them a .Read role, with no write access anywhere.
Tenancy	Multi-tenant and Microsoft-verified	Single-tenant, created in your tenant	Multi-tenant by default, so other tenants can consent to it
Credentials	None. Tokens stay in the browser session and never reach a Maester Cloud server	None	A federated credential from the deployment's managed identity by default, so no secret and nothing to rotate. A Key Vault certificate is the alternative
Safe to remove?	Yes, once setup is done. That is what the panel at the bottom does	No. Deleting it breaks sign-in	No. It is how assessments run

Three ways to run setup

Every Microsoft Entra permission below is delegated. The setup app can only ever do what the signed-in administrator could already do, and it can do none of it once they sign out. The three approaches differ in how much you do by hand and how much privilege stays consented afterwards.

	Express Setup does everything	Balanced Consent once, hand it back	Least privilege No privileged consent at all
Azure	Contributor on the subscription, so setup creates the resource group	Contributor on one resource group you created yourself	Contributor on one resource group you created yourself
Microsoft Entra	Global Administrator	Global Administrator, for the length of the run only	None. You create both apps yourself in the Entra admin center
Setup app afterwards	Stays consented, so setup can grant new roles later without asking again	You delete its enterprise application, which takes Application.ReadWrite.All and AppRoleAssignment.ReadWrite.All out of your tenant. Your deployment and your own two apps are untouched	Never consented, so it holds nothing in your tenant to begin with
Manual work	None	One removal at the end, done on this page	Both apps by hand, plus an admin grant for the runner roles, and again for every future role change
PowerShell instead	Available, though the browser app is the quicker route here	Or run Maester Cloud PowerShell: the same setup with no consent to our app at all. The only cost is running PowerShell locally	Also avoids the consent question, though you still create both apps by hand
Trade-off	The consent stays until you remove it. It is delegated only, so the app can act just as a signed-in administrator and never on its own: nothing happens while nobody is using it	You consent again whenever an app is created or a new release needs a new read role	Setup cannot help when a new Maester release needs a new read role
Best when	You want upgrades to stay one click, including when new Maester tests need new read roles	You will grant privilege for an afternoon but not leave it standing	Your identity team owns app registrations, or policy forbids third-party consent

Running it from PowerShell is covered at the bottom of this page.

What needs what

Every permission below is delegated, so the app can only ever do what the signed-in account could already do. None of it is application permission, and none of it keeps working after you sign out.

Sign in to this setup app (every time)

Reads your own profile so the app can show which account is signed in. It reads nothing else about your directory.

User.Read on Microsoft Graph

Deploy or update your Azure resources (every release)

This is the one you will do again and again: each new version of Maester Cloud is picked up by re-running the deployment. It touches Azure only. No Microsoft Entra permission is involved, and none of the one-time permissions below are needed to stay on the latest version.

user_impersonation on Azure Resource Manager

Create the Maester Cloud SSO app (once)

Creates the single-tenant Entra app your users sign in to Maester Cloud with, and exposes its access_as_user scope. Done once, when you first set up the portal. If your identity team owns app registrations, they can create it instead and you attach its IDs, in which case setup never needs this permission at all.

Application.ReadWrite.All on Microsoft Graph (one-time)

Create the runner app and grant its roles (once)

Creates the app registration Maester Cloud reads your tenant with, adds its federated identity credential, and grants it 21 read-only Microsoft Graph application roles. Granting those roles is the single most privileged thing setup does, and it happens once per deployment.

Application.ReadWrite.All on Microsoft Graph (one-time)
AppRoleAssignment.ReadWrite.All on Microsoft Graph (one-time)

Add another tenant for Maester Cloud to read (once per tenant)

The runner app is multi-tenant by default, so a second tenant joins by having its own administrator grant admin consent to that same app. That consent happens in the other tenant, by that tenant’s admin, against your runner app. This setup app is not involved and needs no permission there.

Admin consent in the other tenant on Your runner app

Whichever you pick, the setup app checks the token you actually hold rather than demanding the maximum: app creation is accepted with AppRegistration.Create or Application.ReadWrite.OwnedBy, and reads with Application.Read.All or Directory.Read.All.

Why the one-time permissions can go

Application.ReadWrite.All and AppRoleAssignment.ReadWrite.All exist for three one-time jobs:

Create the Maester Cloud SSO app.
Create your runner app.
Grant the runner app its read-only Graph roles.

Once those exist:

A running Maester Cloud never uses either permission again.
It runs on the runner app's own read-only roles.
Your regular version updates are Azure-only.

Remove the one-time permissions from Maester Cloud Setup

This removes Application.ReadWrite.All and AppRoleAssignment.ReadWrite.All from the Maester Cloud Setup app in your tenant: the two one-time permissions it needed to create your apps and grant the runner its roles. Your deployment, Maester Cloud SSO, and your runner app keep working, because they are separate objects that you own.

Both routes are done by you in the Microsoft Entra admin center rather than by this app, which is deliberate: revoking a single permission is something the portal can do and an app cannot, because dropping one grant through the API needs DelegatedPermissionGrant.ReadWrite.All.

Start by opening Enterprise applications and searching for Maester Cloud Setup. Inside the setup app these steps link straight to the application, because a signed-in session knows its object id.

	Revoke one permission Drop only what you choose	Remove the whole app Revokes everything at once
In the Entra portal	Open Maester Cloud Setup, from the link above or by searching Enterprise applications. Go to Security › Permissions, then the Admin consent tab. On the row for the permission you want gone, open the row menu and choose Revoke permission.	Open Maester Cloud Setup, from the link above or by searching Enterprise applications. Go to Properties. Choose Delete, then confirm.
What it leaves	Everything you did not revoke stays. Revoking only AppRoleAssignment.ReadWrite.All is the useful middle ground: setup can still read and repair your apps, but can no longer grant Graph roles.	Nothing. The consent record goes with the application. It sits in the recycle bin for 30 days, so a mistake is recoverable.
Next time you run setup	You are asked to consent again only for what you revoked.	You consent again from scratch.

Removing the whole application also ends any setup session that is open: once the enterprise application is gone, no new tokens can be issued for it in your tenant. Finish your deployment first.

Running setup from PowerShell

The MaesterCloud module ships the same setup app. It serves it from a temporary port on your own machine and signs in using the Azure CLI and Microsoft Graph PowerShell applications, which are Microsoft's own. Your tenant never consents to a Maester Cloud application, so none of the one-time permissions on this page are ever granted to us.

Install the module. This needs PowerShell 7.2 or later; nothing else has to be installed first.

Install-Module MaesterCloud -AllowPrerelease -Scope CurrentUser

Then start setup. This opens the wizard in your browser on a random localhost port.

Start-MaesterCloudSetup

From there the steps are identical: sign in to Azure, deploy, configure portal sign-in, and create the runner app. The Azure and Microsoft Entra roles above are the same, because they describe what your account can do, not which client asked.