Permissions
Read-only. Every permission explained.
Halberd requests only read application permissions in Microsoft Graph. It never creates, changes or deletes anything in a client tenant.
| Permission | Why Halberd needs it |
|---|---|
| Directory.Read.All | List users, guests and groups, and see who is enabled, disabled or licensed (user access control). |
| Policy.Read.All | Read Security Defaults, Conditional Access, and the user-consent setting to confirm MFA is enforced. |
| UserAuthenticationMethod.Read.All | See which MFA methods each user has registered (not the secrets themselves). |
| AuditLog.Read.All | Read sign-in activity to find inactive accounts and legacy-authentication sign-ins (needs Entra ID P1). |
| Application.Read.All | List third-party cloud apps connected to the tenant and the permissions granted to them (cloud services in scope). |
| RoleManagement.Read.Directory | See who holds privileged admin roles such as Global Administrator. |
| DeviceManagementManagedDevices.Read.All | Read Intune device OS versions and last sync time for security update checks (only used when Intune is present). |
| Organization.Read.All | Read the tenant name, verified domains and licences to confirm the right tenant and which checks can run. |
Removing access
A client can remove Halberd at any time: Microsoft Entra admin center → Enterprise applications → Halberd by Aspenfy → Properties → Delete. MSPs can also disconnect a client inside Halberd.
Important: Halberd is a readiness aid and does not issue or guarantee Cyber Essentials certification. Certification is awarded only by an IASME-licensed certification body after assessment. Halberd is not affiliated with or endorsed by the NCSC or IASME.
See where a client stands in minutes
Free Cloud scope & MFA check for one client tenant. No card needed.