Before you let any tool into a tenant you should be able to read what it asks for. This page lists it all. The permissions are given to an app registration your organization owns, or to your own sign-in; none of them is given to us.
Each one asks only for what that moment needs.
Signs in as you, with delegated read permissions of Microsoft Graph. The app can never read more than your own account may read. Exchange Online, Teams and Power Apps offer no read-only permission, so those three follow your administrator role; during a backup the app only reads.
Runs without a person, through a second registration with read permissions, the directory role Global Reader, and a certificate whose private key stays on your computer.
Signs in on its own, at the moment you confirm the preview, and asks for write permissions for the items you selected and nothing else. The sign-in is discarded afterward.
Creates the registration in your tenant. It needs two powerful permissions for a few minutes, shows you every line before anything is written, and removes those two from your consent again at the end.
The recommended setup creates an app registration named "365 Rewind (sign-in)" in your tenant. It is a public client for a single organization with the redirect address http://localhost. It has no client secret and no certificate, so there is nothing to steal from it: it only works together with a person who signs in. All its permissions are delegated.
You can also skip the setup. The app then signs in through Microsoft's own tools (Quick start), with the same read permissions.
Every name below is a read permission. The app refuses to put a write permission of Microsoft Graph on this registration; the rule is built in and cannot be switched off. A permission your tenant does not offer, for example one that belongs to a license you do not have, is left out and reported.
AccessReview.Read.AllAgentIdentityBlueprint.Read.AllAgreement.Read.AllAppCatalog.Read.AllApplication.Read.AllAttackSimulation.Read.AllAuthenticationContext.Read.AllBackupRestore-Configuration.Read.AllBackupRestore-Control.Read.AllBrowserSiteLists.Read.AllChannel.ReadBasic.AllCloudPC.Read.AllConfigurationMonitoring.Read.AllCopilotPackages.Read.AllCopilotSettings-LimitedMode.ReadCustomAuthenticationExtension.Read.AllCustomDetection.Read.AllCustomSecAttributeDefinition.Read.AllDeviceManagementApps.Read.AllDeviceManagementCloudCA.Read.AllDeviceManagementConfiguration.Read.AllDeviceManagementManagedDevices.Read.AllDeviceManagementRBAC.Read.AllDeviceManagementScripts.Read.AllDeviceManagementServiceConfig.Read.AllDirectory.Read.AllDomain-InternalFederation.Read.AllDomain.Read.AllEntitlementManagement.Read.AllEventListener.Read.AllExternalConnection.Read.AllIdentityProvider.Read.AllIdentityUserFlow.Read.AllLifecycleWorkflows-CustomExt.Read.AllLifecycleWorkflows-Workflow.Read.AllLifecycleWorkflows.Read.AllMultiTenantOrganization.Read.AllNetworkAccess.Read.AllNetworkAccessPolicy.Read.AllOnPremDirectorySynchronization.Read.AllOrganization.Read.AllOrgSettings-AppsAndServices.Read.AllOrgSettings-DynamicsVoice.Read.AllOrgSettings-Forms.Read.AllOrgSettings-Microsoft365Install.Read.AllOrgSettings-Todo.Read.AllPeopleSettings.Read.AllPlace.Read.AllPolicy.Read.AllPolicy.Read.B2BManagementPolicyPolicy.Read.DeviceConfigurationPolicy.Read.HybridAuthenticationPolicy.Read.PermissionGrantPublicKeyInfrastructure.Read.AllReportSettings.Read.AllRoleAssignmentSchedule.Read.DirectoryRoleEligibilitySchedule.Read.DirectoryRoleManagement.Read.DefenderRoleManagement.Read.DirectoryRoleManagementAlert.Read.DirectoryRoleManagementPolicy.Read.DirectorySearchConfiguration.Read.AllSecurityEvents.Read.AllSecurityIdentitiesAutoConfig.Read.AllSecurityIdentitiesSensors.Read.AllSharePointTenantSettings.Read.AllSites.Read.AllTeamSettings.Read.AllTeamTemplates.ReadTeamworkAppSettings.Read.AllTermStore.Read.AllUser.ReadUser.Read.AllTwo of these deserve a note. Sites.Read.All is used for one thing: finding the address of your SharePoint admin center. The app reads no site, list or file. User.Read.All and Directory.Read.All are used to show the names of the people and groups a policy refers to.
Microsoft adds openid, profile and offline_access to every sign-in of a person. They identify you and keep the sign-in alive while the app is open; they are not permissions of an interface.
| Microsoft service | Permission | What it allows |
|---|---|---|
| Office 365 Exchange Online | Exchange.Manage | What your Exchange administrator role allows. Also serves Security & Compliance (Defender and Purview policies), which publishes no permission of its own. |
| Skype and Teams Tenant Admin API | user_impersonation | What your Teams administrator role allows. |
| Power Apps Service | User | What your Power Platform administrator role allows. |
| Power Platform API | EnvironmentManagement.Environments.Read, EnvironmentManagement.Groups.Read, EnvironmentManagement.Settings.Read, Licensing.BillingPolicies.Read | Read-only. |
Microsoft offers no read-only permission for the first three, so they let the app do what the signed-in administrator may do. During a backup the app only reads: it runs the read commands of its settings catalog, which we sign with a key that is kept offline and is not on the portal server. The app verifies that signature with a key built into it before it uses the catalog, and runs only commands of Microsoft's modules for these services. To keep it narrower still, sign in for backups with an account that holds only reader roles.
Scheduled backups are optional. When you switch them on, the app creates a second registration, "365 Rewind (unattended)", for a single organization, with no redirect address and no client secret. It holds:
Exchange.ManageAsApp on Exchange Online and on Security & Compliance. This permission does nothing by itself; what the registration may do there is decided by its role.Some settings can only be read by a signed-in person. A scheduled backup skips them and a backup you start reads them; the coverage page says which.
No write permission of Microsoft Graph is held between restores. When you confirm a restore, the app signs in again and asks for the write permissions of the selected items only: restoring a Conditional Access policy asks for Policy.ReadWrite.ConditionalAccess, not for the right to change Intune. The consent is yours alone, not one for the whole organization, and the sign-in is thrown away when the restore ends.
Creating a registration needs a person who is a Cloud Application Administrator, an Application Administrator or a Global Administrator. The setup signs in through Microsoft's "Microsoft Graph Command Line Tools" and asks for:
Application.ReadWrite.All, to create the registration.DelegatedPermissionGrant.ReadWrite.All, to give it consent for the read permissions.Organization.Read.All and User.Read, to show which tenant and which account you are signed in to.AppRoleAssignment.ReadWrite.All and RoleManagement.ReadWrite.Directory, to give the unattended registration its permissions and the Global Reader role.Before anything is written you see the plan, line by line: what is created, what is granted, what is kept. You confirm by typing a domain of the tenant. As its last step the setup removes these powerful permissions from your consent on Microsoft's tool again, so they do not linger after the few minutes they were needed.
In the app, Settings removes each registration with its consents, its role, its certificate and the scheduled task, and shows the same kind of plan first. You can also delete the registrations yourself in the Entra admin center, under App registrations; both carry the tag 365Rewind so they are easy to find. Microsoft keeps a deleted registration restorable for 30 days.
Nothing that opens your tenant. No password, token, client secret or certificate ever reaches 365 Rewind, and there is no multi-tenant app of ours to consent to. The security page explains where backups are kept and how they are encrypted.