Created by Claude - please verify

E5 value - composite of existing caches, Defender hunting queries and light checks; each capability is checked independently.

Required Microsoft Graph permissions

Organization.Read.All RoleManagement.Read.Directory Policy.Read.All AccessReview.Read.All AttackSimulation.Read.All eDiscovery.Read.All InformationProtectionPolicy.Read.All SecurityIdentitiesSensors.Read.All ThreatHunting.Read.All — application permissions, granted to the app registration with admin consent.

Licence: E5-class licences (the report shows what is used whatever you own).

Endpoints: GET /v1.0/subscribedSkus · cached: PIM, CA policies, access reviews, attack simulations, eDiscovery cases · GET /beta/security/informationProtection/sensitivityLabels · GET /beta/security/identities/sensors · POST /v1.0/security/runHuntingQuery (DeviceInfo, CloudAppEvents)

A capability that cannot be checked (missing permission) is shown as 'unknown', not as unused.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

E5 Value Realisation

Microsoft 365 E5 costs substantially more than E3 because of PIM, Identity Protection, Defender for Office 365 P2, Defender for Endpoint P2, Defender for Identity, Defender for Cloud Apps and Purview Premium. If those capabilities are not switched on and used, the organisation pays for them anyway. Use this at renewal - or to justify E3 plus the add-ons you actually use.