What priviledges are required for an AppID to scan SharePoint Online

For Sharepoint Online, you need these permissions:

You also need to add the XML permissions shown here on the Sharepoint Admin site

learn.microsoft.com/.../security-apponly-azureacs

Please open a support case if you need more assistance.

Edit: I see you have a related case open already. If the information above doesn't help, I'll be the one getting the case.

Thanks Greg,

I have a question on that article:

I was a little thrown by how the XML code had sharepoint/.../tenant in the file.  Should I have left that exact coding?  I thought it was just an example so I replace it with mydomanname.sharepoint.com/.../tenant. Was that correct or should I have left it as is?

Hi Jordan,

Leave it exactly as shown in the support article. It's more of a generic reference. I've had customers change as you suggested, but then it doesn't work.

We can schedule a live support call and review if you'd prefer.
You can respond on the open support case and I'll be picking that up soon.

OK.  Got it to work. My problem was not going to https://{mytenant}-admin.sharepoint.com/_layouts/15/appinv.aspx.  I was trusting it at the non-admin site.  After trusting the app in the right spot, the scanning started working.

Thanks Greg!

No worries, that's why I get the big bucks! (I wish!).