Assign Roles
To get access to reporting data through the API, one of the following roles must be assigned:
Security Reader
Security Administrator
Global Administrator
For a full list of roles that can manage Azure AD resources, see Azure AD built-in roles 
.