This Knowledge Base article provides the app registrations and permissions that are required to connect the Defend console to your email infrastructure.

During installation, admins must agree to grant permissions to link to Microsoft 365 app registrations as part of setup in the Deployment Center. Some new features may require you to relink the app registration. You can do this from the Settings page in Defend.

For new installations, Defend uses a single app registration, the KnowBe4 Inbound Email Security app registration by default. If you enable message security,  Defend switches to the single KnowBe4 Collaboration Security app registration, which replaces the separate User Analysis and Admin Features app registrations below. For older deployments, you can migrate to the single app registration from your Settings page.

Most permissions below are required for core Defend functionality. A few are tied to specific features or feature sets. When that's the case, it's called out in the Permission Details section that follows the table.
 

Permission Details

Permission consent for the KnowBe4 Collaboration Security app registration happens all at once, at the app level. When you link this single app, you consent to its full permission list together. You can't grant a subset (for example, keeping MailboxSettings.Read but declining MailboxSettings.ReadWrite) while still linking this app. The "narrower alternative" notes below describe the minimum technical scope a feature needs, not a consent choice available within this app.

MailboxSettings.ReadWrite

Used for: The Microsoft Outlook categories feature. When enabled, Defend creates its own master category in each user's mailbox so that messages it has tagged (for example, as phishing) show up with a visible label in Microsoft Outlook.

Why write access is required: Microsoft Graph only allows master categories to be created with the write permission. MailboxSettings.Read alone can't create them. If your tenant isn't using Microsoft Outlook categories, this write access isn't needed.

Side effect: MailboxSettings.ReadWrite includes everything MailboxSettings.Read covers. Because of this, granting it also satisfies the read access Defend needs for mailbox breakdown reporting, so you only need to consent to one permission rather than two.

Narrower alternative: MailboxSettings.Read alone is sufficient if you don't use Microsoft Outlook categories. You would still get mailbox breakdown reporting, just not the Outlook category labels. However, this isn't a choice you can make in the KnowBe4 Collaboration Security app registration; it's a full permission set that includes MailboxSettings.ReadWrite is granted together. This narrower option applies only if you're using the legacy User Analysis app registration, which requests MailboxSettings.Read only.

Files.Read.All - Read files in all site collections

This permission is read-only. It's used to scan attachments shared in Microsoft Teams: Teams messages carry a link to the file rather than the file itself, so Defend follows that link, copies the file to storage, scans it with BitDefender antivirus, and deletes the copy.

It's only requested from customers using Defend for both email and Microsoft Teams. If you're using Defend for email alone, it's never requested.

Narrower alternative considered: Sites.Selected was evaluated, but it doesn't work here. It requires an admin to grant access on a per-site basis, and a Microsoft Teams attachment can live in any user's OneDrive, so there's no fixed set of sites to select in advance.