To fully scan a user should should be a ‘Global Reader’ and log into the installed Senserva application in their tenant. When available, it would be Senserva’s recommendation to use Privileged Identity Management (PIM) to enable this role while scanning.