When its free you are the product. What data are these companies mining from your tenant and what else beyond the "Free" reports do they do with that data?
These companies do not actually process your data or store your data. They’re essentially a wrap and you can see what permissions they have via the Oauth token when you approve the connection
You’re not giving them access to anything. Oauth is an authentication protocol that only grants specific and a very limited access to certain attributes. Of course, as with any third-party add-on depending on what the product does will determine access, so for example if you use a third-party back up to like Veam then it will need a large number of permissions. Other than that you don’t need to be paranoid 😊
