Per-customer consent
Each customer's Global Admin approves each module for their own tenant, on Microsoft's consent screen, and the wizard assigns the view-only Global Reader role from their own browser. No shared credentials, no standing admin access, and the customer can revoke it whenever they like.