Graph permissions
Microsoft's edit ·
Microsoft's commit message in microsoftgraph/microsoft-graph-docs-contrib · commit 2c40e31 · +3 −2 lines · also on GitHub
⋯ 114 unchanged lines
115115
For example, a group can have users, groups, applications, service principals, devices, and contacts as members. An app is granted the *GroupMember.Read.All* least privileged permission to [List group members](/graph/api/group-list-members). In the response object, only the **id** and **@odata.type** properties are populated for all the members that are returned. The other properties are indicated as `null`. For this API:
116116
- To read the basic properties of a group's members that are users, the app needs at least the *User.ReadBasic.All* permission.
117117
- To read the basic properties of a group's members that are groups, the app needs at least the *GroupMember.Read.All* permission.
118
−- To read the basic properties of a group's members that are devices, the app needs at least the *Device.Read.All* permission, and so on.
119
−- However, as an alternative to the individual resource-level permissions, the app can be assigned at least the *Directory.Read.All* permission to read *all properties for all member types*.
118
+- To read the basic properties of a group's members that are devices, the app needs at least the *Device.Read.All* permission.
119
+- To read the basic properties of a group's members that are service principals, the app needs at least the *Application.Read.All* permission.
120
+- As per the principle of least privilege, you should prefer using the above permissions as appropriate for your application. However, as an alternative to the individual resource-level permissions, the app can be assigned the *Directory.Read.All* permission to read *all properties for all member types*.
120121
121122
### Example
122123
⋯ 119 unchanged lines
Microsoft's Markdown source from microsoftgraph/microsoft-graph-docs-contrib, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:19 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.