Graph permissions
Microsoft's edit ·
Microsoft's commit message in microsoftgraph/microsoft-graph-docs-contrib · commit 5a88c6f · +4 −0 lines · also on GitHub
⋯ 52 unchanged lines
5353
5454
*Application permissions*, also called *app roles*, work in the app-only access scenario, without a signed-in user present. The application can access *any* data that the permission is associated with. For example, an application granted the *Files.Read.All* application permission can read any file in the organization.
5555
56
+With the *User.ReadWrite.All* application permission, an application can update many of the writable user properties supported by Microsoft Graph, including for users assigned privileged admin roles.
57
+
58
+Application permissions are highly privileged because they allow applications to access and modify resources without requiring a signed-in user. From a least-privilege perspective, the delegated permission model is the recommended approach whenever it meets the application's requirements.
59
+
5660
For apps that access resources and APIs without a signed-in user, an administrator consents to the application permissions when the app is installed in the tenant or through the Microsoft Entra admin center. Only Privileged Role Administrator and Global Administrator can consent to application permissions.
5761
5862
Apart from being assigned Microsoft Graph application permissions, an app might also be granted the privileges it needs through one of the following conditions:
⋯ 187 unchanged lines
Microsoft's Markdown source from microsoftgraph/microsoft-graph-docs-contrib, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:19 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.