ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 17:50 UTC Customize Public modeDiscuss ChangeIntel on Discord

Graph permissions

This page's changes and edits · All guidance changes

Microsoft's edit ·

[Freshness] Lightweight freshness passes

Microsoft's commit message in microsoftgraph/microsoft-graph-docs-contrib · commit 6f6ea4b · +19 −19 lines · also on GitHub

⋯ 6 unchanged lines
77 ms.topic: concept-article
88 ms.localizationpriority: high
99 ms.subservice: entra-applications
10 −ms.date: 10/30/2024
10 +ms.date: 08/29/2025
1111 ms.custom: graphiamtop20, scenarios:getting-started, sfi-ga-nochange
1212 #customer intent: As a developer integrating with Microsoft Graph, I want to learn about using Microsoft Graph permissions, so that I can properly request and manage permissions for my app.
1313 ---
1414
1515 # Overview of Microsoft Graph permissions
1616
17 −Before the Microsoft identity platform can authorize your app to access data in the Microsoft cloud, the app must be granted the privileges that it needs. Similarly, before the Microsoft identity platform can authorize your app to access data through Microsoft Graph, the app must be granted the privileges that it needs.
17 +Before the Microsoft identity platform can authorize your app to access data in the Microsoft cloud, you must grant the app the privileges it needs. Similarly, before the Microsoft identity platform can authorize your app to access data through Microsoft Graph, you must grant the app the privileges it needs.
1818
1919 One way to grant an app the privileges it needs to access and work with your data through Microsoft Graph is by assigning it *Microsoft Graph permissions*. Another way is through role-based access control (RBAC) systems, like [Microsoft Entra RBAC](/azure/active-directory/roles/custom-overview). In some cases, access to data through Microsoft Graph APIs might require both Microsoft Graph permissions and RBAC permissions.
2020
⋯ 5 unchanged lines
2626
2727 ## Permission types
2828
29 −Microsoft Graph supports [two access scenarios](/graph/auth/auth-concepts), *delegated access* and *app-only access*. In delegated access, the app calls Microsoft Graph on behalf of a signed-in user. In app-only access, the app calls Microsoft Graph with its own identity, without a signed in user.
29 +Microsoft Graph supports [two access scenarios](/graph/auth/auth-concepts), *delegated access* and *app-only access*. In delegated access, the app calls Microsoft Graph on behalf of a signed-in user. In app-only access, the app calls Microsoft Graph with its own identity, without a signed-in user.
3030
3131 To support these access scenarios, Microsoft Graph exposes *delegated permissions* and *application permissions*.
3232
3333 ### Delegated permissions
3434
35 −*Delegated permissions*, also called *scopes*, are used in the delegated access scenario. They're permissions that allow the application to act on behalf of a signed-in user. However, the application can't access anything the signed-in user couldn't access.
35 +*Delegated permissions*, also called *scopes*, work in the delegated access scenario. These permissions let the application act on behalf of a signed-in user. However, the application can't access anything the signed-in user couldn't access.
3636
37 −For example, an application has been granted the *Files.Read.All* delegated permission on behalf of Tom, a user. The application can only read all files in the organization that Tom can already access. Tom might be able to access the files because he has permissions through one of the following ways:
37 +For example, an application gets the *Files.Read.All* delegated permission on behalf of Tom, a user. The application can only read all files in the organization that Tom can already access. Tom might be able to access the files because he has permissions through one of the following ways:
3838
3939 - Tom created or owns the files.
4040 - The files were shared directly with Tom, or indirectly shared through a team or group membership.
⋯ 3 unchanged lines
4444
4545 In a delegated access scenario, an app might allow users to sign in with their personal Microsoft accounts, like Outlook.com, work or school accounts, or allow both account types. All delegated permissions are valid for work or school accounts, but not all are valid for personal Microsoft accounts. Use the [Microsoft Graph permissions reference](permissions-reference.md) to identify delegated permissions that are valid for personal Microsoft accounts.
4646
47 −When a user signs in to an app they, or, in some cases, an administrator, are given a chance to consent to the delegated permissions. If they grant consent, the app can access resources and APIs within the boundaries of the user's permissions.
47 +When a user signs in to an app, they, or, in some cases, an administrator, get a chance to consent to the delegated permissions. If they grant consent, the app can access resources and APIs within the boundaries of the user's permissions.
4848
4949 > [!NOTE]
5050 > Permissions granted through [Microsoft Entra built-in roles](/entra/identity/role-based-access-control/permissions-reference?toc=/graph/toc.json) don't limit the app to calling Microsoft Graph APIs only.
5151
5252 ### Application permissions
5353
54 −*Application permissions*, also called *app roles*, are used in the app-only access scenario, without a signed-in user present. The application is able to access *any* data that the permission is associated with. For example, an application granted the *Files.Read.All* application permission can read any file in the organization.
54 +*Application permissions*, also called *app roles*, work in the app-only access scenario, without a signed-in user present. The application can access *any* data that the permission is associated with. For example, an application granted the *Files.Read.All* application permission can read any file in the organization.
5555
5656 For apps that access resources and APIs without a signed-in user, an administrator consents to the application permissions when the app is installed in the tenant or through the Microsoft Entra admin center. Only Privileged Role Administrator and Global Administrator can consent to application permissions.
5757
⋯ 22 unchanged lines
8080
8181 ## Permissions naming pattern
8282
83 −Microsoft Graph exposes granular permissions that help you control the access that apps have to Microsoft Graph resources, like users, groups, and mail. These permissions are named in the following pattern:
83 +Microsoft Graph exposes granular permissions that help you control the access that apps have to Microsoft Graph resources, like users, groups, and mail. These permissions follow the naming pattern:
8484
8585 *{resource}*.*{operation}*.*{constraint}*
8686
8787 | Value | Description | Examples |
8888 |----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------|
89 −| `{resource}` | Refers to a Microsoft Graph resource to which the permission allows access. For example, the `user` resource. | `User`, `Application`, or `Group` |
90 −| `{operation}` | Refers to the Microsoft Graph API operations that are allowed on the data that's exposed by the resource. For example, `Read` for read operations only, or `ReadWrite` for read, create, update, and delete operations. | `Read`, `ReadBasic`, `ReadWrite`, `Create`, `Manage`, or `Migrate` |
89 +| `{resource}` | Refers to a Microsoft Graph resource to which the permission grants access. For example, the `user` resource. | `User`, `Application`, or `Group` |
90 +| `{operation}` | Refers to the Microsoft Graph API operations that are allowed on the data exposed by the resource. For example, `Read` for read operations only, or `ReadWrite` for read, create, update, and delete operations. | `Read`, `ReadBasic`, `ReadWrite`, `Create`, `Manage`, or `Migrate` |
9191 | `{constraint}` | Determines the potential extent of access an app has within the directory. This value might not be explicitly declared. When undeclared, the default constraint is limited to data that's owned by the signed-in user. | `All`, `AppFolder`, `OwnedBy`, `Selected`, `Shared`, `Hidden` |
9292
9393 Examples:
9494 - *User.Read* - Allows the app to read information about the signed-in user.
9595 - *Application.ReadWrite.All* - Allows the app to manage all applications in the tenant.
9696 - *Application.ReadWrite.OwnedBy* - Allows the app to manage only the applications that it creates or owns.
97 −- *Group.Create* - Allows the application create new groups, but not modify or delete them.
97 +- *Group.Create* - Allows the application to create new groups, but not modify or delete them.
9898 - *Member.Read.Hidden* - Allows the app to read hidden memberships
9999
100100 For the full list of permissions exposed by Microsoft Graph, see the [Microsoft Graph permissions reference](permissions-reference.md).
101101
102102 ## Resource-specific consent (RSC) permissions
103103
104 −RSC is an authorization framework that allows for granting scoped access to the data exposed by a resource. Through RSC, an authorized user can give an app access to the data of a specific instance of a resource type. They don't need to give app access to every instance of the resource type in the entire tenant.
104 +RSC is an authorization framework that grants scoped access to the data exposed by a resource. Through RSC, an authorized user can give an app access to the data of a specific instance of a resource type. They don't need to give app access to every instance of the resource type in the entire tenant.
105105
106106 RSC permissions are also available for consent and are supported by only a subset of features available through Microsoft Graph such as Teams, chats, and messages. Learn more about [RSC permissions](/microsoftteams/platform/graph-api/rsc/resource-specific-consent) or discover the [full list of RSC permissions available](./permissions-reference.md#resource-specific-consent-rsc-permissions).
107107
108108 ## Limited information returned for inaccessible member objects
109109
110 −Container objects such as groups support members of various types, for example users and devices. When an application with the right privileges queries the membership of a container object, it receives a `200 OK` response and a collection of objects. However, if the app doesn't have the permissions to read a certain object type in the container, objects of that type are returned but with limited information, for example, only the object type and ID might be returned and other properties are indicated as `null`. Complete information is returned for the object types that the app has permissions to read.
110 +Container objects such as groups support members of various types, for example users and devices. When an application with the right privileges queries the membership of a container object, it receives a `200 OK` response and a collection of objects. However, if the app doesn't have the permissions to read a certain object type in the container, the app receives objects of that type but with limited information. For example, only the object type and ID might be returned and other properties are indicated as `null`. The app receives complete information for the object types that it has permissions to read.
111111
112 −This principle is applied to all relationships that are of [directoryObject](/graph/api/resources/directoryobject) type. Examples include `/groups/{id}/members`, `/users/{id}/memberOf`, and `me/ownedObjects`.
112 +This principle applies to all relationships that are of [directoryObject](/graph/api/resources/directoryobject) type. Examples include `/groups/{id}/members`, `/users/{id}/memberOf`, and `me/ownedObjects`.
113113
114114 For example, a group can have users, groups, applications, service principals, devices, and contacts as members. An app is granted the *GroupMember.Read.All* least privileged permission to [List group members](/graph/api/group-list-members). In the response object, only the **id** and **@odata.type** properties are populated for all the members that are returned. The other properties are indicated as `null`. For this API, and to return more information for the group's members, the app needs the following additional permissions:
115115 - To read the basic properties of a group's members that are users, *User.ReadBasic.All* is the least privileged permission.
⋯ 80 unchanged lines
196196
197197 ## Best practices for using Microsoft Graph permissions
198198
199 −Microsoft Graph exposes granular permissions that allow an app to request only the permissions it requires to function. Granular permissions allow you to apply the *principle of least privilege* when assigning and granting permissions to an app, by granting the app the minimum permission it needs for the operation.
199 +Microsoft Graph exposes granular permissions that allow an app to request only the permissions it needs to function. Granular permissions let you apply the *principle of least privilege* when assigning and granting permissions to an app. Grant the app the minimum permission it needs for the operation.
200200
201201 Consider the following examples:
202202
203 −- An app needs to only read the profile information of the signed-in user. The app requires only the *User.Read* permission, which is the least privileged permission to access the signed-in user's information. Granting the app the *User.ReadWrite* permission makes it over-privileged because the app doesn't need to update the user's profile.
203 +- An app needs to read the profile information of the signed-in user. The app requires only the *User.Read* permission, which is the least privileged permission to access the signed-in user's information. Granting the app the *User.ReadWrite* permission makes it over-privileged because the app doesn't need to update the user's profile.
204204 - An app needs to read the groups in the tenant without a signed-in user. The app requires only the *GroupMember.Read.All* application permission, which is the least privileged permission to read groups in the tenant without a signed-in user.
205205 - An app needs to read or write to a calendar of the signed-in user. The app manages dynamic jobs, and syncs from the user's Outlook calendar to keep the app up-to-date so to schedule jobs for the user. Even though [getting](/graph/api/event-delta) the user's calendar data requires *Calendars.Read*, [updating](/graph/api/user-post-events) the calendar with scheduled jobs requires a higher privileged permission, *Calendars.ReadWrite*. In this case, the app should request *Calendars.ReadWrite*.
206206
207 −Granting an application more privileges than it needs is a poor security practice that increases the app's attack surface and exposes it to unauthorized and unintended access to data or operations. Also, requesting more permissions than necessary might cause users to refrain from consenting to an app, affecting an app's adoption and usage.
207 +Granting an application more privileges than it needs is a poor security practice. It increases the app's exposure to unauthorized and unintended access to data or operations. Also, requesting more permissions than necessary might cause users to refrain from consenting to an app, affecting an app's adoption and usage.
208208
209209 Apply the principle of least privilege when assigning and granting Microsoft Graph permissions to an app. For more information, see [Enhance security with the principle of least privilege](/azure/active-directory/develop/secure-least-privileged-access) and [Building apps that secure identity through permissions and consent](/security/zero-trust/develop/identity).
210210
211211 ### Permissions to use with caution
212212
213 −Some Microsoft Graph permissions grant access to a wider range of data or operations than others. Use such permissions with caution. For example, the *Directory.AccessAsUser.All* permission is the highest privileged delegated permission that grants access to nearly all API operations across Microsoft Entra ID. *Directory.ReadWrite.All* permission is second in privilege ranking. *Directory.Read.All* is the highest privileged read-only permission for Microsoft Entra ID resources. These permissions should be used with caution and only when necessary. Always use lesser-privileged options permissions instead.
213 +Some Microsoft Graph permissions grant access to a wider range of data or operations than others. Use such permissions with caution. For example, the *Directory.AccessAsUser.All* permission is the highest privileged delegated permission that grants access to nearly all API operations across Microsoft Entra ID. *Directory.ReadWrite.All* permission is second in privilege ranking. *Directory.Read.All* is the highest privileged read-only permission for Microsoft Entra ID resources. Use these permissions with caution and only when necessary. Always use lesser-privileged options permissions instead.
214214
215215 In API reference documentation relating to Microsoft Entra ID resources, some of these higher privileged permissions might be intentionally excluded from the table of permissions supported to access the API.
216216
⋯ 5 unchanged lines
222222
223223 ## Retrieve permission IDs through Microsoft Graph
224224
225 −To set permissions using the Azure CLI, PowerShell, or infrastructure as code frameworks, you might need the identifier for the permission that you want to use instead of the name. The [permissions reference](permissions-reference.md) lists IDs for all Microsoft Graph permissions. Alternatively, you can read information about all Microsoft Graph permissions programmatically through the [Get servicePrincipal](/graph/api/serviceprincipal-get) API in Microsoft Graph. The following example shows a request.
225 +To set permissions by using the Azure CLI, PowerShell, or infrastructure as code frameworks, you might need the identifier for the permission that you want to use instead of the name. The [permissions reference](permissions-reference.md) lists IDs for all Microsoft Graph permissions. Alternatively, you can read information about all Microsoft Graph permissions programmatically through the [Get servicePrincipal](/graph/api/serviceprincipal-get) API in Microsoft Graph. The following example shows a request.
226226
227227 ```msgraph-interactive
228228 GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000-c000-000000000000')?$select=id,appId,displayName,appRoles,oauth2PermissionScopes,resourceSpecificApplicationPermissions
⋯ 9 unchanged lines

Microsoft's Markdown source from microsoftgraph/microsoft-graph-docs-contrib, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:19 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 17:50 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.