Graph permissions

This page's changes and edits · All guidance changes

Microsoft's edit · 26 Dec 2025 17:58 UTC

Update permissions-overview.md

Microsoft's commit message in microsoftgraph/microsoft-graph-docs-contrib · commit 84a5966 · +25 ~~−24~~ lines · also on GitHub

⋯ 33 unchanged lines

3434

3535 *Delegated permissions*, also called *scopes*, work in the delegated access scenario. These permissions let the application act on behalf of a signed-in user. However, the application can't access anything the signed-in user couldn't access.

3636

37 −For example, an application gets the *Files.Read.All* delegated permission on behalf of Tom, a user. The application can only read all files in the organization that Tom can already access. Tom might be able to access the files because he has permissions through one of the following ways:

37 +For example, an application gets the ´Files.Read.All´ delegated permission on behalf of Tom, a user. The application can only read all files in the organization that Tom can already access. Tom might be able to access the files because he has permissions through one of the following ways:

3838

3939 - Tom created or owns the files.

4040 - The files were shared directly with Tom, or indirectly shared through a team or group membership.

⋯ 10 unchanged lines

5151

5252 ### Application permissions

5353

54 −*Application permissions*, also called *app roles*, work in the app-only access scenario, without a signed-in user present. The application can access *any* data that the permission is associated with. For example, an application granted the *Files.Read.All* application permission can read any file in the organization.

54 +*Application permissions*, also called *app roles*, work in the app-only access scenario, without a signed-in user present. The application can access *any* data that the permission is associated with. For example, an application granted the ´Files.Read.All´ application permission can read any file in the organization.

5555

5656 For apps that access resources and APIs without a signed-in user, an administrator consents to the application permissions when the app is installed in the tenant or through the Microsoft Entra admin center. Only Privileged Role Administrator and Global Administrator can consent to application permissions.

5757

⋯ 5 unchanged lines

6363 > [!NOTE]

6464 > Permissions granted through [Microsoft Entra built-in roles](/entra/identity/role-based-access-control/permissions-reference?toc=/graph/toc.json) don't limit the app to calling Microsoft Graph APIs only.

6565

66 −

6766 ### Comparison of delegated and application permissions

6867

6968 | Category | Delegated permissions | Application permissions |

⋯ 9 unchanged lines

7978

8079 :::image type="content" source="images/auth-v2/app-privileges-illustration.png" alt-text="Illustration of application privileges in delegated vs app-only access scenarios.":::

8180

82 −### Best practice for choosing permission types to register your connector agent

81 +### Best practices for selecting permission types for connector agent registration

8382

84 −Graph connector agents run as background services and require Microsoft Graph Application permissions.<br>

85 −**Delegated permissions aren't supported** for connector agent registration and cause registration failures, even if permissions appear correctly configured.<br>

86 −Request the **least-privileged Application permissions** needed for your connector scenario and ensure **tenant‑wide admin consent** is granted.

83 +Microsoft Graph connector agents run as background services and require Microsoft Graph application permissions.

8784

85 +*Delegated permissions aren't supported* for connector agent registration and cause registration failures, even when the permissions appear correctly configured.

86 +

87 +Request the *least‑privileged application permissions* needed for your connector scenario and ensure *tenant‑wide admin consent* is granted.

88 +

8889 ## Permissions naming pattern

8990

9091 Microsoft Graph exposes granular permissions that help you control the access that apps have to Microsoft Graph resources, like users, groups, and mail. These permissions follow the naming pattern:

⋯ 7 unchanged lines

9899 | `{constraint}` | Determines the potential extent of access an app has within the directory. This value might not be explicitly declared. When undeclared, the default constraint is limited to data that's owned by the signed-in user. | `All`, `AppFolder`, `OwnedBy`, `Selected`, `Shared`, `Hidden` |

99100

100101 Examples:

101 −- *User.Read* - Allows the app to read information about the signed-in user.

102 −- *Application.ReadWrite.All* - Allows the app to manage all applications in the tenant.

103 −- *Application.ReadWrite.OwnedBy* - Allows the app to manage only the applications that it creates or owns.

104 −- *Group.Create* - Allows the application to create new groups, but not modify or delete them.

105 −- *Member.Read.Hidden* - Allows the app to read hidden memberships.

102 +- ´User.Read´ - Allows the app to read information about the signed-in user.

103 +- ´Application.ReadWrite.All´ - Allows the app to manage all applications in the tenant.

104 +- ´Application.ReadWrite.OwnedBy´ - Allows the app to manage only the applications that it creates or owns.

105 +- ´Group.Create´ - Allows the application to create new groups, but not modify or delete them.

106 +- ´Member.Read.Hidden´ - Allows the app to read hidden memberships.

106107

107108 For the full list of permissions exposed by Microsoft Graph, see the [Microsoft Graph permissions reference](permissions-reference.md).

108109

⋯ 1 unchanged line

110111

111112 RSC is an authorization framework that grants scoped access to the data exposed by a resource. Through RSC, an authorized user can give an app access to the data of a specific instance of a resource type. They don't need to give app access to every instance of the resource type in the entire tenant.

112113

113 −RSC permissions are also available for consent and are supported by only a subset of features available through Microsoft Graph such as Teams, chats, and messages. For more information, see [RSC permissions](/microsoftteams/platform/graph-api/rsc/resource-specific-consent) and the [full list of RSC permissions available](./permissions-reference.md#resource-specific-consent-rsc-permissions).

114 +RSC permissions are also available for consent and are supported by only a subset of features available through Microsoft Graph such as Teams, chats, and messages. For more information, see [RSC permissions](/microsoftteams/platform/graph-api/rsc/resource-specific-consent) and the [full list of available RSC permissions](./permissions-reference.md#resource-specific-consent-rsc-permissions).

114115

115116 ## Limited information returned for inaccessible member objects

116117

⋯ 1 unchanged line

118119

119120 This principle applies to all relationships that are of [directoryObject](/graph/api/resources/directoryobject) type. Examples include `/groups/{id}/members`, `/users/{id}/memberOf`, and `me/ownedObjects`.

120121

121 −For example, a group can have users, groups, applications, service principals, devices, and contacts as members. An app is granted the *GroupMember.Read.All* least privileged permission to [List group members](/graph/api/group-list-members). In the response object, only the **id** and **@odata.type** properties are populated for all the members that are returned. The other properties are indicated as `null`. For this API, and to return more information for the group's members, the app needs the following additional permissions:

122 −- To read the basic properties of a group's members that are users, *User.ReadBasic.All* is the least privileged permission.

123 −- To read the basic properties of a group's members that are groups, *GroupMember.Read.All* is the least privileged permission.

124 −- To read the basic properties of a group's members that are devices, *Device.Read.All* is the least privileged permission.

125 −- To read the basic properties of a group's members that are service principals, *Application.Read.All* is the least privileged permission.

126 −- As per the principle of least privilege, use the preceding permissions as appropriate for your application. However, as an alternative to the individual resource-level permissions, assign the app the *Directory.Read.All* permission to read *all properties for all member types*.

122 +For example, a group can have users, groups, applications, service principals, devices, and contacts as members. An app is granted the ´GroupMember.Read.All´ least privileged permission to [List group members](/graph/api/group-list-members). In the response object, only the **id** and **@odata.type** properties are populated for all the members that are returned. The other properties are indicated as `null`. For this API, and to return more information for the group's members, the app needs the following additional permissions:

123 +- To read the basic properties of a group's members that are users, ´User.ReadBasic.All´ is the least privileged permission.

124 +- To read the basic properties of a group's members that are groups, ´GroupMember.Read.All´ is the least privileged permission.

125 +- To read the basic properties of a group's members that are devices, ´Device.Read.All´ is the least privileged permission.

126 +- To read the basic properties of a group's members that are service principals, ´Application.Read.All´ is the least privileged permission.

127 +- As per the principle of least privilege, use the preceding permissions as appropriate for your application; however, as an alternative to the individual resource-level permissions, assign the app the `Directory.Read.All` permission to read *all properties for all member types*.

127128

128129 ### Example

129130

⋯ 77 unchanged lines

207208

208209 Consider the following examples:

209210

210 −- An app needs to read the profile information of the signed-in user. The app requires only the *User.Read* permission, which is the least privileged permission to access the signed-in user's information. Granting the app the *User.ReadWrite* permission makes it over-privileged because the app doesn't need to update the user's profile.

211 −- An app needs to read the groups in the tenant without a signed-in user. The app requires only the *GroupMember.Read.All* application permission, which is the least privileged permission to read groups in the tenant without a signed-in user.

212 −- An app needs to read or write to a calendar of the signed-in user. The app manages dynamic jobs, and syncs from the user's Outlook calendar to keep the app up-to-date so to schedule jobs for the user. Even though [getting](/graph/api/event-delta) the user's calendar data requires *Calendars.Read*, [updating](/graph/api/user-post-events) the calendar with scheduled jobs requires a higher privileged permission, *Calendars.ReadWrite*. In this case, the app should request *Calendars.ReadWrite*.

211 +- An app needs to read the profile information of the signed-in user. The app requires only the ´User.Read´ permission, which is the least privileged permission to access the signed-in user's information. Granting the app the ´User.ReadWrite´ permission makes it over-privileged because the app doesn't need to update the user's profile.

212 +- An app needs to read the groups in the tenant without a signed-in user. The app requires only the ´GroupMember.Read.All´ application permission, which is the least privileged permission to read groups in the tenant without a signed-in user.

213 +- An app needs to read or write to a calendar of the signed-in user. The app manages dynamic jobs, and syncs from the user's Outlook calendar to keep the app up-to-date so to schedule jobs for the user. Even though [getting](/graph/api/event-delta) the user's calendar data requires ´Calendars.Read´, [updating](/graph/api/user-post-events) the calendar with scheduled jobs requires a higher privileged permission, ´Calendars.ReadWrite´. In this case, the app should request ´Calendars.ReadWrite´.

213214

214215 Granting an application more privileges than it needs is a poor security practice. It increases the app's exposure to unauthorized and unintended access to data or operations. Also, requesting more permissions than necessary might cause users to refrain from consenting to an app, affecting an app's adoption and usage.

215216

⋯ 1 unchanged line

217218

218219 ### Permissions to use with caution

219220

220 −Some Microsoft Graph permissions grant access to a wider range of data or operations than others. Use these permissions with caution. For example, the *Directory.AccessAsUser.All* permission is the highest privileged delegated permission that grants access to nearly all API operations across Microsoft Entra ID. *Directory.ReadWrite.All* permission is second in privilege ranking. *Directory.Read.All* is the highest privileged read-only permission for Microsoft Entra ID resources. Use these permissions with caution and only when necessary. Always use lesser-privileged options permissions instead.

221 +Some Microsoft Graph permissions grant access to a wider range of data or operations than others. Use these permissions with caution. For example, the ´Directory.AccessAsUser.All´ permission is the highest privileged delegated permission that grants access to nearly all API operations across Microsoft Entra ID. ´Directory.ReadWrite.All´ permission is second in privilege ranking. ´Directory.Read.All´ is the highest privileged read-only permission for Microsoft Entra ID resources. Use these permissions with caution and only when necessary. Always use lesser-privileged options permissions instead.

221222

222223 In API reference documentation relating to Microsoft Entra ID resources, some of these higher privileged permissions might be intentionally excluded from the table of permissions supported to access the API.

223224

224 −In addition, the Global Administrator role is the highest privileged built-in role in Microsoft Entra ID. In API reference documentation, this role is intentionally excluded from the list of roles that support access to the API in favor of lesser-privileged roles.

225 +In addition, the Global Administrator role is the highest privileged built-in role in Microsoft Entra ID. In the API reference documentation, this role is intentionally excluded from the list of roles that support access to the API in favor of lesser-privileged roles.

225226

226227 ## Limits on requested permissions per app

227228

⋯ 17 unchanged lines

Microsoft's Markdown source from microsoftgraph/microsoft-graph-docs-contrib, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:19 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.