Graph permissions
Microsoft's edit ·
Microsoft's commit message in microsoftgraph/microsoft-graph-docs-contrib · commit 8ba7d2d · +12 −5 lines · also on GitHub
⋯ 41 unchanged lines
4242
4343
**Therefore, in a delegated scenario, the privileges that an app has to act on behalf of a user is determined by the Microsoft Graph permissions that the app has been granted *and* the user's own permissions.**
4444
45
−In a delegated access scenario, an app might allow users to sign in with their personal Microsoft accounts, like Outlook.com, work or school accounts, or allow both account types. All delegated permissions are valid for work or school accounts, but not all are valid for personal Microsoft accounts. Use the [Microsoft Graph permissions reference](permissions-reference.md) to identify delegated permissions that are valid for personal Microsoft accounts.
45
+In a delegated access scenario, an app might allow users to sign in with their personal Microsoft accounts, like Outlook.com, work or school accounts, or both account types. All delegated permissions are valid for work or school accounts, but not all are valid for personal Microsoft accounts. Use the [Microsoft Graph permissions reference](permissions-reference.md) to identify delegated permissions that are valid for personal Microsoft accounts.
4646
4747
When a user signs in to an app, they, or, in some cases, an administrator, get a chance to consent to the delegated permissions. If they grant consent, the app can access resources and APIs within the boundaries of the user's permissions.
4848
⋯ 14 unchanged lines
6363
> [!NOTE]
6464
> Permissions granted through [Microsoft Entra built-in roles](/entra/identity/role-based-access-control/permissions-reference?toc=/graph/toc.json) don't limit the app to calling Microsoft Graph APIs only.
6565
66
+
6667
### Comparison of delegated and application permissions
6768
6869
| Category | Delegated permissions | Application permissions |
⋯ 9 unchanged lines
7879
7980
:::image type="content" source="images/auth-v2/app-privileges-illustration.png" alt-text="Illustration of application privileges in delegated vs app-only access scenarios.":::
8081
82
+### Best practice for choosing permission types to register your connector agent
83
+
84
+Graph connector agents run as background services and require Microsoft Graph Application permissions.
85
+**Delegated permissions aren't supported** for connector agent registration and cause registration failures, even if permissions appear correctly configured.
86
+Request the **least-privileged Application permissions** needed for your connector scenario and ensure **tenant‑wide admin consent** is granted.
87
+
8188
## Permissions naming pattern
8289
8390
Microsoft Graph exposes granular permissions that help you control the access that apps have to Microsoft Graph resources, like users, groups, and mail. These permissions follow the naming pattern:
⋯ 11 unchanged lines
95102
- *Application.ReadWrite.All* - Allows the app to manage all applications in the tenant.
96103
- *Application.ReadWrite.OwnedBy* - Allows the app to manage only the applications that it creates or owns.
97104
- *Group.Create* - Allows the application to create new groups, but not modify or delete them.
98
−- *Member.Read.Hidden* - Allows the app to read hidden memberships
105
+- *Member.Read.Hidden* - Allows the app to read hidden memberships.
99106
100107
For the full list of permissions exposed by Microsoft Graph, see the [Microsoft Graph permissions reference](permissions-reference.md).
101108
⋯ 1 unchanged line
103110
104111
RSC is an authorization framework that grants scoped access to the data exposed by a resource. Through RSC, an authorized user can give an app access to the data of a specific instance of a resource type. They don't need to give app access to every instance of the resource type in the entire tenant.
105112
106
−RSC permissions are also available for consent and are supported by only a subset of features available through Microsoft Graph such as Teams, chats, and messages. Learn more about [RSC permissions](/microsoftteams/platform/graph-api/rsc/resource-specific-consent) or discover the [full list of RSC permissions available](./permissions-reference.md#resource-specific-consent-rsc-permissions).
113
+RSC permissions are also available for consent and are supported by only a subset of features available through Microsoft Graph such as Teams, chats, and messages. For more information, see [RSC permissions](/microsoftteams/platform/graph-api/rsc/resource-specific-consent) and the [full list of RSC permissions available](./permissions-reference.md#resource-specific-consent-rsc-permissions).
107114
108115
## Limited information returned for inaccessible member objects
109116
⋯ 6 unchanged lines
116123
- To read the basic properties of a group's members that are groups, *GroupMember.Read.All* is the least privileged permission.
117124
- To read the basic properties of a group's members that are devices, *Device.Read.All* is the least privileged permission.
118125
- To read the basic properties of a group's members that are service principals, *Application.Read.All* is the least privileged permission.
119
−- As per the principle of least privilege, you should prefer using the preceding permissions as appropriate for your application. However, as an alternative to the individual resource-level permissions, the app can be assigned the *Directory.Read.All* permission to read *all properties for all member types*.
126
+- As per the principle of least privilege, use the preceding permissions as appropriate for your application. However, as an alternative to the individual resource-level permissions, assign the app the *Directory.Read.All* permission to read *all properties for all member types*.
120127
121128
### Example
122129
⋯ 87 unchanged lines
210217
211218
### Permissions to use with caution
212219
213
−Some Microsoft Graph permissions grant access to a wider range of data or operations than others. Use such permissions with caution. For example, the *Directory.AccessAsUser.All* permission is the highest privileged delegated permission that grants access to nearly all API operations across Microsoft Entra ID. *Directory.ReadWrite.All* permission is second in privilege ranking. *Directory.Read.All* is the highest privileged read-only permission for Microsoft Entra ID resources. Use these permissions with caution and only when necessary. Always use lesser-privileged options permissions instead.
220
+Some Microsoft Graph permissions grant access to a wider range of data or operations than others. Use these permissions with caution. For example, the *Directory.AccessAsUser.All* permission is the highest privileged delegated permission that grants access to nearly all API operations across Microsoft Entra ID. *Directory.ReadWrite.All* permission is second in privilege ranking. *Directory.Read.All* is the highest privileged read-only permission for Microsoft Entra ID resources. Use these permissions with caution and only when necessary. Always use lesser-privileged options permissions instead.
214221
215222
In API reference documentation relating to Microsoft Entra ID resources, some of these higher privileged permissions might be intentionally excluded from the table of permissions supported to access the API.
216223
⋯ 21 unchanged lines
Microsoft's Markdown source from microsoftgraph/microsoft-graph-docs-contrib, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:19 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.