Graph permissions

This page's changes and edits · All guidance changes

Microsoft's edit · 29 Dec 2025 11:01 UTC

Add admin consent note to Overview instead of permissions reference

Microsoft's commit message in microsoftgraph/microsoft-graph-docs-contrib · commit 9a3954b · +8 ~~−16~~ lines · also on GitHub

⋯ 6 unchanged lines

77 ms.topic: concept-article

88 ms.localizationpriority: high

99 ms.subservice: entra-applications

10 −ms.date: 12/26/2025

10 +ms.date: 08/29/2025

1111 ms.custom: graphiamtop20, scenarios:getting-started, sfi-ga-nochange

1212 #customer intent: As a developer integrating with Microsoft Graph, I want to learn about using Microsoft Graph permissions, so that I can properly request and manage permissions for my app.

1313 ---

⋯ 28 unchanged lines

4242

4343 **Therefore, in a delegated scenario, the privileges that an app has to act on behalf of a user is determined by the Microsoft Graph permissions that the app has been granted *and* the user's own permissions.**

4444

45 −In a delegated access scenario, an app might allow users to sign in with their personal Microsoft accounts, like Outlook.com, work or school accounts, or both account types. All delegated permissions are valid for work or school accounts, but not all are valid for personal Microsoft accounts. Use the [Microsoft Graph permissions reference](permissions-reference.md) to identify delegated permissions that are valid for personal Microsoft accounts.

45 +In a delegated access scenario, an app might allow users to sign in with their personal Microsoft accounts, like Outlook.com, work or school accounts, or allow both account types. All delegated permissions are valid for work or school accounts, but not all are valid for personal Microsoft accounts. Use the [Microsoft Graph permissions reference](permissions-reference.md) to identify delegated permissions that are valid for personal Microsoft accounts.

4646

4747 When a user signs in to an app, they, or, in some cases, an administrator, get a chance to consent to the delegated permissions. If they grant consent, the app can access resources and APIs within the boundaries of the user's permissions.

4848

⋯ 20 unchanged lines

6969 |--|--|--|

7070 | Types of apps | Web app / Mobile / Single-page app (SPA) | Web / Daemon |

7171 | Access context | [Get access on behalf of a user](auth-v2-user.md) | [Get access without a user](auth-v2-service.md) |

72 −| Who can consent | <li> Users can consent for their data <li> Admins can consent for all users | Only admin can consent |

72 +| Who can consent | <ul><li> Users can consent for their data</li> <li> Admins can consent for all users</li></ul> User consent availability also depends on your tenant's [app consent policies](/entra/identity/enterprise-apps/manage-app-consent-policies). Even when admin consent isn't required for a permission by default, your organization's policies may still restrict user consent | Only admin can consent |

7373 | Other names | <li> Scopes <li>OAuth2 permissions | <li> App roles <li>App-only permissions <li>Direct access permissions |

7474 | Result of consent | [oAuth2PermissionGrant](/graph/api/resources/oauth2permissiongrant) object| [appRoleAssignment](/graph/api/resources/approleassignment) object |

7575 | Supported **signInAudience** types | AzureADMyOrg AzureADMultipleOrgs AzureADandPersonalMicrosoftAccount PersonalMicrosoftAccount | AzureADMyOrg AzureADMultipleOrgs AzureADandPersonalMicrosoftAccount |

⋯ 2 unchanged lines

7878

7979 :::image type="content" source="images/auth-v2/app-privileges-illustration.png" alt-text="Illustration of application privileges in delegated vs app-only access scenarios.":::

8080

81 −### Best practices for selecting permission types for connector agent registration

82 −

83 −Microsoft Graph connector agents run as background services and require Microsoft Graph application permissions.

84 −

85 −*Delegated permissions aren't supported* for connector agent registration and cause registration failures, even when the permissions appear correctly configured.

86 −

87 −Request the *least‑privileged application permissions* needed for your connector scenario and ensure *tenant‑wide admin consent* is granted.

88 −

8981 ## Permissions naming pattern

9082

9183 Microsoft Graph exposes granular permissions that help you control the access that apps have to Microsoft Graph resources, like users, groups, and mail. These permissions follow the naming pattern:

⋯ 11 unchanged lines

10395 - *Application.ReadWrite.All* - Allows the app to manage all applications in the tenant.

10496 - *Application.ReadWrite.OwnedBy* - Allows the app to manage only the applications that it creates or owns.

10597 - *Group.Create* - Allows the application to create new groups, but not modify or delete them.

106 −- *Member.Read.Hidden* - Allows the app to read hidden memberships.

98 +- *Member.Read.Hidden* - Allows the app to read hidden memberships

10799

108100 For the full list of permissions exposed by Microsoft Graph, see the [Microsoft Graph permissions reference](permissions-reference.md).

109101

⋯ 1 unchanged line

111103

112104 RSC is an authorization framework that grants scoped access to the data exposed by a resource. Through RSC, an authorized user can give an app access to the data of a specific instance of a resource type. They don't need to give app access to every instance of the resource type in the entire tenant.

113105

114 −RSC permissions are also available for consent and are supported by only a subset of features available through Microsoft Graph such as Teams, chats, and messages. For more information, see [RSC permissions](/microsoftteams/platform/graph-api/rsc/resource-specific-consent) and the [full list of available RSC permissions](./permissions-reference.md#resource-specific-consent-rsc-permissions).

106 +RSC permissions are also available for consent and are supported by only a subset of features available through Microsoft Graph such as Teams, chats, and messages. Learn more about [RSC permissions](/microsoftteams/platform/graph-api/rsc/resource-specific-consent) or discover the [full list of RSC permissions available](./permissions-reference.md#resource-specific-consent-rsc-permissions).

115107

116108 ## Limited information returned for inaccessible member objects

117109

⋯ 6 unchanged lines

124116 - To read the basic properties of a group's members that are groups, *GroupMember.Read.All* is the least privileged permission.

125117 - To read the basic properties of a group's members that are devices, *Device.Read.All* is the least privileged permission.

126118 - To read the basic properties of a group's members that are service principals, *Application.Read.All* is the least privileged permission.

127 −- As per the principle of least privilege, use the preceding permissions as appropriate for your application; however, as an alternative to the individual resource-level permissions, assign the app the *Directory.Read.All* permission to read *all properties for all member types*.

119 +- As per the principle of least privilege, you should prefer using the preceding permissions as appropriate for your application. However, as an alternative to the individual resource-level permissions, the app can be assigned the *Directory.Read.All* permission to read *all properties for all member types*.

128120

129121 ### Example

130122

⋯ 87 unchanged lines

218210

219211 ### Permissions to use with caution

220212

221 −Some Microsoft Graph permissions grant access to a wider range of data or operations than others. Use these permissions with caution. For example, the *Directory.AccessAsUser.All* permission is the highest privileged delegated permission that grants access to nearly all API operations across Microsoft Entra ID. *Directory.ReadWrite.All* permission is second in privilege ranking. *Directory.Read.All* is the highest privileged read-only permission for Microsoft Entra ID resources. Use these permissions with caution and only when necessary. Always use lesser-privileged options permissions instead.

213 +Some Microsoft Graph permissions grant access to a wider range of data or operations than others. Use such permissions with caution. For example, the *Directory.AccessAsUser.All* permission is the highest privileged delegated permission that grants access to nearly all API operations across Microsoft Entra ID. *Directory.ReadWrite.All* permission is second in privilege ranking. *Directory.Read.All* is the highest privileged read-only permission for Microsoft Entra ID resources. Use these permissions with caution and only when necessary. Always use lesser-privileged options permissions instead.

222214

223215 In API reference documentation relating to Microsoft Entra ID resources, some of these higher privileged permissions might be intentionally excluded from the table of permissions supported to access the API.

224216

225 −In addition, the Global Administrator role is the highest privileged built-in role in Microsoft Entra ID. In the API reference documentation, this role is intentionally excluded from the list of roles that support access to the API in favor of lesser-privileged roles.

217 +In addition, the Global Administrator role is the highest privileged built-in role in Microsoft Entra ID. In API reference documentation, this role is intentionally excluded from the list of roles supported to access the API in favor of lesser-privileged roles.

226218

227219 ## Limits on requested permissions per app

228220

⋯ 17 unchanged lines

Microsoft's Markdown source from microsoftgraph/microsoft-graph-docs-contrib, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:19 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.