Graph permissions
Microsoft's edit ·
Microsoft's commit message in microsoftgraph/microsoft-graph-docs-contrib · commit c914651 · +16 −8 lines · also on GitHub
⋯ 6 unchanged lines
77
ms.topic: concept-article
88
ms.localizationpriority: high
99
ms.subservice: entra-applications
10
−ms.date: 08/29/2025
10
+ms.date: 12/26/2025
1111
ms.custom: graphiamtop20, scenarios:getting-started, sfi-ga-nochange
1212
#customer intent: As a developer integrating with Microsoft Graph, I want to learn about using Microsoft Graph permissions, so that I can properly request and manage permissions for my app.
1313
---
⋯ 28 unchanged lines
4242
4343
**Therefore, in a delegated scenario, the privileges that an app has to act on behalf of a user is determined by the Microsoft Graph permissions that the app has been granted *and* the user's own permissions.**
4444
45
−In a delegated access scenario, an app might allow users to sign in with their personal Microsoft accounts, like Outlook.com, work or school accounts, or allow both account types. All delegated permissions are valid for work or school accounts, but not all are valid for personal Microsoft accounts. Use the [Microsoft Graph permissions reference](permissions-reference.md) to identify delegated permissions that are valid for personal Microsoft accounts.
45
+In a delegated access scenario, an app might allow users to sign in with their personal Microsoft accounts, like Outlook.com, work or school accounts, or both account types. All delegated permissions are valid for work or school accounts, but not all are valid for personal Microsoft accounts. Use the [Microsoft Graph permissions reference](permissions-reference.md) to identify delegated permissions that are valid for personal Microsoft accounts.
4646
4747
When a user signs in to an app, they, or, in some cases, an administrator, get a chance to consent to the delegated permissions. If they grant consent, the app can access resources and APIs within the boundaries of the user's permissions.
4848
⋯ 20 unchanged lines
6969
|--|--|--|
7070
| Types of apps | Web app / Mobile / Single-page app (SPA) | Web / Daemon |
7171
| Access context | [Get access on behalf of a user](auth-v2-user.md) | [Get access without a user](auth-v2-service.md) |
72
−| Who can consent | <ul><li> Users can consent for their data</li> <li> Admins can consent for all users</li></ul><br/><br/>User consent availability also depends on your tenant's [app consent policies](/entra/identity/enterprise-apps/manage-app-consent-policies). Even when admin consent isn't required for a permission by default, your organization's policies may still restrict user consent | Only admin can consent |
72
+| Who can consent | <li> Users can consent for their data <li> Admins can consent for all users | Only admin can consent |
7373
| Other names | <li> Scopes <li>OAuth2 permissions | <li> App roles <li>App-only permissions <li>Direct access permissions |
7474
| Result of consent | [oAuth2PermissionGrant](/graph/api/resources/oauth2permissiongrant) object| [appRoleAssignment](/graph/api/resources/approleassignment) object |
7575
| Supported **signInAudience** types | AzureADMyOrg <br/> AzureADMultipleOrgs <br/> AzureADandPersonalMicrosoftAccount <br/> PersonalMicrosoftAccount | AzureADMyOrg <br/> AzureADMultipleOrgs <br/> AzureADandPersonalMicrosoftAccount |
⋯ 2 unchanged lines
7878
7979
:::image type="content" source="images/auth-v2/app-privileges-illustration.png" alt-text="Illustration of application privileges in delegated vs app-only access scenarios.":::
8080
81
+### Best practices for selecting permission types for connector agent registration
82
+
83
+Microsoft Graph connector agents run as background services and require Microsoft Graph application permissions.
84
+
85
+*Delegated permissions aren't supported* for connector agent registration and cause registration failures, even when the permissions appear correctly configured.
86
+
87
+Request the *least‑privileged application permissions* needed for your connector scenario and ensure *tenant‑wide admin consent* is granted.
88
+
8189
## Permissions naming pattern
8290
8391
Microsoft Graph exposes granular permissions that help you control the access that apps have to Microsoft Graph resources, like users, groups, and mail. These permissions follow the naming pattern:
⋯ 11 unchanged lines
95103
- *Application.ReadWrite.All* - Allows the app to manage all applications in the tenant.
96104
- *Application.ReadWrite.OwnedBy* - Allows the app to manage only the applications that it creates or owns.
97105
- *Group.Create* - Allows the application to create new groups, but not modify or delete them.
98
−- *Member.Read.Hidden* - Allows the app to read hidden memberships
106
+- *Member.Read.Hidden* - Allows the app to read hidden memberships.
99107
100108
For the full list of permissions exposed by Microsoft Graph, see the [Microsoft Graph permissions reference](permissions-reference.md).
101109
⋯ 1 unchanged line
103111
104112
RSC is an authorization framework that grants scoped access to the data exposed by a resource. Through RSC, an authorized user can give an app access to the data of a specific instance of a resource type. They don't need to give app access to every instance of the resource type in the entire tenant.
105113
106
−RSC permissions are also available for consent and are supported by only a subset of features available through Microsoft Graph such as Teams, chats, and messages. Learn more about [RSC permissions](/microsoftteams/platform/graph-api/rsc/resource-specific-consent) or discover the [full list of RSC permissions available](./permissions-reference.md#resource-specific-consent-rsc-permissions).
114
+RSC permissions are also available for consent and are supported by only a subset of features available through Microsoft Graph such as Teams, chats, and messages. For more information, see [RSC permissions](/microsoftteams/platform/graph-api/rsc/resource-specific-consent) and the [full list of available RSC permissions](./permissions-reference.md#resource-specific-consent-rsc-permissions).
107115
108116
## Limited information returned for inaccessible member objects
109117
⋯ 6 unchanged lines
116124
- To read the basic properties of a group's members that are groups, *GroupMember.Read.All* is the least privileged permission.
117125
- To read the basic properties of a group's members that are devices, *Device.Read.All* is the least privileged permission.
118126
- To read the basic properties of a group's members that are service principals, *Application.Read.All* is the least privileged permission.
119
−- As per the principle of least privilege, you should prefer using the preceding permissions as appropriate for your application. However, as an alternative to the individual resource-level permissions, the app can be assigned the *Directory.Read.All* permission to read *all properties for all member types*.
127
+- As per the principle of least privilege, use the preceding permissions as appropriate for your application; however, as an alternative to the individual resource-level permissions, assign the app the *Directory.Read.All* permission to read *all properties for all member types*.
120128
121129
### Example
122130
⋯ 87 unchanged lines
210218
211219
### Permissions to use with caution
212220
213
−Some Microsoft Graph permissions grant access to a wider range of data or operations than others. Use such permissions with caution. For example, the *Directory.AccessAsUser.All* permission is the highest privileged delegated permission that grants access to nearly all API operations across Microsoft Entra ID. *Directory.ReadWrite.All* permission is second in privilege ranking. *Directory.Read.All* is the highest privileged read-only permission for Microsoft Entra ID resources. Use these permissions with caution and only when necessary. Always use lesser-privileged options permissions instead.
221
+Some Microsoft Graph permissions grant access to a wider range of data or operations than others. Use these permissions with caution. For example, the *Directory.AccessAsUser.All* permission is the highest privileged delegated permission that grants access to nearly all API operations across Microsoft Entra ID. *Directory.ReadWrite.All* permission is second in privilege ranking. *Directory.Read.All* is the highest privileged read-only permission for Microsoft Entra ID resources. Use these permissions with caution and only when necessary. Always use lesser-privileged options permissions instead.
214222
215223
In API reference documentation relating to Microsoft Entra ID resources, some of these higher privileged permissions might be intentionally excluded from the table of permissions supported to access the API.
216224
217
−In addition, the Global Administrator role is the highest privileged built-in role in Microsoft Entra ID. In API reference documentation, this role is intentionally excluded from the list of roles supported to access the API in favor of lesser-privileged roles.
225
+In addition, the Global Administrator role is the highest privileged built-in role in Microsoft Entra ID. In the API reference documentation, this role is intentionally excluded from the list of roles that support access to the API in favor of lesser-privileged roles.
218226
219227
## Limits on requested permissions per app
220228
⋯ 17 unchanged lines
Microsoft's Markdown source from microsoftgraph/microsoft-graph-docs-contrib, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:19 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.