Graph permissions
Microsoft's edit ·
Microsoft's commit message in microsoftgraph/microsoft-graph-docs-contrib · commit fdd697d · +6 −6 lines · also on GitHub
⋯ 111 unchanged lines
112112
113113
This principle is applied to all relationships that are of [directoryObject](/graph/api/resources/directoryobject) type. Examples include `/groups/{id}/members`, `/users/{id}/memberOf`, and `me/ownedObjects`.
114114
115
−For example, a group can have users, groups, applications, service principals, devices, and contacts as members. An app is granted the *GroupMember.Read.All* least privileged permission to [List group members](/graph/api/group-list-members). In the response object, only the **id** and **@odata.type** properties are populated for all the members that are returned. The other properties are indicated as `null`. For this API:
116
−- To read the basic properties of a group's members that are users, the app needs at least the *User.ReadBasic.All* permission.
117
−- To read the basic properties of a group's members that are groups, the app needs at least the *GroupMember.Read.All* permission.
118
−- To read the basic properties of a group's members that are devices, the app needs at least the *Device.Read.All* permission.
119
−- To read the basic properties of a group's members that are service principals, the app needs at least the *Application.Read.All* permission.
120
−- As per the principle of least privilege, you should prefer using the above permissions as appropriate for your application. However, as an alternative to the individual resource-level permissions, the app can be assigned the *Directory.Read.All* permission to read *all properties for all member types*.
115
+For example, a group can have users, groups, applications, service principals, devices, and contacts as members. An app is granted the *GroupMember.Read.All* least privileged permission to [List group members](/graph/api/group-list-members). In the response object, only the **id** and **@odata.type** properties are populated for all the members that are returned. The other properties are indicated as `null`. For this API, and to return data for the other object types, the app needs the following additional permissions:
116
+- To read the basic properties of a group's members that are users, *User.ReadBasic.All* is the least privileged permission.
117
+- To read the basic properties of a group's members that are groups, *GroupMember.Read.All* is the least privileged permission.
118
+- To read the basic properties of a group's members that are devices, *Device.Read.All* is the least privileged permission.
119
+- To read the basic properties of a group's members that are service principals, *Application.Read.All* is the least privileged permission.
120
+- As per the principle of least privilege, you should prefer using the preceding permissions as appropriate for your application. However, as an alternative to the individual resource-level permissions, the app can be assigned the *Directory.Read.All* permission to read *all properties for all member types*.
121121
122122
### Example
123123
⋯ 119 unchanged lines
Microsoft's Markdown source from microsoftgraph/microsoft-graph-docs-contrib, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:19 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.