Microsoft Graph Permissions
Every Microsoft Graph API permission - delegated, application and resource-specific consent - with its identifier, consent requirement and the description a user or admin actually sees, from the official Graph permissions reference.
| Permission ▲ | Resource ▲ | Delegated ▲ | Application ▲ | Admin consent ▲ |
|---|
About Microsoft Graph permissions
A Graph permission, also called a scope, is what an application asks for so that its access token is allowed to reach a given part of Microsoft Graph. Every permission exists in up to two flavours, and the difference decides who can consent to it and what the call can reach.
Delegated, application and resource-specific
- Delegated permissions are used when a user is signed in. The effective access is the intersection of the permission and what that user is already allowed to do, so a delegated
User.ReadWrite.Allstill cannot edit a user the signed-in account has no rights over. - Application permissions are used with no signed-in user, typically by a daemon or a pipeline. There is no user to intersect with, so the permission is the whole story - which is why almost all of them require admin consent.
- Resource-specific consent (RSC) permissions are scoped to a single Teams team, chat or user rather than the tenant, and are consented by the owner of that resource.
Permissions are not Entra ID roles
This is the distinction that costs the most debugging time. A Graph permission decides what the token may attempt; an Entra ID directory role decides what the identity may do in the directory. Many operations need both, and Microsoft publishes no mapping between the two - the models are deliberately parallel. If a call fails with Authorization_RequestDenied despite the right scope, the missing piece is usually the role, not the permission.
Choosing the least privileged permission
- Prefer the narrowest permission a call accepts; each Graph API method documents its own least privileged option.
- Prefer delegated over application whenever a user is present, so the user's own limits still apply.
- Watch for the
.Allsuffix - it means tenant-wide, not "all properties". - Identifiers listed here are the same GUIDs in every tenant, so they are safe to hard-code in an app manifest or a consent URL.
Where this data comes from
The dataset is rebuilt several times a day from Microsoft's published permissions reference. The same catalog can be read from Graph itself on the Microsoft Graph service principal, but only by a caller holding Application.Read.All; the reference is public and additionally carries the RSC permissions.