← cd ~/compare
// compare · graph permissions
AccessReview.Read.All vs AccessReview.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: AccessReview.Read.All only reads. AccessReview.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Permission type | AccessReview.Read.All | AccessReview.ReadWrite.All |
|---|---|---|
| Application | Read all access reviews Allows the app to read access reviews, reviewers, decisions and settings in the organization, without a signed-in user. Always needs admin consent · Medium risk | Manage all access reviews Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization, without a signed-in user. Always needs admin consent · High risk |
| Delegated | Read all access reviews that user can access Allows the app to read access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization. Needs admin consent · Low risk | Manage all access reviews that user can access Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization. Needs admin consent · High risk |
Spotted something out of date or wrong? Tell us and we'll fix it.