← cd ~/compare
// compare · graph permissions
Application.Read.All vs Application.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Application.Read.All only reads. Application.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Application.Read.All | Application.ReadWrite.All | |
|---|---|---|
| Application | Read all applications Allows the app to read all applications and service principals without a signed-in user. Always needs admin consent · Medium risk | Read and write all applications Allows the app to create, read, update and delete applications and service principals without a signed-in user. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants. Always needs admin consent · Critical risk |
| Delegated | Read applications Allows the app to read applications and service principals on behalf of the signed-in user. Needs admin consent · Low risk | Read and write applications Allows the app to create, read, update and delete applications and service principals on behalf of the signed-in user. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants. Needs admin consent · Critical risk |