← cd ~/compare
// compare · graph permissions
Application.ReadWrite.OwnedBy vs Application.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: If the app only manages apps it created, use Application.ReadWrite.OwnedBy.
| Application.ReadWrite.OwnedBy | Application.ReadWrite.All | |
|---|---|---|
| Application | Manage apps that this app creates or owns Allows the app to create other applications, and fully manage those applications (read, update, update application secrets and delete), without a signed-in user. It cannot update any apps that it is not an owner of. Always needs admin consent · Medium risk | Read and write all applications Allows the app to create, read, update and delete applications and service principals without a signed-in user. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants. Always needs admin consent · Critical risk |
| Delegated | Not available as a delegated permission | Read and write applications Allows the app to create, read, update and delete applications and service principals on behalf of the signed-in user. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants. Needs admin consent · Critical risk |