← cd ~/compare
// compare · graph permissions
Device.Read.All vs Device.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Device.Read.All only reads. Device.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Permission type | Device.Read.All | Device.ReadWrite.All |
|---|---|---|
| Application | Read all devices Allows the app to read your organization's devices' configuration information without a signed-in user. Always needs admin consent · Medium risk | Read and write devices Allows the app to read and write all device properties without a signed in user. Does not allow device creation, device deletion or update of device alternative security identifiers. Always needs admin consent · High risk |
| Delegated | Read all devices Allows the app to read your organization's devices' configuration information on behalf of the signed-in user. Needs admin consent · Low risk | Not available as a delegated permission |
Spotted something out of date or wrong? Tell us and we'll fix it.