← cd ~/compare
// compare · graph permissions
Device.Read.All vs DeviceManagementManagedDevices.Read.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Pick the one that grants the least access and still covers what your app does. Compare the descriptions above, and check whether a delegated permission would do: it can never do more than the signed-in user.
| Device.Read.All | DeviceManagementManagedDevices.Read.All | |
|---|---|---|
| Application | Read all devices Allows the app to read your organization's devices' configuration information without a signed-in user. Always needs admin consent · Medium risk | Read Microsoft Intune devices Allows the app to read the properties of devices managed by Microsoft Intune, without a signed-in user. Always needs admin consent · High risk |
| Delegated | Read all devices Allows the app to read your organization's devices' configuration information on behalf of the signed-in user. Needs admin consent · Low risk | Read Microsoft Intune devices Allows the app to read the properties of devices managed by Microsoft Intune. Needs admin consent · High risk |