← cd ~/compare
// compare · graph permissions
DeviceManagementApps.Read.All vs DeviceManagementApps.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: DeviceManagementApps.Read.All only reads. DeviceManagementApps.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Permission type | DeviceManagementApps.Read.All | DeviceManagementApps.ReadWrite.All |
|---|---|---|
| Application | Read Microsoft Intune apps Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user. Always needs admin consent · High risk | Read and write Microsoft Intune apps Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user. Always needs admin consent · High risk |
| Delegated | Read Microsoft Intune apps Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune. Needs admin consent · High risk | Read and write Microsoft Intune apps Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune. Needs admin consent · High risk |
Spotted something out of date or wrong? Tell us and we'll fix it.