← cd ~/compare
// compare · graph permissions
DeviceManagementConfiguration.Read.All vs DeviceManagementConfiguration.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: If the app only reads configuration, use DeviceManagementConfiguration.Read.All.
| Permission type | DeviceManagementConfiguration.Read.All | DeviceManagementConfiguration.ReadWrite.All |
|---|---|---|
| Application | Read Microsoft Intune device configuration and policies Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user. Always needs admin consent · High risk | Read and write Microsoft Intune device configuration and policies Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user. Always needs admin consent · High risk |
| Delegated | Read Microsoft Intune Device Configuration and Policies Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups. Needs admin consent · High risk | Read and write Microsoft Intune Device Configuration and Policies Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups. Needs admin consent · High risk |
Spotted something out of date or wrong? Tell us and we'll fix it.