← cd ~/compare
// compare · graph permissions
DeviceManagementManagedDevices.Read.All vs DeviceManagementManagedDevices.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: If the app only reads devices, use DeviceManagementManagedDevices.Read.All.
| Permission type | DeviceManagementManagedDevices.Read.All | DeviceManagementManagedDevices.ReadWrite.All |
|---|---|---|
| Application | Read Microsoft Intune devices Allows the app to read the properties of devices managed by Microsoft Intune, without a signed-in user. Always needs admin consent · High risk | Read and write Microsoft Intune devices Allows the app to read and write the properties of devices managed by Microsoft Intune, without a signed-in user. Does not allow high impact operations such as remote wipe and password reset on the device’s owner Always needs admin consent · High risk |
| Delegated | Read Microsoft Intune devices Allows the app to read the properties of devices managed by Microsoft Intune. Needs admin consent · High risk | Read and write Microsoft Intune devices Allows the app to read and write the properties of devices managed by Microsoft Intune. Does not allow high impact operations such as remote wipe and password reset on the device’s owner. Needs admin consent · High risk |
Spotted something out of date or wrong? Tell us and we'll fix it.