← cd ~/compare
// compare · graph permissions
Directory.Read.All vs Directory.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Directory.Read.All only reads. Directory.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Directory.Read.All | Directory.ReadWrite.All | |
|---|---|---|
| Application | Read directory data Allows the app to read data in your organization's directory, such as users, groups and apps, without a signed-in user. Always needs admin consent · Medium risk | Read and write directory data Allows the app to read and write data in your organization's directory, such as users, and groups, without a signed-in user. Does not allow user or group deletion. Always needs admin consent · Critical risk |
| Delegated | Read directory data Allows the app to read data in your organization's directory, such as users, groups and apps. Needs admin consent · Low risk | Read and write directory data Allows the app to read and write data in your organization's directory, such as users, and groups. It does not allow the app to delete users or groups, or reset user passwords. Needs admin consent · Critical risk |