← cd ~/compare
// compare · graph permissions
Directory.Read.All vs User.Read.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Use the specific permission for what you read, such as User.Read.All, Group.Read.All or Device.Read.All.
| Directory.Read.All | User.Read.All | |
|---|---|---|
| Application | Read directory data Allows the app to read data in your organization's directory, such as users, groups and apps, without a signed-in user. Always needs admin consent · Medium risk | Read all users' full profiles Allows the app to read user profiles without a signed in user. Always needs admin consent · Medium risk |
| Delegated | Read directory data Allows the app to read data in your organization's directory, such as users, groups and apps. Needs admin consent · Low risk | Read all users' full profiles Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user. Needs admin consent · Low risk |