← cd ~/compare
// compare · graph permissions
Domain.Read.All vs Domain.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Domain.Read.All only reads. Domain.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Permission type | Domain.Read.All | Domain.ReadWrite.All |
|---|---|---|
| Application | Read domains Allows the app to read all domain properties without a signed-in user. Always needs admin consent · Medium risk | Read and write domains Allows the app to read and write all domain properties without a signed in user. Also allows the app to add, verify and remove domains. Always needs admin consent · Critical risk |
| Delegated | Read domains. Allows the app to read all domain properties on behalf of the signed-in user. Needs admin consent · Low risk | Read and write domains Allows the app to read and write all domain properties on behalf of the signed-in user. Also allows the app to add, verify and remove domains. Needs admin consent · Critical risk |
Spotted something out of date or wrong? Tell us and we'll fix it.