← cd ~/compare
// compare · graph permissions
EntitlementManagement.Read.All vs EntitlementManagement.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: EntitlementManagement.Read.All only reads. EntitlementManagement.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Permission type | EntitlementManagement.Read.All | EntitlementManagement.ReadWrite.All |
|---|---|---|
| Application | Read all entitlement management resources Allows the app to read access packages and related entitlement management resources without a signed-in user. Always needs admin consent · High risk | Read and write all entitlement management resources Allows the app to read and write access packages and related entitlement management resources without a signed-in user. Always needs admin consent · High risk |
| Delegated | Read all entitlement management resources Allows the app to read access packages and related entitlement management resources on behalf of the signed-in user. Needs admin consent · High risk | Read and write entitlement management resources Allows the app to request access to and management of access packages and related entitlement management resources on behalf of the signed-in user. Needs admin consent · High risk |
Spotted something out of date or wrong? Tell us and we'll fix it.