← cd ~/compare
// compare · graph permissions
Files.Read.All vs Files.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Files.Read.All only reads. Files.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Files.Read.All | Files.ReadWrite.All | |
|---|---|---|
| Application | Read files in all site collections Allows the app to read all files in all site collections without a signed in user. Always needs admin consent · High risk | Read and write files in all site collections Allows the app to read, create, update and delete all files in all site collections without a signed in user. Always needs admin consent · High risk |
| Delegated | Read all files that user can access Allows the app to read all files the signed-in user can access. Users can consent · Medium risk | Have full access to all files user can access Allows the app to read, create, update and delete all files the signed-in user can access. Users can consent · High risk |