← cd ~/compare
// compare · graph permissions
Group.Read.All vs GroupMember.Read.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: If you only need membership, use GroupMember.Read.All.
| Group.Read.All | GroupMember.Read.All | |
|---|---|---|
| Application | Read all groups Allows the app to read group properties and memberships, and read conversations for all groups, without a signed-in user. Always needs admin consent · Medium risk | Read all group memberships Allows the app to read memberships and basic group properties for all groups without a signed-in user. Always needs admin consent · Medium risk |
| Delegated | Read all groups Allows the app to list groups, and to read their properties and all group memberships on behalf of the signed-in user. Also allows the app to read calendar, conversations, files, and other group content for all groups the signed-in user can access. Needs admin consent · Low risk | Read group memberships Allows the app to list groups, read basic group properties and read membership of all groups the signed-in user has access to. Needs admin consent · Low risk |