← cd ~/compare
// compare · graph permissions
GroupMember.Read.All vs GroupMember.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: GroupMember.Read.All only reads. GroupMember.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Permission type | GroupMember.Read.All | GroupMember.ReadWrite.All |
|---|---|---|
| Application | Read all group memberships Allows the app to read memberships and basic group properties for all groups without a signed-in user. Always needs admin consent · Medium risk | Read and write all group memberships Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted. Always needs admin consent · High risk |
| Delegated | Read group memberships Allows the app to list groups, read basic group properties and read membership of all groups the signed-in user has access to. Needs admin consent · Low risk | Read and write group memberships Allows the app to list groups, read basic properties, read and update the membership of the groups the signed-in user has access to. Group properties and owners cannot be updated and groups cannot be deleted. Needs admin consent · High risk |
Spotted something out of date or wrong? Tell us and we'll fix it.