← cd ~/compare
// compare · graph permissions
IdentityRiskEvent.Read.All vs IdentityRiskEvent.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: IdentityRiskEvent.Read.All only reads. IdentityRiskEvent.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Permission type | IdentityRiskEvent.Read.All | IdentityRiskEvent.ReadWrite.All |
|---|---|---|
| Application | Read all identity risk event information Allows the app to read the identity risk event information for your organization without a signed in user. Always needs admin consent · Medium risk | Read and write all risk detection information Allows the app to read and update identity risk detection information for your organization without a signed-in user. Update operations include confirming risk event detections. Always needs admin consent · High risk |
| Delegated | Read identity risk event information Allows the app to read identity risk event information for all users in your organization on behalf of the signed-in user. Needs admin consent · Low risk | Read and write identity risk event information Allows the app to read and update identity risk event information for all users in your organization on behalf of the signed-in user. Update operations include confirming risk event detections. Needs admin consent · High risk |
Spotted something out of date or wrong? Tell us and we'll fix it.