← cd ~/compare
// compare · graph permissions
Mail.Read vs Mail.ReadWrite
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Mail.Read only reads. Mail.ReadWrite can also create, change or delete. Use the read-only one unless your app needs to write.
| Mail.Read | Mail.ReadWrite | |
|---|---|---|
| Application | Read mail in all mailboxes Allows the app to read mail in all mailboxes without a signed-in user. Always needs admin consent · High risk | Read and write mail in all mailboxes Allows the app to create, read, update, and delete mail in all mailboxes without a signed-in user. Does not include permission to send mail. Always needs admin consent · High risk |
| Delegated | Read user mail Allows the app to read the signed-in user's mailbox. Users can consent · Medium risk | Read and write access to user mail Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail. Users can consent · Medium risk |