← cd ~/compare
// compare · graph permissions
Mail.ReadBasic vs Mail.Read
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: If you only need headers and metadata, use Mail.ReadBasic. For application permissions, limit which mailboxes the app can reach with Exchange Online RBAC for applications.
| Mail.ReadBasic | Mail.Read | |
|---|---|---|
| Application | Read basic mail in all mailboxes Allows the app to read basic mail properties in all mailboxes without a signed-in user. Includes all properties except body, previewBody, attachments and any extended properties. Always needs admin consent · High risk | Read mail in all mailboxes Allows the app to read mail in all mailboxes without a signed-in user. Always needs admin consent · High risk |
| Delegated | Read user basic mail Allows the app to read email in the signed-in user's mailbox except body, previewBody, attachments and any extended properties. Users can consent · Medium risk | Read user mail Allows the app to read the signed-in user's mailbox. Users can consent · Medium risk |