← cd ~/compare
// compare · graph permissions
Mail.Send vs Mail.ReadWrite
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Pick the one that grants the least access and still covers what your app does. Compare the descriptions above, and check whether a delegated permission would do: it can never do more than the signed-in user.
| Mail.Send | Mail.ReadWrite | |
|---|---|---|
| Application | Send mail as any user Allows the app to send mail as any user without a signed-in user. Always needs admin consent · High risk | Read and write mail in all mailboxes Allows the app to create, read, update, and delete mail in all mailboxes without a signed-in user. Does not include permission to send mail. Always needs admin consent · High risk |
| Delegated | Send mail as a user Allows the app to send mail as users in the organization. Users can consent · Medium risk | Read and write access to user mail Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail. Users can consent · Medium risk |