← cd ~/compare
// compare · graph permissions
Organization.Read.All vs Organization.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Organization.Read.All only reads. Organization.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Permission type | Organization.Read.All | Organization.ReadWrite.All |
|---|---|---|
| Application | Read organization information Allows the app to read the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information. Always needs admin consent · Medium risk | Read and write organization information Allows the app to read and write the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information. Always needs admin consent · High risk |
| Delegated | Read organization information Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed skus and tenant branding information. Needs admin consent · Low risk | Read and write organization information Allows the app to read and write the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed skus and tenant branding information. Needs admin consent · High risk |
Spotted something out of date or wrong? Tell us and we'll fix it.