← cd ~/compare
// compare · graph permissions
Policy.Read.All vs Policy.ReadWrite.ConditionalAccess
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: If the app only reads policies, use Policy.Read.All.
| Policy.Read.All | Policy.ReadWrite.ConditionalAccess | |
|---|---|---|
| Application | Read your organization's policies Allows the app to read all your organization's policies without a signed in user. Always needs admin consent · Medium risk | Read and write your organization's conditional access policies Allows the app to read and write your organization's conditional access policies, without a signed-in user. Always needs admin consent · Critical risk |
| Delegated | Read your organization's policies Allows the app to read your organization's policies on behalf of the signed-in user. Needs admin consent · Low risk | Read and write your organization's conditional access policies Allows the app to read and write your organization's conditional access policies on behalf of the signed-in user. Needs admin consent · Critical risk |