← cd ~/compare
// compare · graph permissions
RoleManagement.Read.Directory vs RoleManagement.ReadWrite.Directory
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: If the app only reads role assignments, use RoleManagement.Read.Directory.
| RoleManagement.Read.Directory | RoleManagement.ReadWrite.Directory | |
|---|---|---|
| Application | Read all directory RBAC settings Allows the app to read the role-based access control (RBAC) settings for your company's directory, without a signed-in user. This includes reading directory role templates, directory roles and memberships. Always needs admin consent · Medium risk | Read and write all directory RBAC settings Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, without a signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships. Always needs admin consent · Critical risk |
| Delegated | Read directory RBAC settings Allows the app to read the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes reading directory role templates, directory roles and memberships. Needs admin consent · Medium risk | Read and write directory RBAC settings Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships. Needs admin consent · Critical risk |