← cd ~/compare
// compare · graph permissions
Sites.Read.All vs Sites.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Sites.Read.All only reads. Sites.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Permission type | Sites.Read.All | Sites.ReadWrite.All |
|---|---|---|
| Application | Read items in all site collections Allows the app to read documents and list items in all site collections without a signed in user. Always needs admin consent · High risk | Read and write items in all site collections Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user. Always needs admin consent · High risk |
| Delegated | Read items in all site collections Allows the application to read documents and list items in all site collections on behalf of the signed-in user Users can consent · Medium risk | Edit or delete items in all site collections Allows the application to edit or delete documents and list items in all site collections on behalf of the signed-in user. Users can consent · High risk |
Spotted something out of date or wrong? Tell us and we'll fix it.