← cd ~/compare
// compare · graph permissions
TeamMember.Read.All vs TeamMember.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: TeamMember.Read.All only reads. TeamMember.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| Permission type | TeamMember.Read.All | TeamMember.ReadWrite.All |
|---|---|---|
| Application | Read the members of all teams Read the members of all teams, without a signed-in user. Always needs admin consent · Medium risk | Add and remove members from all teams Add and remove members from all teams, without a signed-in user. Also allows changing a team member's role, for example from owner to non-owner. Always needs admin consent · High risk |
| Delegated | Read the members of teams Read the members of teams, on behalf of the signed-in user. Needs admin consent · Low risk | Add and remove members from teams Add and remove members from teams, on behalf of the signed-in user. Also allows changing a member's role, for example from owner to non-owner. Needs admin consent · High risk |
Spotted something out of date or wrong? Tell us and we'll fix it.