← cd ~/compare
// compare · graph permissions
User.Read.All vs User.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: User.Read.All only reads. User.ReadWrite.All can also create, change or delete. Use the read-only one unless your app needs to write.
| User.Read.All | User.ReadWrite.All | |
|---|---|---|
| Application | Read all users' full profiles Allows the app to read user profiles without a signed in user. Always needs admin consent · Medium risk | Read and write all users' full profiles Allows the app to read and update user profiles without a signed in user. Always needs admin consent · High risk |
| Delegated | Read all users' full profiles Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user. Needs admin consent · Low risk | Read and write all users' full profiles Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user. Needs admin consent · High risk |