← cd ~/compare
// compare · graph permissions
User.Read vs User.Read.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Pick the one that grants the least access and still covers what your app does. Compare the descriptions above, and check whether a delegated permission would do: it can never do more than the signed-in user.
| User.Read | User.Read.All | |
|---|---|---|
| Application | Not available as an application permission | Read all users' full profiles Allows the app to read user profiles without a signed in user. Always needs admin consent · Medium risk |
| Delegated | Sign in and read user profile Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users. Users can consent · Low risk | Read all users' full profiles Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user. Needs admin consent · Low risk |