← cd ~/compare
// compare · graph permissions
User.ReadBasic.All vs User.Read.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: If you only need names and emails, User.ReadBasic.All is enough.
| User.ReadBasic.All | User.Read.All | |
|---|---|---|
| Application | Read all users' basic profiles Allows the app to read a basic set of profile properties of other users in your organization without a signed-in user. Includes display name, first and last name, email address, open extensions, and photo. Always needs admin consent · Low risk | Read all users' full profiles Allows the app to read user profiles without a signed in user. Always needs admin consent · Medium risk |
| Delegated | Read all users' basic profiles Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo. Users can consent · Low risk | Read all users' full profiles Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user. Needs admin consent · Low risk |