← cd ~/compare
// compare · graph permissions
UserAuthenticationMethod.Read.All vs UserAuthenticationMethod.ReadWrite.All
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: If the app only reads methods, use UserAuthenticationMethod.Read.All.
| Permission type | UserAuthenticationMethod.Read.All | UserAuthenticationMethod.ReadWrite.All |
|---|---|---|
| Application | Read all users' authentication methods Allows the app to read authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods. Always needs admin consent · Medium risk | Read and write all users' authentication methods Allows the application to read and write authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user's phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods Always needs admin consent · Critical risk |
| Delegated | Read all users' authentication methods Allows the app to read authentication methods of all users in your organization that the signed-in user has access to. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods. Needs admin consent · Low risk | Read and write all users' authentication methods Allows the app to read and write authentication methods of all users in your organization that the signed-in user has access to. Authentication methods include things like a user's phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods. Needs admin consent · Critical risk |
Spotted something out of date or wrong? Tell us and we'll fix it.