azureblog.co.uk
← cd ~/tools
// graph-permissions

Microsoft Graph permissions explained

All 999 Microsoft Graph permissions: what each one allows, its application and delegated IDs, how risky it is and whether there's a narrower option. Reviewing an app? The app permission risk check rates every app in your tenant.

AccessReview Acronym AdministrativeUnit AgentCard AgentCardManifest AgentCollection AgentCommunicationConfiguration AgentIdentity AgentIdentityBlueprint AgentIdentityBlueprintPrincipal AgentIdUser AgentInstance AgentRegistration Agreement AgreementAcceptance AiEnterpriseInteraction Analytics APIConnectors AppCatalog AppCertTrustConfiguration Application Application-RemoteDesktopConfig AppRoleAssignment ApprovalSolution ApprovalSolutionResponse AttackSimulation AuditActivity AuditLog AuditLogsQuery AuditLogsQuery-CRM AuditLogsQuery-Endpoint AuditLogsQuery-Entra AuditLogsQuery-Exchange AuditLogsQuery-OneDrive AuditLogsQuery-SharePoint AuthenticationContext BackupRestore-Configuration BackupRestore-Control BackupRestore-Monitor BackupRestore-Restore BackupRestore-Search BillingConfiguration BitlockerKey Bookings BookingsAppointment Bookmark BrowserSiteLists BusinessScenarioConfig BusinessScenarioData Calendars CallAiInsights CallDelegation CallEvents CallEvents-Emergency CallRecord-PstnCalls CallRecordings CallRecords Calls CallTranscripts CaseManagement ChangeManagement Channel ChannelMember ChannelMessage ChannelSettings Chat ChatMember ChatMessage CloudApp-Discovery CloudPC Community ConfigurationMonitoring ConsentRequest Contacts Contacts-OnPremisesSyncBehavior Content ContentActivity ContentHub-Catalog ContentHub-Installed Contracts CopilotConversation CopilotPackages CopilotPolicySettings CopilotSettings-LimitedMode CrossTenantContentMigration CrossTenantInformation CrossTenantUserProfileSharing CustomAuthenticationExtension CustomDetection CustomObject CustomObjectDefinition CustomSecAttributeAssignment CustomSecAttributeAuditLogs CustomSecAttributeDefinition CustomSecAttributeProvisioning CustomTags DelegatedAdminRelationship DelegatedPermissionGrant Device DeviceLocalCredential DeviceManagementApps DeviceManagementCloudCA DeviceManagementConfiguration DeviceManagementDeploymentPlans DeviceManagementManagedDevices DeviceManagementRBAC DeviceManagementScripts DeviceManagementServiceConfig DeviceTemplate Directory DirectoryRecommendations Domain Domain-InternalFederation EAS eDiscovery EduAdministration EduAssignments EduCurricula EduReports-Reading EduReports-Reflect EduRoster email EngagementConversation EngagementExport EngagementMeetingConversation EngagementRole EntitlementManagement EntitlementMgmt-SubjectAccess EntraBackup EventListener EWS ExchangeMessageTrace ExternalConnection ExternalItem ExternalUserProfile Family FileIngestion FileIngestionHybridOnboarding Files FileStorageContainer FileStorageContainerType FileStorageContainerTypeReg Financials Goals-Export Group Group-Conversation Group-NestingSupport Group-OnPremisesSyncBehavior Group-PreferredDataLocation Group-XTenantIdentitySync GroupMember GroupSettings HealthMonitoringAlert HealthMonitoringAlertConfig IdentityDiagnostic IdentityNotifications IdentityProvider IdentityRiskEvent IdentityRiskyAgent IdentityRiskyServicePrincipal IdentityRiskyUser IdentityUserFlow IMAP IndustryData IndustryData-DataConnector IndustryData-InboundFlow IndustryData-OutboundFlow IndustryData-ReferenceDefinition IndustryData-Run IndustryData-SourceSystem IndustryData-TimePeriod InfoProtectABACPolicy InfoProtectAttributeAssignment InfoProtectAttributeDefinition InformationProtectionConfig InformationProtectionContent InformationProtectionPolicy Insights-UserMetric LearningAssignedCourse LearningContent LearningProvider LearningSelfInitiatedCourse LicenseAssignment LifecyclePolicies-AgentId LifecyclePolicies-Guests LifecycleWorkflows LifecycleWorkflows-CustomExt LifecycleWorkflows-Reports LifecycleWorkflows-Workflow ListItems Lists LockboxRequest LockboxSettings Mail Mail-Advanced MailboxConfigItem MailboxFolder MailboxItem MailboxSettings MailTips ManagedTenants Member MultiTenantOrganization MutualTlsOauthConfiguration NetworkAccess NetworkAccess-Reports NetworkAccessBranch NetworkAccessPolicy Notes Notifications offline_access OnlineMeetingAiInsight OnlineMeetingArtifact OnlineMeetingRecording OnlineMeetings OnlineMeetingTranscript OnPremDirectorySynchronization OnPremisesPublishingProfiles openid Organization OrganizationalBranding OrgContact OrgSettings-AppsAndServices OrgSettings-DynamicsVoice OrgSettings-Forms OrgSettings-Microsoft365Install OrgSettings-Todo PartnerBilling PartnerSecurity PendingExternalUserProfile People PeopleSettings Place PlaceDevice PlaceDeviceTelemetry Policy POP PreAuthorizationGrant Presence PrintConnector Printer PrinterShare PrintJob PrintSettings PrintTaskDefinition PrivilegedAccess PrivilegedAccess-CustomExt PrivilegedAssignmentSchedule PrivilegedEligibilitySchedule profile ProfilePhoto ProgramControl ProtectionScopes ProvisioningLog PublicKeyInfrastructure PullPrintPrinter QnA RealTimeActivityFeed RecordsManagement RemoteTenantGroups Reports ReportSettings ResourceSpecificPermissionGrant RiskPreventionProviders RoleAssignmentSchedule RoleEligibilitySchedule RoleManagement RoleManagementAlert RoleManagementPolicy Schedule Schedule-WorkingTime SchedulePermissions SearchConfiguration SecurityActions SecurityAlert SecurityAnalyzedMessage SecurityCopilotWorkspaces SecurityEvents SecurityIdentitiesAccount SecurityIdentitiesActions SecurityIdentitiesAutoConfig SecurityIdentitiesHealth SecurityIdentitiesMigration SecurityIdentitiesSensors SecurityIdentitiesUserActions SecurityIncident SensitivityLabel SensitivityLabels SentimentSurvey ServiceActivity-Exchange ServiceActivity-Microsoft365Web ServiceActivity-OneDrive ServiceActivity-Teams ServiceHealth ServiceMessage ServiceMessageViewpoint ServicePrincipalEndpoint SharePointCrossTenantMigration SharePointTenantSettings ShortNotes SignInIdentifier Sites SMTP SpiffeTrustDomain Storyline SubjectNameRegistration SubjectRightsRequest Subscription Synchronization SynchronizationData-User SynchronizationMetadata Tasks Team TeamMember TeamsActivity TeamsAppInstallation TeamSettings TeamsPolicyUserAssign TeamsResourceAccount TeamsTab TeamsTelephoneNumber TeamsUserConfiguration TeamTemplates Teamwork TeamworkAppSettings TeamworkCustomEmoji TeamworkDevice TeamworkSection TeamworkTag TeamworkTargetedMessage TeamworkUserInteraction TenantGovernance-Invitation TenantGovernance-PolicyTemplate TenantGovernance-RelatedTenant TenantGovernance-Relationship TenantGovernance-Request TenantGovernance-Setting TermStore ThreatAssessment ThreatHunting ThreatIndicators ThreatIntelligence ThreatSubmission ThreatSubmissionPolicy Topic TrustFrameworkKeySet UnifiedGroupMember User User-ConvertToInternal User-LifeCycleInfo User-Mail User-OnPremisesSyncBehavior User-PasswordProfile User-Phone UserActivity UserAuthenticationMethod UserAuthMethod-Email UserAuthMethod-External UserAuthMethod-HardwareOATH UserAuthMethod-MicrosoftAuthApp UserAuthMethod-Passkey UserAuthMethod-Password UserAuthMethod-Phone UserAuthMethod-PlatformCred UserAuthMethod-QR UserAuthMethod-ResourceKey UserAuthMethod-SoftwareOATH UserAuthMethod-TAP UserAuthMethod-WindowsHello UserCloudClipboard UserNotification UserShiftPreferences UserTeamwork UserTimelineActivity UserWindowsSettings VerifiedId-Profile VirtualAppointment VirtualAppointmentNotification VirtualEvent VirtualEventRegistration-Anon WindowsUpdates Workbooks WorkforceIntegration

AccessReview

Acronym

AdministrativeUnit

AgentCard

AgentCardManifest

AgentCollection

AgentCommunicationConfiguration

AgentIdentity

AgentIdentityBlueprint

AgentIdentityBlueprintPrincipal

AgentIdUser

AgentInstance

AgentRegistration

Agreement

AgreementAcceptance

AiEnterpriseInteraction

Analytics

APIConnectors

AppCatalog

AppCertTrustConfiguration

Application

Application-RemoteDesktopConfig

AppRoleAssignment

ApprovalSolution

ApprovalSolutionResponse

AttackSimulation

AuditActivity

AuditLog

AuditLogsQuery

AuditLogsQuery-CRM

AuditLogsQuery-Endpoint

AuditLogsQuery-Entra

AuditLogsQuery-Exchange

AuditLogsQuery-OneDrive

AuditLogsQuery-SharePoint

AuthenticationContext

BackupRestore-Configuration

BackupRestore-Control

BackupRestore-Monitor

BackupRestore-Restore

BillingConfiguration

BitlockerKey

Bookings

BookingsAppointment

Bookmark

BrowserSiteLists

BusinessScenarioConfig

BusinessScenarioData

Calendars

CallAiInsights

CallDelegation

CallEvents

CallEvents-Emergency

CallRecord-PstnCalls

CallRecordings

CallRecords

Calls

CallTranscripts

CaseManagement

ChangeManagement

Channel

ChannelMember

ChannelMessage

ChannelSettings

Chat

ChatMember

ChatMessage

CloudApp-Discovery

CloudPC

Community

ConfigurationMonitoring

ConsentRequest

Contacts

Contacts-OnPremisesSyncBehavior

Content

ContentActivity

ContentHub-Catalog

ContentHub-Installed

Contracts

CopilotConversation

CopilotPackages

CopilotPolicySettings

CopilotSettings-LimitedMode

CrossTenantContentMigration

CrossTenantInformation

CrossTenantUserProfileSharing

CustomAuthenticationExtension

CustomDetection

CustomObject

CustomObjectDefinition

CustomSecAttributeAssignment

CustomSecAttributeAuditLogs

CustomSecAttributeDefinition

CustomSecAttributeProvisioning

CustomTags

DelegatedAdminRelationship

DelegatedPermissionGrant

Device

DeviceLocalCredential

DeviceManagementApps

DeviceManagementCloudCA

DeviceManagementConfiguration

DeviceManagementDeploymentPlans

DeviceManagementManagedDevices

DeviceManagementRBAC

DeviceManagementScripts

DeviceManagementServiceConfig

DeviceTemplate

Directory

DirectoryRecommendations

Domain

Domain-InternalFederation

EAS

eDiscovery

EduAdministration

EduAssignments

EduCurricula

EduReports-Reading

EduReports-Reflect

EduRoster

email

EngagementConversation

EngagementExport

EngagementMeetingConversation

EngagementRole

EntitlementManagement

EntitlementMgmt-SubjectAccess

EntraBackup

EventListener

EWS

ExchangeMessageTrace

ExternalConnection

ExternalItem

ExternalUserProfile

Family

FileIngestion

FileIngestionHybridOnboarding

Files

FileStorageContainer

FileStorageContainerType

FileStorageContainerTypeReg

Financials

Goals-Export

Group

Group-Conversation

Group-NestingSupport

Group-OnPremisesSyncBehavior

Group-PreferredDataLocation

Group-XTenantIdentitySync

GroupMember

GroupSettings

HealthMonitoringAlert

HealthMonitoringAlertConfig

IdentityDiagnostic

IdentityNotifications

IdentityProvider

IdentityRiskEvent

IdentityRiskyAgent

IdentityRiskyServicePrincipal

IdentityRiskyUser

IdentityUserFlow

IMAP

IndustryData

IndustryData-DataConnector

IndustryData-InboundFlow

IndustryData-OutboundFlow

IndustryData-ReferenceDefinition

IndustryData-Run

IndustryData-SourceSystem

IndustryData-TimePeriod

InfoProtectABACPolicy

InfoProtectAttributeAssignment

InfoProtectAttributeDefinition

InformationProtectionConfig

InformationProtectionContent

InformationProtectionPolicy

Insights-UserMetric

LearningAssignedCourse

LearningContent

LearningProvider

LearningSelfInitiatedCourse

LicenseAssignment

LifecyclePolicies-AgentId

LifecyclePolicies-Guests

LifecycleWorkflows

LifecycleWorkflows-CustomExt

LifecycleWorkflows-Reports

LifecycleWorkflows-Workflow

ListItems

Lists

LockboxRequest

LockboxSettings

Mail

Mail-Advanced

MailboxConfigItem

MailboxFolder

MailboxItem

MailboxSettings

MailTips

ManagedTenants

Member

MultiTenantOrganization

MutualTlsOauthConfiguration

NetworkAccess

NetworkAccess-Reports

NetworkAccessBranch

NetworkAccessPolicy

Notes

Notifications

offline_access

OnlineMeetingAiInsight

OnlineMeetingArtifact

OnlineMeetingRecording

OnlineMeetings

OnlineMeetingTranscript

OnPremDirectorySynchronization

OnPremisesPublishingProfiles

openid

Organization

OrganizationalBranding

OrgContact

OrgSettings-AppsAndServices

OrgSettings-DynamicsVoice

OrgSettings-Forms

OrgSettings-Microsoft365Install

OrgSettings-Todo

PartnerBilling

PartnerSecurity

PendingExternalUserProfile

People

PeopleSettings

Place

PlaceDevice

PlaceDeviceTelemetry

Policy

POP

PreAuthorizationGrant

Presence

PrintConnector

Printer

PrinterShare

PrintJob

PrintSettings

PrintTaskDefinition

PrivilegedAccess

PrivilegedAccess-CustomExt

PrivilegedAssignmentSchedule

PrivilegedEligibilitySchedule

profile

ProfilePhoto

ProgramControl

ProtectionScopes

ProvisioningLog

PublicKeyInfrastructure

PullPrintPrinter

QnA

RealTimeActivityFeed

RecordsManagement

RemoteTenantGroups

Reports

ReportSettings

ResourceSpecificPermissionGrant

RiskPreventionProviders

RoleAssignmentSchedule

RoleEligibilitySchedule

RoleManagement

RoleManagementAlert

RoleManagementPolicy

Schedule

Schedule-WorkingTime

SchedulePermissions

SearchConfiguration

SecurityActions

SecurityAlert

SecurityAnalyzedMessage

SecurityCopilotWorkspaces

SecurityEvents

SecurityIdentitiesAccount

SecurityIdentitiesActions

SecurityIdentitiesAutoConfig

SecurityIdentitiesHealth

SecurityIdentitiesMigration

SecurityIdentitiesSensors

SecurityIdentitiesUserActions

SecurityIncident

SensitivityLabel

SensitivityLabels

SentimentSurvey

ServiceActivity-Exchange

ServiceActivity-Microsoft365Web

ServiceActivity-OneDrive

ServiceActivity-Teams

ServiceHealth

ServiceMessage

ServiceMessageViewpoint

ServicePrincipalEndpoint

SharePointCrossTenantMigration

SharePointTenantSettings

ShortNotes

SignInIdentifier

Sites

SMTP

SpiffeTrustDomain

Storyline

SubjectNameRegistration

SubjectRightsRequest

Subscription

Synchronization

SynchronizationData-User

SynchronizationMetadata

Tasks

Team

TeamMember

TeamsActivity

TeamsAppInstallation

TeamSettings

TeamsPolicyUserAssign

TeamsResourceAccount

TeamsTab

TeamsTelephoneNumber

TeamsUserConfiguration

TeamTemplates

Teamwork

TeamworkAppSettings

TeamworkCustomEmoji

TeamworkDevice

TeamworkSection

TeamworkTag

TeamworkTargetedMessage

TeamworkUserInteraction

TenantGovernance-Invitation

TenantGovernance-PolicyTemplate

TenantGovernance-RelatedTenant

TenantGovernance-Relationship

TenantGovernance-Request

TenantGovernance-Setting

TermStore

ThreatAssessment

ThreatHunting

ThreatIndicators

ThreatIntelligence

ThreatSubmission

ThreatSubmissionPolicy

Topic

TrustFrameworkKeySet

UnifiedGroupMember

User

User-ConvertToInternal

User-LifeCycleInfo

User-Mail

User-OnPremisesSyncBehavior

User-PasswordProfile

User-Phone

UserActivity

UserAuthenticationMethod

UserAuthMethod-Email

UserAuthMethod-External

UserAuthMethod-HardwareOATH

UserAuthMethod-MicrosoftAuthApp

UserAuthMethod-Passkey

UserAuthMethod-Password

UserAuthMethod-Phone

UserAuthMethod-PlatformCred

UserAuthMethod-QR

UserAuthMethod-ResourceKey

UserAuthMethod-SoftwareOATH

UserAuthMethod-TAP

UserAuthMethod-WindowsHello

UserCloudClipboard

UserNotification

UserShiftPreferences

UserTeamwork

UserTimelineActivity

UserWindowsSettings

VerifiedId-Profile

VirtualAppointment

VirtualAppointmentNotification

VirtualEvent

VirtualEventRegistration-Anon

WindowsUpdates

Workbooks

WorkforceIntegration