← cd ~/graph-permissions
// graph-permissions · Chat
Chat.ReadWrite.WhereInstalledMicrosoft Graph permission · High risk
Allows the app to read and write all chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user.
Application permission
High riskRead and write all chat messages for chats where the associated Teams application is installed.. Allows the app to read and write all chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user.
| ID | ad73ce80-f3cd-40ce-b325-df12c33df713 |
|---|---|
| Consent | Always needs admin consent |
| Risk | As an application permission this reaches every user's data in the tenant, without anyone signed in. |
Grant it to an app
In the portal: App registrations › your app › API permissions › Add a permission › Microsoft Graph › Application permissions, then grant admin consent. Or with Graph PowerShell:
Connect-MgGraph -Scopes "Application.Read.All", "AppRoleAssignment.ReadWrite.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$app = Get-MgServicePrincipal -Filter "appId eq '<your app's client id>'"
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $app.Id `
-PrincipalId $app.Id -ResourceId $graph.Id -AppRoleId "ad73ce80-f3cd-40ce-b325-df12c33df713"Which apps already have it?
# Apps that hold Chat.ReadWrite.WhereInstalled as an application permission
Connect-MgGraph -Scopes "Application.Read.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graph.Id -All |
Where-Object AppRoleId -eq "ad73ce80-f3cd-40ce-b325-df12c33df713" |
Select-Object PrincipalDisplayName, PrincipalId, CreatedDateTime