azureblog.co.uk
← cd ~/graph-permissions
// graph-permissions · User

User.ReadWrite.CrossCloudMicrosoft Graph permission · Medium risk

Allows the app to read and update external cloud user profiles without a signed in user.

Application permission

Medium risk

Read and write profiles of users that originate from an external cloud.. Allows the app to read and update external cloud user profiles without a signed in user.

ID5652f862-b626-407b-a3e6-248aeb95763c
ConsentAlways needs admin consent
RiskCan make changes. Check the scope is as narrow as possible.

Grant it to an app

In the portal: App registrations › your app › API permissions › Add a permission › Microsoft Graph › Application permissions, then grant admin consent. Or with Graph PowerShell:

powershell5 lines
Connect-MgGraph -Scopes "Application.Read.All", "AppRoleAssignment.ReadWrite.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$app   = Get-MgServicePrincipal -Filter "appId eq '<your app's client id>'"
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $app.Id `
    -PrincipalId $app.Id -ResourceId $graph.Id -AppRoleId "5652f862-b626-407b-a3e6-248aeb95763c"

Which apps already have it?

powershell6 lines
# Apps that hold User.ReadWrite.CrossCloud as an application permission
Connect-MgGraph -Scopes "Application.Read.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graph.Id -All |
    Where-Object AppRoleId -eq "5652f862-b626-407b-a3e6-248aeb95763c" |
    Select-Object PrincipalDisplayName, PrincipalId, CreatedDateTime

Other User permissions

Check every app in your tenant → Permission explainer

Sources