{"generated":"2026-10-18T00:33:42.391Z","source":"https://azureblog.co.uk","count":999,"note":"Risk ratings are azureblog.co.uk's own guidance, not Microsoft's.","permissions":[{"permission":"AccessReview.Read.All","application":{"id":"d07a8cc0-3d51-4b77-b3b0-32704d1f69fa","name":"Read all access reviews","description":"Allows the app to read access reviews, reviewers, decisions and settings in the organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ebfcd32b-babb-40f4-a14b-42706e83bd28","name":"Read all access reviews that user can access","description":"Allows the app to read access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/accessreview-read-all/"},{"permission":"AccessReview.ReadWrite.All","application":{"id":"ef5f7d5c-338f-44b0-86c3-351f46c8bb5f","name":"Manage all access reviews","description":"Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"e4aa47b9-9a69-4109-82ed-36ec70d85ff1","name":"Manage all access reviews that user can access","description":"Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/accessreview-readwrite-all/"},{"permission":"AccessReview.ReadWrite.Membership","application":{"id":"18228521-a591-40f1-b215-5fad4488c117","name":"Manage access reviews for group and app memberships","description":"Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization for group and app memberships, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"5af8c3f5-baca-439a-97b0-ea58a435e269","name":"Manage access reviews for group and app memberships","description":"Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings for group and app memberships that the signed-in user has access to in the organization.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/accessreview-readwrite-membership/"},{"permission":"Acronym.Read.All","application":{"id":"8c0aed2c-0c61-433d-b63c-6370ddc73248","name":"Read all acronyms","description":"Allows an app to read all acronyms without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9084c10f-a2d6-4713-8732-348def50fe02","name":"Read all acronyms that the user can access","description":"Allows an app to read all acronyms that the signed-in user can access.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/acronym-read-all/"},{"permission":"AdministrativeUnit.Read.All","application":{"id":"134fd756-38ce-4afd-ba33-e9623dbe66c2","name":"Read all administrative units","description":"Allows the app to read administrative units and administrative unit membership without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"3361d15d-be43-4de6-b441-3c746d05163d","name":"Read administrative units","description":"Allows the app to read administrative units and administrative unit membership on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/administrativeunit-read-all/"},{"permission":"AdministrativeUnit.ReadWrite.All","application":{"id":"5eb59dd3-1da2-4329-8733-9dabdc435916","name":"Read and write all administrative units","description":"Allows the app to create, read, update, and delete administrative units and manage administrative unit membership without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"7b8a2d34-6b3f-4542-a343-54651608ad81","name":"Read and write administrative units","description":"Allows the app to create, read, update, and delete administrative units and manage administrative unit membership on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/administrativeunit-readwrite-all/"},{"permission":"AgentCard.Read.All","application":{"id":"aec9e0a0-6f46-4150-a9f7-05e9e3e87399","name":"Read all agent cards in Agent Registry","description":"Allows the app to read all agent cards and their skills in your organization's Agent Registry without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"73ea6732-992c-4292-98f7-9feff18d3ade","name":"Read agent cards in Agent Registry","description":"Allows the app to read agent cards and their skills in your organization's Agent Registry on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcard-read-all/"},{"permission":"AgentCard.ReadWrite.All","application":{"id":"ef566853-42d6-45a5-bed9-5ccb82c98b4f","name":"Read and write all agent cards in Agent Registry","description":"Allows the app to create, read, update, and delete all agent cards and manage their skills in your organization's Agent Registry without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"b0f726a8-0fa2-4ce2-937b-fd17a446261f","name":"Read and write agent cards in Agent Registry","description":"Allows the app to create, read, update, and delete agent cards and manage their skills in your organization's Agent Registry on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcard-readwrite-all/"},{"permission":"AgentCard.ReadWrite.ManagedBy","application":{"id":"9c4a07db-e0c1-4fb0-8e85-dfd8ae3b8201","name":"Read and write managed-by agent cards in Agent Registry","description":"Allows the app to read and update agent cards that designate the calling app as their manager and manage their skills in your organization's Agent Registry without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcard-readwrite-managedby/"},{"permission":"AgentCardManifest.Read.All","application":{"id":"3ee18438-e6e5-4858-8f1c-d7b723b45213","name":"Read all agent card manifests in Agent Registry","description":"Allows the app to read all agent card manifests in your organization's Agent Registry without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ada96a26-9579-4c29-a578-c3482a765716","name":"Read all agent card manifests in Agent Registry","description":"Allows the app to read agent card manifests in your organization's Agent Registry on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcardmanifest-read-all/"},{"permission":"AgentCardManifest.ReadWrite.All","application":{"id":"228b1a03-f7ca-4348-b50d-e8a547ab61af","name":"Read and write all agent card manifests in Agent Registry","description":"Allows the app to read and write to all agent card manifests in your organization's Agent Registry without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"80151b1a-1c31-4846-ae0d-c79939ee13d1","name":"Read and write agent card manifests in Agent Registry","description":"Allows the app to read and write agent card manifests in your organization's Agent Registry on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcardmanifest-readwrite-all/"},{"permission":"AgentCardManifest.ReadWrite.ManagedBy","application":{"id":"77f6034c-52f5-4526-9fa1-d55a67e72cc4","name":"Read and write managed-by agent card manifests in Agent Registry","description":"Allows the app to read and write agent card manifests that name it as manager in your organization's Agent Registry without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcardmanifest-readwrite-managedby/"},{"permission":"AgentCollection.Read.All","application":{"id":"e65ee1da-d1d5-467b-bdd0-3e9bb94e6e0c","name":"Read all collections in Agent Registry, except quarantined and global","description":"Allows the app to read all collections and their membership in your organization's Agent Registry without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"fa50be38-fdff-469c-96dc-ef5fce3c64bf","name":"Read all collections in Agent Registry, except quarantined and global","description":"Allows the app to read collections and their membership in your organization's Agent Registry on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcollection-read-all/"},{"permission":"AgentCollection.Read.Global","application":null,"delegated":{"id":"b14924c8-87f1-438a-81f2-dc370ba2f45d","name":"Read global collection in Agent Registry","description":"Allows the app to read global collection and its membership in your organization's Agent Registry on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcollection-read-global/"},{"permission":"AgentCollection.Read.Quarantined","application":null,"delegated":{"id":"43acfda3-daf3-4aa4-955d-b051d0024e82","name":"Read quarantined collection in Agent Registry","description":"Allows the app to read quarantined collection and its membership in your organization's Agent Registry on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcollection-read-quarantined/"},{"permission":"AgentCollection.ReadWrite.All","application":{"id":"feb31d7d-a227-4487-898c-e014840d07b3","name":"Read and write all collections in Agent Registry, except quarantined and global","description":"Allows the app to create, read, update, and delete all collections and manage their membership in your organization's Agent Registry without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"6d8a7002-a05e-4b95-a768-0e6f0badc6c8","name":"Read and write collections in Agent Registry, except quarantined and global","description":"Allows the app to create, read, update, and delete collections and manage their membership in your organization's Agent Registry on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcollection-readwrite-all/"},{"permission":"AgentCollection.ReadWrite.Global","application":null,"delegated":{"id":"c001dd65-8a6b-4349-ab0c-4e8a410d28d2","name":"Read and write global collection in Agent Registry","description":"Allows the app to read and update global collection and manage its membership in your organization's Agent Registry on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcollection-readwrite-global/"},{"permission":"AgentCollection.ReadWrite.ManagedBy","application":{"id":"2e0fb698-9996-479f-926b-ce63f4397829","name":"Read and write managed-by collections in Agent Registry","description":"Allows the app to create, read, update, and delete collections that designate the calling app as their manager and manage their membership in your organization's Agent Registry without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcollection-readwrite-managedby/"},{"permission":"AgentCollection.ReadWrite.Quarantined","application":null,"delegated":{"id":"ae331cc9-9f51-484b-a90b-124f2e4a6398","name":"Read and write quarantined collection in Agent Registry","description":"Allows the app to read and update quarantined collection and manage its membership in your organization's Agent Registry on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcollection-readwrite-quarantined/"},{"permission":"AgentCommunicationConfiguration.Read","application":null,"delegated":{"id":"57ff8075-2fb3-4879-8693-5d51ee8d5e9e","name":"Read agent communication configuration","description":"Allows the app to read the communication configuration of agent blueprints on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcommunicationconfiguration-read/"},{"permission":"AgentCommunicationConfiguration.Read.All","application":{"id":"eccf3f2d-f81a-4718-95d7-ef4a0c42ac43","name":"Read all agent communication configurations","description":"Allows the app to read the communication configuration of agent blueprints without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcommunicationconfiguration-read-all/"},{"permission":"AgentCommunicationConfiguration.ReadWrite","application":null,"delegated":{"id":"15e0db35-0641-4175-b014-c2cb39286338","name":"Read and write agent communication configuration","description":"Allows the app to read and update the communication configuration of agent blueprints on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcommunicationconfiguration-readwrite/"},{"permission":"AgentCommunicationConfiguration.ReadWrite.All","application":{"id":"9c72696d-c77b-4d8d-b59e-dfca4792c9ec","name":"Read and write all agent communication configurations","description":"Allows the app to read and update the communication configuration of agent blueprints without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentcommunicationconfiguration-readwrite-all/"},{"permission":"AgentIdentity.Create.All","application":{"id":"ad25cc1d-84d8-47df-a08e-b34c2e800819","name":"Create agent identities without an agent blueprint parent","description":"Allows the client to create agent identities without a signed-in user, even if the client is not the parent agent identity blueprint.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"e75eeac6-d759-4ba3-ae5c-773a27efafba","name":"Create agent identities without an agent blueprint parent","description":"Allows the client to create agent identities on behalf of the signed-in user, even if the client is not the parent agent identity blueprint.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentity-create-all/"},{"permission":"AgentIdentity.CreateAsManager","application":{"id":"4c390976-b2b7-42e0-9187-c6be3bead001","name":"Create and manage agent identities as the parent agent identity blueprint","description":"Allows the app to create agent identities as the parent agent identity blueprint and fully manage them, including reading, updating, and deleting, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentity-createasmanager/"},{"permission":"AgentIdentity.DeleteRestore.All","application":{"id":"5b016f9b-18eb-41d4-869a-66931914d1c8","name":"Delete and restore agent identities","description":"Allows the client to delete and restore agent identities without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"c8ee41e5-35e7-4fe9-8ecb-93493adcac5b","name":"Delete and restore agent identities","description":"Allows the client to delete and restore agent identities on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentity-deleterestore-all/"},{"permission":"AgentIdentity.EnableDisable.All","application":{"id":"69ee0943-4fa4-4ec8-8e52-d12e4ea661a3","name":"Enable or disable agent identities","description":"Allows the client to enable or disable agent identities without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"a501206a-e364-4a3f-be6e-765806d0e323","name":"Enable or disable agent identities","description":"Allows the client to enable or disable agent identities on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentity-enabledisable-all/"},{"permission":"AgentIdentity.Read.All","application":{"id":"b2b8f011-2898-4234-9092-5059f6c1ebfa","name":"Read all agent identities","description":"Allows the app to read all agent identities without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"5e850691-d86a-4b24-bfa6-8a52fb37a0c1","name":"Read all agent identities","description":"Allows the client to read all agent identities on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentity-read-all/"},{"permission":"AgentIdentity.ReadWrite.All","application":{"id":"dcf7150a-88d4-4fe6-9be1-c2744c455397","name":"Read and write all agent identities","description":"Allows the client to read, update, create, and delete agent identities without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"4a4facd5-0ee1-49b7-a5b2-fdcc2491685e","name":"Read and write all agent identities","description":"Allows the client to read, update, create, and delete agent identities on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentity-readwrite-all/"},{"permission":"AgentIdentityBlueprint.AddRemoveCreds.All","application":{"id":"0510736e-bdfb-4b37-9a1f-89b4a074763a","name":"Update agent identity blueprint credentials","description":"Allows updating agent identity blueprint credentials without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"75b5feb2-bfe7-423f-907d-cc505186f246","name":"Update agent identity blueprint credentials","description":"Allows updating agent identity blueprint credentials on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentityblueprint-addremovecreds-all/"},{"permission":"AgentIdentityBlueprint.Create","application":{"id":"ea4b2453-ad2d-4d94-9155-10d5d9493ce9","name":"Create agent identity blueprints.","description":"Allows creating new agent identity blueprints without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"8fc15edd-ba24-494e-9bf6-d38e1b7ba8fd","name":"Create agent identity blueprints.","description":"Allows creating new agent identity blueprints on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentityblueprint-create/"},{"permission":"AgentIdentityBlueprint.DeleteRestore.All","application":{"id":"3f80b699-6405-4e36-a4df-4f19950ff91e","name":"Delete and restore agent identity blueprints.","description":"Allows deleting or restoring agent identity blueprints without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"f12ba1f6-afb7-4685-9a30-21e8c3f551d8","name":"Delete and restore agent identity blueprints.","description":"Allows deleting or restoring agent identity blueprints on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentityblueprint-deleterestore-all/"},{"permission":"AgentIdentityBlueprint.Read.All","application":{"id":"7547a7d1-36fa-4479-9c31-559a600eaa4f","name":"Read all agent identity blueprints","description":"Allows the client to read all agent identity blueprints without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"26512dc8-1364-4e9f-867c-6d8b22a9e162","name":"Read all agent identity blueprints","description":"Allows the client to read all agent identity blueprints on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentityblueprint-read-all/"},{"permission":"AgentIdentityBlueprint.ReadWrite.All","application":{"id":"7fddd33b-d884-4ec0-8696-72cff90ff825","name":"Read and write all agent identity blueprints.","description":"Allows the client to read, update, create, and delete agent identity blueprints without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"4fd490fc-1467-48eb-8a4c-421597ab0402","name":"Read and write all agent identity blueprints.","description":"Allows the client to read, update, create, and delete agent identity blueprints on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentityblueprint-readwrite-all/"},{"permission":"AgentIdentityBlueprint.UpdateAuthProperties.All","application":{"id":"19202363-278e-49c2-bf00-391e2ba00881","name":"Update agent identity blueprint authorization and authentication properties","description":"Allows updating agent identity blueprint authorization and authentication properties without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"6f677aa9-25af-49a5-8a1d-628dc7f0d009","name":"Update agent identity blueprint authorization and authentication properties","description":"Allows updating agent identity blueprint authorization and authentication properties on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentityblueprint-updateauthproperties-all/"},{"permission":"AgentIdentityBlueprint.UpdateBranding.All","application":{"id":"76232daa-a1e4-4544-b664-495a006513bf","name":"Update agent identity blueprint branding","description":"Allows updating agent identity blueprint branding without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"60960e31-67cb-4d25-9d36-4922109923a2","name":"Update agent identity blueprint branding","description":"Allows updating agent identity blueprint branding on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentityblueprint-updatebranding-all/"},{"permission":"AgentIdentityBlueprintPrincipal.Create","application":{"id":"8959696d-d07e-4916-9b1e-3ba9ce459161","name":"Create agent identity blueprint principals.","description":"Allows creating new agent identity blueprint principals without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"00dcd896-6b23-42ce-b5de-c58493c05e22","name":"Create agent identity blueprint principals.","description":"Allows creating new agent identity blueprint principals on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentityblueprintprincipal-create/"},{"permission":"AgentIdentityBlueprintPrincipal.DeleteRestore.All","application":{"id":"f86a2dd8-9298-4675-bd78-f5a3572da2d7","name":"Delete and restore agent identity blueprint principals.","description":"Allows deleting or restoring agent identity blueprint principals without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2c70023e-a482-4af2-9ff1-51ded53e6bad","name":"Delete and restore agent identity blueprint principals.","description":"Allows deleting or restoring agent identity blueprint principals on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentityblueprintprincipal-deleterestore-all/"},{"permission":"AgentIdentityBlueprintPrincipal.EnableDisable.All","application":{"id":"a0bdd23d-8b19-4682-b428-574d96527c6f","name":"Enable or disable agent identity blueprint principals.","description":"Allows enabling or disabling agent identity blueprint principals without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"e7475e0a-9f02-43e2-a250-5c2ea74ccd0e","name":"Enable or disable agent identity blueprint principals.","description":"Allows enabling or disabling agent identity blueprint principals on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentityblueprintprincipal-enabledisable-all/"},{"permission":"AgentIdentityBlueprintPrincipal.Read.All","application":{"id":"9361dea9-4524-493d-941d-f1b65aaf6c7c","name":"Read agent identity blueprint principals.","description":"Allows reading agent identity blueprint principals without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"88c856a2-de61-4632-b2d4-ac503cbc8dd2","name":"Read agent identity blueprint principals.","description":"Allows reading agent identity blueprint principals on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentityblueprintprincipal-read-all/"},{"permission":"AgentIdentityBlueprintPrincipal.ReadWrite.All","application":{"id":"3bc933bc-8b4d-4cb6-ac49-b73774299250","name":"Read and write all agent identity blueprint principals.","description":"Allows the app to read, update, create, and delete agent identity blueprint principals without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"bf2cad6a-9082-438a-9a63-95fa2687af65","name":"Read and write all agent identity blueprint principals.","description":"Allows the app to read, update, create, and delete agent identity blueprint principals on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentidentityblueprintprincipal-readwrite-all/"},{"permission":"AgentIdUser.ReadWrite.All","application":{"id":"b782c9ad-6f2b-4894-a21b-72bf22417f0a","name":"Read and write all agent ID users' full profiles","description":"Allows the app to create agent users, read and update agent ID user profiles and read basic company properties, delete and restore agent users without a signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"ad57fb88-4658-4fd6-ab7d-e43184b08e4e","name":"Read and write all agent ID users' full profiles","description":"Allows the app to create agent users, read and write the full set of profile properties, reports, and managers of agent ID users, delete and restore agent users in your organization, and read basic company properties, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentiduser-readwrite-all/"},{"permission":"AgentIdUser.ReadWrite.IdentityParentedBy","application":{"id":"4aa6e624-eee0-40ab-bdd8-f9639038a614","name":"Read and write full profiles of agent ID users under an agent blueprint","description":"Allows the app to create agent users, read and update agent ID user profiles, delete and restore agent users under an agent blueprint, and read basic company properties without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"52a417d9-0b3c-4466-9a3b-66960de73d74","name":"Read and write full profiles of agent ID users under an agent blueprint","description":"Allows the app to create agent users, read and write the full set of profile properties, reports, and managers of agent ID users in your organization, delete and restore agent users under an agent blueprint, and read basic company properties, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentiduser-readwrite-identityparentedby/"},{"permission":"AgentInstance.Read.All","application":{"id":"799a4732-85b8-4c67-b048-75f0e88a232b","name":"Read all agent instances in Agent Registry","description":"Allows the app to read all agent instances and their related collections in your organization's Agent Registry without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"4c3c738a-2df0-4877-bf4a-f796950ff34c","name":"Read all agent instances in Agent Registry","description":"Allows the app to read agent instances and their related collections in your organization's Agent Registry on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentinstance-read-all/"},{"permission":"AgentInstance.ReadWrite.All","application":{"id":"07abdd95-78dc-4353-bd32-09f880ea43d0","name":"Read and write all agent instances in Agent Registry","description":"Allows the app to create, read, update, and delete all agent instances in your organization's Agent Registry without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"fc79e324-da24-497a-b5ec-e7de08320375","name":"Read and write agent instances in Agent Registry","description":"Allows the app to create, read, update, and delete agent instances in your organization's Agent Registry on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentinstance-readwrite-all/"},{"permission":"AgentInstance.ReadWrite.ManagedBy","application":{"id":"782ab1bf-24f1-4c27-8bbc-2006d42792a6","name":"Read and write managed-by agent instances in Agent Registry","description":"Allows the app to create, read, update, and delete agent instances that designate the calling app as their manager in your organization's Agent Registry without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentinstance-readwrite-managedby/"},{"permission":"AgentRegistration.Read.All","application":{"id":"d3acceb6-4673-47c0-aeac-582f2c7cf72c","name":"Read all agent registrations","description":"Allows the app to read agent registration information without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ef96ce0b-b2ea-4ae4-a783-108212d8ecee","name":"Read all agent registrations","description":"Allows the user to read all agent registration information","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentregistration-read-all/"},{"permission":"AgentRegistration.ReadWrite.All","application":{"id":"39fb8c64-7bd3-4107-8515-14d6e55ddda4","name":"Read and write all agent registrations","description":"Allows the app to read and write agent registration information without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"20f263bf-7d50-4e66-912c-16b4b4194fd4","name":"Read and write all agent registrations","description":"Allows the user to read and write all agent registration information","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agentregistration-readwrite-all/"},{"permission":"Agreement.Read.All","application":{"id":"2f3e6f8c-093b-4c57-a58b-ba5ce494a169","name":"Read all terms of use agreements","description":"Allows the app to read terms of use agreements, without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"af2819c9-df71-4dd3-ade7-4d7c9dc653b7","name":"Read all terms of use agreements","description":"Allows the app to read terms of use agreements on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agreement-read-all/"},{"permission":"Agreement.ReadWrite.All","application":{"id":"c9090d00-6101-42f0-a729-c41074260d47","name":"Read and write all terms of use agreements","description":"Allows the app to read and write terms of use agreements, without a signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"ef4b5d93-3104-4664-9053-a5c49ab44218","name":"Read and write all terms of use agreements","description":"Allows the app to read and write terms of use agreements on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agreement-readwrite-all/"},{"permission":"AgreementAcceptance.Read","application":null,"delegated":{"id":"0b7643bb-5336-476f-80b5-18fbfbc91806","name":"Read user terms of use acceptance statuses","description":"Allows the app to read terms of use acceptance statuses on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agreementacceptance-read/"},{"permission":"AgreementAcceptance.Read.All","application":{"id":"d8e4ec18-f6c0-4620-8122-c8b1f2bf400e","name":"Read all terms of use acceptance statuses","description":"Allows the app to read terms of use acceptance statuses, without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"a66a5341-e66e-4897-9d52-c2df58c2bfb9","name":"Read terms of use acceptance statuses that user can access","description":"Allows the app to read terms of use acceptance statuses on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/agreementacceptance-read-all/"},{"permission":"AiEnterpriseInteraction.Read","application":null,"delegated":{"id":"859cceb9-2ec2-4e48-bcd7-b8490b5248a5","name":"Read user AI enterprise interactions.","description":"Allows the app to read user AI enterprise interactions, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/aienterpriseinteraction-read/"},{"permission":"AiEnterpriseInteraction.Read.All","application":{"id":"839c90ab-5771-41ee-aef8-a562e8487c1e","name":"Read all AI enterprise interactions.","description":"Allows the app to read all AI enterprise interactions.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/aienterpriseinteraction-read-all/"},{"permission":"Analytics.Read","application":null,"delegated":{"id":"e03cf23f-8056-446a-8994-7d93dfc8b50e","name":"Read user activity statistics","description":"Allows the app to read the signed-in user's activity statistics, such as how much time the user has spent on emails, in meetings, or in chat sessions.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/analytics-read/"},{"permission":"APIConnectors.Read.All","application":{"id":"b86848a7-d5b1-41eb-a9b4-54a4e6306e97","name":"Read API connectors for authentication flows","description":"Allows the app to read the API connectors used in user authentication flows, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"1b6ff35f-31df-4332-8571-d31ea5a4893f","name":"Read API connectors for authentication flows","description":"Allows the app to read the API connectors used in user authentication flows, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/apiconnectors-read-all/"},{"permission":"APIConnectors.ReadWrite.All","application":{"id":"1dfe531a-24a6-4f1b-80f4-7a0dc5a0a171","name":"Read and write API connectors for authentication flows","description":"Allows the app to read, create and manage the API connectors used in user authentication flows, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"c67b52c5-7c69-48b6-9d48-7b3af3ded914","name":"Read and write API connectors for authentication flows","description":"Allows the app to read, create and manage the API connectors used in user authentication flows, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/apiconnectors-readwrite-all/"},{"permission":"AppCatalog.Read.All","application":{"id":"e12dae10-5a57-4817-b79d-dfbec5348930","name":"Read all app catalogs","description":"Allows the app to read apps in the app catalogs without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"88e58d74-d3df-44f3-ad47-e89edf4472e4","name":"Read all app catalogs","description":"Allows the app to read the apps in the app catalogs.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/appcatalog-read-all/"},{"permission":"AppCatalog.ReadWrite.All","application":{"id":"dc149144-f292-421e-b185-5953f2e98d7f","name":"Read and write to all app catalogs","description":"Allows the app to create, read, update, and delete apps in the app catalogs without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"1ca167d5-1655-44a1-8adf-1414072e1ef9","name":"Read and write to all app catalogs","description":"Allows the app to create, read, update, and delete apps in the app catalogs.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/appcatalog-readwrite-all/"},{"permission":"AppCatalog.Submit","application":null,"delegated":{"id":"3db89e36-7fa6-4012-b281-85f3d9d9fd2e","name":"Submit application packages to the catalog and cancel pending submissions","description":"Allows the app to submit application packages to the catalog and cancel submissions that are pending review on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/appcatalog-submit/"},{"permission":"AppCertTrustConfiguration.Read.All","application":{"id":"f0d7f93b-6fce-4221-a197-ace5848da396","name":"Read all trusted certificate authority configurations for applications","description":"Allows the app to read all trusted certificate authority configurations which can be used to restrict application certificates based on their issuing authority, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"af281d3a-030d-4122-886e-146fb30a0413","name":"Read the trusted certificate authority configuration for applications","description":"Allows the app to read the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/appcerttrustconfiguration-read-all/"},{"permission":"AppCertTrustConfiguration.ReadWrite.All","application":{"id":"e508b0bc-7b1a-4b59-8646-d12066f4a72f","name":"Read and write all trusted certificate authority configurations for applications","description":"Allows the app to create, read, update and delete all trusted certificate authority configurations which can be used to restrict application certificates based on their issuing authority, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"4bae2ed4-473e-4841-a493-9829cfd51d48","name":"Read and write the trusted certificate authority configuration for applications","description":"Allows the app to create, read, update and delete the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/appcerttrustconfiguration-readwrite-all/"},{"permission":"Application-RemoteDesktopConfig.ReadWrite.All","application":{"id":"3be0012a-cc4e-426b-895b-f9c836bf6381","name":"Read and write the remote desktop security configuration for all apps","description":"Allows the app to read and write the remote desktop security configuration for all apps in your organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"ffa91d43-2ad8-45cc-b592-09caddeb24bb","name":"Read and write the remote desktop security configuration for apps","description":"Allows the app to read and write other apps' remote desktop security configuration, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/application-remotedesktopconfig-readwrite-all/"},{"permission":"Application.Read.All","application":{"id":"9a5d68dd-52b0-4cc2-bd40-abcf44ac3a30","name":"Read all applications","description":"Allows the app to read all applications and service principals without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"c79f8feb-a9db-4090-85f9-90d820caa0eb","name":"Read applications","description":"Allows the app to read applications and service principals on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/application-read-all/"},{"permission":"Application.ReadUpdate.All","application":{"id":"fc023787-fd04-4e44-9bc7-d454f00c0f0a","name":"Read and update all apps","description":"Allows the app to read and update all apps in your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"0586a906-4d89-4de8-b3c8-1aacdcc0c679","name":"Read and update all apps","description":"Allows the app to read and update all apps in your organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/application-readupdate-all/"},{"permission":"Application.ReadWrite.All","application":{"id":"1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9","name":"Read and write all applications","description":"Allows the app to create, read, update and delete applications and service principals without a signed-in user. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"delegated":{"id":"bdfbf15f-ee85-4955-8675-146e8e5296b5","name":"Read and write applications","description":"Allows the app to create, read, update and delete applications and service principals on behalf of the signed-in user. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"leastPrivilege":"If the app only manages apps it created, use Application.ReadWrite.OwnedBy.","url":"https://azureblog.co.uk/graph-permissions/application-readwrite-all/"},{"permission":"Application.ReadWrite.OwnedBy","application":{"id":"18a4783c-866b-4cc7-a460-3d5e5662c884","name":"Manage apps that this app creates or owns","description":"Allows the app to create other applications, and fully manage those applications (read, update, update application secrets and delete), without a signed-in user.  It cannot update any apps that it is not an owner of.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/application-readwrite-ownedby/"},{"permission":"AppRoleAssignment.ReadWrite.All","application":{"id":"06b708a9-e830-4db3-a914-8e69da51d44f","name":"Manage app permission grants and app role assignments","description":"Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"delegated":{"id":"84bccea3-f856-4a8a-967b-dbe0a3d53a64","name":"Manage app permission grants and app role assignments","description":"Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/approleassignment-readwrite-all/"},{"permission":"ApprovalSolution.Read","application":null,"delegated":{"id":"b0df437d-d341-4df0-aa3e-89ca81a1207f","name":"Read approvals","description":"Allows the app to read approvals on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/approvalsolution-read/"},{"permission":"ApprovalSolution.Read.All","application":{"id":"9f265de7-8d5e-4e9a-a805-5e8bbc49656f","name":"Read all approvals","description":"Allows the app to read all approvals and approval item subscriptions, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/approvalsolution-read-all/"},{"permission":"ApprovalSolution.ReadWrite","application":null,"delegated":{"id":"6768d3af-4562-48ff-82d2-c5e19eb21b9c","name":"Read, create, and respond to approvals","description":"Allows the app to provision, read, create, and respond to approvals on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/approvalsolution-readwrite/"},{"permission":"ApprovalSolution.ReadWrite.All","application":{"id":"45583558-1113-4d06-8969-e79a28edc9ad","name":"Read all approvals and manage approval subscriptions","description":"Allows the app to read all approvals and create, update, or remove approval item subscriptions, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/approvalsolution-readwrite-all/"},{"permission":"ApprovalSolutionResponse.ReadWrite","application":null,"delegated":{"id":"89d944f2-2011-44ad-830c-aa9bf5ef2319","name":"Read and respond to approvals assigned to the current user","description":"Allows the app to read and respond to approvals on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/approvalsolutionresponse-readwrite/"},{"permission":"AttackSimulation.Read.All","application":{"id":"93283d0a-6322-4fa8-966b-8c121624760d","name":"Read attack simulation data of an organization","description":"Allows the app to read attack simulation and training data for an organization without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"104a7a4b-ca76-4677-b7e7-2f4bc482f381","name":"Read attack simulation data of an organization","description":"Allows the app to read attack simulation and training data for an organization for the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/attacksimulation-read-all/"},{"permission":"AttackSimulation.ReadWrite.All","application":{"id":"e125258e-8c8a-42a8-8f55-ab502afa52f3","name":"Read, create, and update all attack simulation data of an organization","description":"Allows the app to read, create, and update attack simulation and training data for an organization without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"27608d7c-2c66-4cad-a657-951d575f5a60","name":"Read, create, and update attack simulation data of an organization","description":"Allows the app to read, create, and update attack simulation and training data for an organization for the signed-in user.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/attacksimulation-readwrite-all/"},{"permission":"AuditActivity.Read","application":{"id":"99bc85fb-e857-4220-9f8c-3a1c83148d2e","name":"Read activity audit log from the audit store.","description":"Read activity audit log from the audit store.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"16786f81-40d2-4116-bb26-d1a753bf0b20","name":"Read activity audit log from the audit store.","description":"Read activity audit log from the audit store.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/auditactivity-read/"},{"permission":"AuditActivity.Write","application":{"id":"f6318678-2713-4bb6-b123-233e7336c1bd","name":"Upload activity audit logs to the audit store.","description":"Allows the application to upload bulk activity audit logs to the audit store.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"a78fd341-0672-4792-a8ae-a5925b2546eb","name":"Upload activity audit logs to the audit store.","description":"Allows the application to upload bulk activity audit logs to the audit store.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/auditactivity-write/"},{"permission":"AuditLog.Read.All","application":{"id":"b0afded3-3588-46d8-8b3d-9842eff778da","name":"Read all audit log data","description":"Allows the app to read and query your audit log activities, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"e4c9e354-4dc5-45b8-9e7c-e1393b0b1a20","name":"Read audit log data","description":"Allows the app to read and query your audit log activities, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":"For sign-in activity only, this is usually the minimum. Grant it to as few apps as possible.","url":"https://azureblog.co.uk/graph-permissions/auditlog-read-all/"},{"permission":"AuditLogsQuery-CRM.Read.All","application":{"id":"20e6f8e4-ffac-4cf7-82f7-70ddb7564318","name":"Read audit logs data from Dynamics CRM workload","description":"Allows the app to read and query audit logs from Dynamics CRM workload, without a signed-in user","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ba78b16f-1e01-41b6-89ca-73e0a32b304c","name":"Read audit logs data from Dynamics CRM workload","description":"Allows the app to read and query audit logs from Dynamics CRM workload, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/auditlogsquery-crm-read-all/"},{"permission":"AuditLogsQuery-Endpoint.Read.All","application":{"id":"0bc85aed-7b0b-437a-bac8-3b29a1b84c99","name":"Read audit logs data from Endpoint Data Loss Prevention workload","description":"Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, without a signed-in user","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ee3409fe-617f-43cf-bd1e-fc8b38049e69","name":"Read audit logs data from Endpoint Data Loss Prevention workload","description":"Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/auditlogsquery-endpoint-read-all/"},{"permission":"AuditLogsQuery-Entra.Read.All","application":{"id":"7276d950-48fc-4269-8348-f22f2bb296d0","name":"Read audit logs data from Entra (Azure AD) workload","description":"Allows the app to read and query audit logs from Entra (Azure AD) workload, without a signed-in user","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"5ff2f415-e0f1-4d11-bfd0-6d87c0f667fd","name":"Read audit logs data from Entra (Azure AD) workload","description":"Allows the app to read and query audit logs from Entra (Azure AD) workload, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/auditlogsquery-entra-read-all/"},{"permission":"AuditLogsQuery-Exchange.Read.All","application":{"id":"6b0d2622-d34e-4470-935b-b96550e5ca8d","name":"Read audit logs data from Exchange workload","description":"Allows the app to read and query audit logs from Exchange workload, without a signed-in user","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"6c8c71d2-c7e1-45b0-ac6d-1d2724fba6ae","name":"Read audit logs data from Exchange workload","description":"Allows the app to read and query audit logs from Exchange workload, on behalf of a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/auditlogsquery-exchange-read-all/"},{"permission":"AuditLogsQuery-OneDrive.Read.All","application":{"id":"8a169a81-841c-45fd-ad43-96aede8801a0","name":"Read audit logs data from OneDrive workload","description":"Allows the app to read and query audit logs from OneDrive workload, without a signed-in user","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"4a72c235-a50d-4870-b598-fd88fd1fa074","name":"Read audit logs data from OneDrive workload","description":"Allows the app to read and query audit logs from OneDrive workload, on behalf of a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/auditlogsquery-onedrive-read-all/"},{"permission":"AuditLogsQuery-SharePoint.Read.All","application":{"id":"91c64a47-a524-4fce-9bf3-3d569a344ecf","name":"Read audit logs data from SharePoint workload","description":"Allows the app to read and query audit logs from SharePoint workload, without a signed-in user","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"30630b65-ed12-4a81-9130-e3a964109fae","name":"Read audit logs data from SharePoint workload","description":"Allows the app to read and query audit logs from SharePoint workload, on behalf of a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/auditlogsquery-sharepoint-read-all/"},{"permission":"AuditLogsQuery.Read.All","application":{"id":"5e1e9171-754d-478c-812c-f1755a9a4c2d","name":"Read audit logs data from all services","description":"Allows the app to read and query audit logs from all services.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"1d9e7ac3-0eca-442c-82f9-e92625af6e6d","name":"Read audit logs data from all services","description":"Allows the app to read and query audit logs from all services, on behalf of a signed-in user","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/auditlogsquery-read-all/"},{"permission":"AuthenticationContext.Read.All","application":{"id":"381f742f-e1f8-4309-b4ab-e3d91ae4c5c1","name":"Read all authentication context information","description":"Allows the app to read the authentication context information in your organization without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"57b030f1-8c35-469c-b0d9-e4a077debe70","name":"Read all authentication context information","description":"Allows the app to read all authentication context information in your organization on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/authenticationcontext-read-all/"},{"permission":"AuthenticationContext.ReadWrite.All","application":{"id":"a88eef72-fed0-4bf7-a2a9-f19df33f8b83","name":"Read and write all authentication context information","description":"Allows the app to read and update the authentication context information in your organization without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"ba6d575a-1344-4516-b777-1404f5593057","name":"Read and write all authentication context information","description":"Allows the app to read and update all authentication context information in your organization on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/authenticationcontext-readwrite-all/"},{"permission":"BackupRestore-Configuration.Read.All","application":{"id":"5fbb5982-3230-4882-93c0-2167523ce0c2","name":"Read all backup configuration policies","description":"Allows the app to read all backup configurations, and lists of Microsoft 365 service resources to be backed-up, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"444ed4b6-0554-4dc6-8e9c-3f9a34ee3ff6","name":"Read backup configuration policies","description":"Allows the app to read the backup configuration, and list of Microsoft 365 service resources to be backed-up, on behalf of the signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/backuprestore-configuration-read-all/"},{"permission":"BackupRestore-Configuration.ReadWrite.All","application":{"id":"18133149-5489-40ac-80f0-4b6fa85f6cdc","name":"Read and edit all backup configuration policies","description":"Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"a0244d16-171c-4496-8ffb-7b9b6954d339","name":"Read and edit backup configuration policies","description":"Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, on behalf of the signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/backuprestore-configuration-readwrite-all/"},{"permission":"BackupRestore-Control.Read.All","application":{"id":"6fe20a79-0e15-45a1-b019-834c125993a0","name":"Read the status of the M365 backup service","description":"Allows the app to read the status of M365 backup service (enable/disable), without signed in user","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"af598c63-4292-4437-b925-e996354d3854","name":"Read the status of the M365 backup service","description":"Allows the app to read the status of M365 backup service (enable/disable), on behalf of the signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/backuprestore-control-read-all/"},{"permission":"BackupRestore-Control.ReadWrite.All","application":{"id":"fb240865-88f8-4a1d-923f-98dbc7920860","name":"Update or read the status of the M365 backup service","description":"Allows the app to update or read the status of M365 backup service (enable/disable), without signed in user","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"96d46335-d92d-41b8-bc9f-273a692381ea","name":"Update or read the status of the M365 backup service","description":"Allows the app to update or read the status of M365 backup service (enable/disable), on behalf of the signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/backuprestore-control-readwrite-all/"},{"permission":"BackupRestore-Monitor.Read.All","application":{"id":"ecae8511-f2d7-4be4-bdbf-91f244d45986","name":"Read all monitoring, quota and billing information for the tenant","description":"Allows the app to monitor all backup and restore jobs, view quota usage and billing details, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"b4e98de1-4600-4e90-b5e1-7c1dfef04e5c","name":"Read monitoring, quota and billing information for the tenant","description":"Allows the app to monitor backup and restore jobs, view quota usage and billing details, on behalf of the signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/backuprestore-monitor-read-all/"},{"permission":"BackupRestore-Restore.Read.All","application":{"id":"87853aa5-0372-4710-b34b-cef27bb7156e","name":"Read all restore sessions","description":"Allows the app to read all restore sessions, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"94b36f78-434f-4904-8c08-421d9a9c1dc2","name":"Read restore sessions","description":"Allows the app to read restore sessions, on behalf of the signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/backuprestore-restore-read-all/"},{"permission":"BackupRestore-Restore.ReadWrite.All","application":{"id":"bebd0841-a3d8-4313-a51d-731112c8ee41","name":"Read restore all sessions and start restore sessions from backups","description":"Allows the app to search all backup snapshots for Microsoft 365 resources, and restore Microsoft 365 resources from a backed-up snapshot, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"9f89e109-94b9-4c9b-b4fc-98cdaa54f574","name":"Read restore sessions and start restore sessions from backups","description":"Allows the app to search the backup snapshots for Microsoft 365 resources, and restore Microsoft 365 resources from a backed-up snapshot, on behalf of the signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/backuprestore-restore-readwrite-all/"},{"permission":"BackupRestore-Search.Read.All","application":{"id":"f6135c51-c766-4be1-9638-ed90c2ed2443","name":"Search for metadata properties in all backup snapshots","description":"Allows the app to search all backup snapshots for Microsoft 365 resources, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2b24830f-f435-446f-ab5a-b1e70d9a2eb5","name":"Search for metadata properties in backup snapshots","description":"Allows the app to search the backup snapshots for Microsoft 365 resources, on behalf of the signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/backuprestore-search-read-all/"},{"permission":"BillingConfiguration.ReadWrite.All","application":{"id":"9e8be751-7eee-4c09-bcfd-d64f6b087fd8","name":"Read and write application billing configuration","description":"Allows the app to read and write the billing configuration on all applications without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"2bf6d319-dfca-4c22-9879-f88dcfaee6be","name":"Read and write application billing configuration","description":"Allows the app to read and write the billing configuration on all applications on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/billingconfiguration-readwrite-all/"},{"permission":"BitlockerKey.Read.All","application":{"id":"57f1cf28-c0c4-4ec3-9a30-19a2eaaf2f6e","name":"Read all BitLocker keys","description":"Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"b27a61ec-b99c-4d6a-b126-c4375d08ae30","name":"Read BitLocker keys","description":"Allows the app to read BitLocker keys on behalf of the signed-in user, for their owned devices. Allows read of the recovery key.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/bitlockerkey-read-all/"},{"permission":"BitlockerKey.ReadBasic.All","application":{"id":"f690d423-6b29-4d04-98c6-694c42282419","name":"Read all BitLocker keys basic information","description":"Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"5a107bfc-4f00-4e1a-b67e-66451267bc68","name":"Read BitLocker keys basic information","description":"Allows the app to read basic BitLocker key properties on behalf of the signed-in user, for their owned devices. Does not allow read of the recovery key itself.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/bitlockerkey-readbasic-all/"},{"permission":"Bookings.Manage.All","application":{"id":"6b22000a-1228-42ec-88db-b8c00399aecb","name":"Manage bookings information","description":"Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"7f36b48e-542f-4d3b-9bcb-8406f0ab9fdb","name":"Manage bookings information","description":"Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/bookings-manage-all/"},{"permission":"Bookings.Read.All","application":{"id":"6e98f277-b046-4193-a4f2-6bf6a78cd491","name":"Read all Bookings related resources.","description":"Allows an app to read Bookings appointments, businesses, customers, services, and staff without a signed-in user.  ","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"33b1df99-4b29-4548-9339-7a7b83eaeebc","name":"Read bookings information","description":"Allows an app to read bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/bookings-read-all/"},{"permission":"Bookings.ReadWrite.All","application":{"id":"0c4b2d20-7919-468d-8668-c54b09d4dee8","name":"Read and write bookings information","description":"Allows an app to read and write bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user. Does not allow create, delete and publish of booking businesses.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"948eb538-f19d-4ec5-9ccc-f059e1ea4c72","name":"Read and write bookings information","description":"Allows an app to read and write bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user. Does not allow create, delete and publish of booking businesses.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/bookings-readwrite-all/"},{"permission":"BookingsAppointment.ReadWrite.All","application":{"id":"9769393e-5a9f-4302-9e3d-7e018ecb64a7","name":"Read and write all Bookings related resources.","description":"Allows an app to read and write Bookings appointments and customers, and additionally allows reading businesses, services, and staff without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"02a5a114-36a6-46ff-a102-954d89d9ab02","name":"Read and write booking appointments","description":"Allows an app to read and write bookings appointments and customers, and additionally allows read businesses information, services, and staff on behalf of the signed-in user.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/bookingsappointment-readwrite-all/"},{"permission":"Bookmark.Read.All","application":{"id":"be95e614-8ef3-49eb-8464-1c9503433b86","name":"Read all bookmarks","description":"Allows an app to read all bookmarks without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"98b17b35-f3b1-4849-a85f-9f13733002f0","name":"Read all bookmarks that the user can access","description":"Allows an app to read all bookmarks that the signed-in user can access.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/bookmark-read-all/"},{"permission":"BrowserSiteLists.Read.All","application":{"id":"c5ee1f21-fc7f-4937-9af0-c91648ff9597","name":"Read all browser site lists for your organization","description":"Allows an app to read all browser site lists configured for your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"fb9be2b7-a7fc-4182-aec1-eda4597c43d5","name":"Read browser site lists for your organization","description":"Allows an app to read the browser site lists configured for your organization, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/browsersitelists-read-all/"},{"permission":"BrowserSiteLists.ReadWrite.All","application":{"id":"8349ca94-3061-44d5-9bfb-33774ea5e4f9","name":"Read and write all browser site lists for your organization","description":"Allows an app to read and write all browser site lists configured for your organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"83b34c85-95bf-497b-a04e-b58eca9d49d0","name":"Read and write browser site lists for your organization","description":"Allows an app to read and write the browser site lists configured for your organization, on behalf of the signed-in user.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/browsersitelists-readwrite-all/"},{"permission":"BusinessScenarioConfig.Read.All","application":null,"delegated":{"id":"d16480b2-e469-4118-846b-d3d177327bee","name":"Read business scenario configurations","description":"Allows the app to read the configurations of your organization's business scenarios, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/businessscenarioconfig-read-all/"},{"permission":"BusinessScenarioConfig.Read.OwnedBy","application":{"id":"acc0fc4d-2cd6-4194-8700-1768d8423d86","name":"Read all business scenario configurations this app creates or owns","description":"Allows the app to read the configurations of business scenarios it owns, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"c47e7b6e-d6f1-4be9-9ffd-1e00f3e32892","name":"Read business scenario configurations this app creates or owns","description":"Allows the app to read the configurations of business scenarios it owns, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/businessscenarioconfig-read-ownedby/"},{"permission":"BusinessScenarioConfig.ReadWrite.All","application":null,"delegated":{"id":"755e785b-b658-446f-bb22-5a46abd029ea","name":"Read and write business scenario configurations","description":"Allows the app to read and write the configurations of your organization's business scenarios, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/businessscenarioconfig-readwrite-all/"},{"permission":"BusinessScenarioConfig.ReadWrite.OwnedBy","application":{"id":"bbea195a-4c47-4a4f-bff2-cba399e11698","name":"Read and write all business scenario configurations this app creates or owns","description":"Allows the app to create new business scenarios and fully manage the configurations of scenarios it owns, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"b3b7fcff-b4d4-4230-bf6f-90bd91285395","name":"Read and write business scenario configurations this app creates or owns","description":"Allows the app to create new business scenarios and fully manage the configurations of scenarios it owns, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/businessscenarioconfig-readwrite-ownedby/"},{"permission":"BusinessScenarioData.Read.OwnedBy","application":{"id":"6c0257fd-cffe-415b-8239-2d0d70fdaa9c","name":"Read data for all business scenarios this app creates or owns","description":"Allows the app to read the data associated with the business scenarios it owns, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"25b265c4-5d34-4e44-952d-b567f6d3b96d","name":"Read all data for business scenarios this app creates or owns","description":"Allows the app to read all data associated with the business scenarios it owns. Data access will be attributed to the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/businessscenariodata-read-ownedby/"},{"permission":"BusinessScenarioData.ReadWrite.OwnedBy","application":{"id":"f2d21f22-5d80-499e-91cc-0a8a4ce16f54","name":"Read and write data for all business scenarios this app creates or owns","description":"Allows the app to fully manage the data associated with the business scenarios it owns, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"19932d57-2952-4c60-8634-3655c79fc527","name":"Read and write all data for business scenarios this app creates or owns","description":"Allows the app to fully manage all data associated with the business scenarios it owns. Data access and changes will be attributed to the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/businessscenariodata-readwrite-ownedby/"},{"permission":"Calendars.Read","application":{"id":"798ee544-9d2d-430c-a058-570e29e34338","name":"Read calendars in all mailboxes","description":"Allows the app to read events of all calendars without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"465a38f9-76ea-45b9-9f34-9e8b0d4b0b42","name":"Read user calendars ","description":"Allows the app to read events in user calendars.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":"If you only need free/busy information, consider Calendars.ReadBasic where available.","url":"https://azureblog.co.uk/graph-permissions/calendars-read/"},{"permission":"Calendars.Read.All","application":{"id":"470229df-a15a-4b08-9d95-8c534862b362","name":"Read all users' work hours and locations","description":"Allows the app to read work hours and locations settings, recurrences, and occurrences for all users in the organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calendars-read-all/"},{"permission":"Calendars.Read.Shared","application":null,"delegated":{"id":"2b9c4092-424d-4249-948d-b43879977640","name":"Read user and shared calendars","description":"Allows the app to read events in all calendars that the user can access, including delegate and shared calendars.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calendars-read-shared/"},{"permission":"Calendars.ReadBasic","application":null,"delegated":{"id":"662d75ba-a364-42ad-adee-f5f880ea4878","name":"Read basic details of user calendars","description":"Allows the app to read events in user calendars, except for properties such as body, attachments, and extensions.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calendars-readbasic/"},{"permission":"Calendars.ReadBasic.All","application":{"id":"8ba4a692-bc31-4128-9094-475872af8a53","name":"Read basic details of calendars in all mailboxes ","description":"Allows the app to read events of all calendars, except for properties such as body, attachments, and extensions, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calendars-readbasic-all/"},{"permission":"Calendars.ReadWrite","application":{"id":"ef54d2bf-783f-4e0f-bca1-3210c0444d99","name":"Read and write calendars in all mailboxes","description":"Allows the app to create, read, update, and delete events of all calendars without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"1ec239c2-d7c9-4623-a91a-a9775856bb36","name":"Have full access to user calendars ","description":"Allows the app to create, read, update, and delete events in user calendars.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":"If the app only reads calendars, use Calendars.Read. For application permissions, limit mailboxes with Exchange Online RBAC for applications.","url":"https://azureblog.co.uk/graph-permissions/calendars-readwrite/"},{"permission":"Calendars.ReadWrite.All","application":{"id":"d91697b0-a708-4c11-a712-8fb2dc081aa2","name":"Read and write all users' work hours and locations","description":"Allows the app to read, create, update, and delete work hours and locations settings, recurrences, and occurrences for all users in the organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calendars-readwrite-all/"},{"permission":"Calendars.ReadWrite.Shared","application":null,"delegated":{"id":"12466101-c9b8-439a-8589-dd09ee67e8e9","name":"Read and write user and shared calendars","description":"Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calendars-readwrite-shared/"},{"permission":"CallAiInsights.Read.All","application":{"id":"792b782b-7822-4b92-8103-77e44f2f706c","name":"Read all AI Insights for calls.","description":"Allows the app to read all AI Insights for all calls, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"e24bdaf9-83f8-468b-a144-c681ccb6caf4","name":"Read all AI Insights for calls. ","description":"Allows the app to read all AI Insights for calls, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/callaiinsights-read-all/"},{"permission":"CallDelegation.Read","application":null,"delegated":{"id":"305b375b-00fe-48bf-81bc-e8d78954c1b6","name":"Read delegation settings","description":"Allows the app to read delegation settings of you","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calldelegation-read/"},{"permission":"CallDelegation.Read.All","application":{"id":"5aa33e77-b893-495e-bdc5-4bf6f27d42a0","name":"Read delegation settings","description":"Allows the app to read delegation settings of you","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calldelegation-read-all/"},{"permission":"CallDelegation.ReadWrite","application":null,"delegated":{"id":"599abf67-f72b-4b5f-98a3-cb38fe646118","name":"Read and write delegation settings","description":"Allows the app to read and write delegation settings of you","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calldelegation-readwrite/"},{"permission":"CallDelegation.ReadWrite.All","application":{"id":"8d06abce-e69b-4122-ba60-4f901bb1db2f","name":"Read and write delegation settings","description":"Allows the app to read and write delegation settings of you","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calldelegation-readwrite-all/"},{"permission":"CallEvents-Emergency.Read.All","application":{"id":"f0a35f91-2aa6-4a99-9d5a-5b6bcb66204e","name":"Read all emergency call events","description":"Allows the app to read emergency call event information for all users in your organization without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/callevents-emergency-read-all/"},{"permission":"CallEvents.Read","application":null,"delegated":{"id":"43431c03-960e-400f-87c6-8f910321dca3","name":"Read call event data","description":"Allows the app to read call event information for an organization for the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/callevents-read/"},{"permission":"CallEvents.Read.All","application":{"id":"1abb026f-7572-49f6-9ddd-ad61cbba181e","name":"Read all call events","description":"Allows the app to read call event information for all users in your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/callevents-read-all/"},{"permission":"CallRecord-PstnCalls.Read.All","application":{"id":"a2611786-80b3-417e-adaa-707d4261a5f0","name":"Read PSTN and direct routing call log data","description":"Allows the app to read all PSTN and direct routing call log data without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/callrecord-pstncalls-read-all/"},{"permission":"CallRecordings.Read.All","application":{"id":"ce8fb1f1-5e1f-44a0-b102-4ec28454d0dc","name":"Read all call recordings","description":"Allows the app to read call recordings for all calls without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"63d31bd6-bcf5-40ca-8283-ba4130a66405","name":"Read all recordings of calls. ","description":"Allows the app to read all recordings of calls, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/callrecordings-read-all/"},{"permission":"CallRecords.Read.All","application":{"id":"45bbb07e-7321-4fd7-a8f6-3ff27e6a81c8","name":"Read all call records","description":"Allows the app to read call records for all calls and online meetings without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/callrecords-read-all/"},{"permission":"Calls.AccessMedia.All","application":{"id":"a7a681dc-756e-4909-b988-f160edc6655f","name":"Access media streams in a call as an app","description":"Allows the app to get direct access to media streams in a call, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calls-accessmedia-all/"},{"permission":"Calls.Initiate.All","application":{"id":"284383ee-7f6e-4e40-a2a8-e85dcb029101","name":"Initiate outgoing 1 to 1 calls from the app","description":"Allows the app to place outbound calls to a single user and transfer calls to users in your organization’s directory, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calls-initiate-all/"},{"permission":"Calls.InitiateGroupCall.All","application":{"id":"4c277553-8a09-487b-8023-29ee378d8324","name":"Initiate outgoing group calls from the app","description":"Allows the app to place outbound calls to multiple users and add participants to meetings in your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calls-initiategroupcall-all/"},{"permission":"Calls.JoinGroupCall.All","application":{"id":"f6b49018-60ab-4f81-83bd-22caeabfed2d","name":"Join group calls and meetings as an app","description":"Allows the app to join group calls and scheduled meetings in your organization, without a signed-in user.  The app will be joined with the privileges of a directory user to meetings in your organization.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calls-joingroupcall-all/"},{"permission":"Calls.JoinGroupCallAsGuest.All","application":{"id":"fd7ccf6b-3d28-418b-9701-cd10f5cd2fd4","name":"Join group calls and meetings as a guest","description":"Allows the app to anonymously join group calls and scheduled meetings in your organization, without a signed-in user.  The app will be joined as a guest to meetings in your organization.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calls-joingroupcallasguest-all/"},{"permission":"Calls.ReportSyntheticMedia.All","application":{"id":"050b0d28-840a-4ff6-bdf9-cc6221acbc1f","name":"Report synthetic media detections in calls","description":"Allows the app to report synthetic media detections for participants in calls, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calls-reportsyntheticmedia-all/"},{"permission":"CallTranscripts.Read.All","application":{"id":"4cd61b6d-8692-40bf-9d90-7f38db5e5fce","name":"Read all call transcripts","description":"Allows the app to read call transcripts for all calls without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"fbace248-5d8e-441c-85ca-cc19221a69a2","name":"Read all transcripts of calls. ","description":"Allows the app to read all transcripts of calls, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/calltranscripts-read-all/"},{"permission":"CaseManagement.ConfigManage.All","application":{"id":"010650d3-1605-49e9-b242-230afecb9dc5","name":"Manage case management configuration","description":"Allows the app to create, read, update, and delete case management configuration, such as SLA policies, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"ee412db8-63b1-4e10-86fa-41c4a4b59eb5","name":"Manage case management configuration","description":"Allows the app to create, read, update, and delete case management configuration, such as SLA policies, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/casemanagement-configmanage-all/"},{"permission":"CaseManagement.Read.All","application":{"id":"b328f35f-712c-40d6-b6b4-95449d77b352","name":"Read all cases, relations, tasks, attachments and activities","description":"Allows the app to read all cases, relations, tasks, attachments and activities, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"7bdc421c-99cd-4b67-a749-aa8e92775f7e","name":"Read all cases, relations, tasks, attachments and activities","description":"Allows the app to read all cases, relations, tasks, attachments and activities, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/casemanagement-read-all/"},{"permission":"CaseManagement.ReadWrite.All","application":{"id":"57ac77a0-bb98-4ba8-bf9a-7af06dcdcc1f","name":"Read and write to all cases, relations, tasks, attachments and activities","description":"Allows the app to read and write to all cases, relations, tasks, attachments and activities, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"363a0763-d7eb-40bc-9457-6be55acd81e2","name":"Read and write to all cases, relations, tasks, attachments and activities","description":"Allows the app to read and write to all cases, relations, tasks, attachments and activities, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/casemanagement-readwrite-all/"},{"permission":"ChangeManagement.Read.All","application":{"id":"418dae40-2b65-4819-900c-519a04e4d278","name":"Read Change Management items","description":"Allows to read all Change Management items.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"4628dff5-c33e-4fde-b17a-b64e7acb1bed","name":"Read Change Management items","description":"Allows to read all Change Management items.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/changemanagement-read-all/"},{"permission":"Channel.Create","application":{"id":"f3a65bd4-b703-46df-8f7e-0174fea562aa","name":"Create channels","description":"Create channels in any team, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"101147cf-4178-4455-9d58-02b5c164e759","name":"Create channels","description":"Create channels in any team, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/channel-create/"},{"permission":"Channel.Delete.All","application":{"id":"6a118a39-1227-45d4-af0c-ea7b40d210bc","name":"Delete channels","description":"Delete channels in any team, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"cc83893a-e232-4723-b5af-bd0b01bcfe65","name":"Delete channels","description":"Delete channels in any team, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/channel-delete-all/"},{"permission":"Channel.ReadBasic.All","application":{"id":"59a6b24b-4225-4393-8165-ebaec5f55d7a","name":"Read the names and descriptions  of all channels","description":"Read all channel names and channel descriptions, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9d8982ae-4365-4f57-95e9-d6032a4c0b87","name":"Read the names and descriptions of channels","description":"Read channel names and channel descriptions, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/channel-readbasic-all/"},{"permission":"ChannelMember.Read.All","application":{"id":"3b55498e-47ec-484f-8136-9013221c06a9","name":"Read the members of all channels","description":"Read the members of all channels, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2eadaff8-0bce-4198-a6b9-2cfc35a30075","name":"Read the members of channels","description":"Read the members of channels, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/channelmember-read-all/"},{"permission":"ChannelMember.ReadWrite.All","application":{"id":"35930dcf-aceb-4bd1-b99a-8ffed403c974","name":"Add and remove members from all channels","description":"Add and remove members from all channels, without a signed-in user. Also allows changing a member's role, for example from owner to non-owner.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"0c3e411a-ce45-4cd1-8f30-f99a3efa7b11","name":"Add and remove members from channels","description":"Add and remove members from channels, on behalf of the signed-in user. Also allows changing a member's role, for example from owner to non-owner.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/channelmember-readwrite-all/"},{"permission":"ChannelMessage.Edit","application":null,"delegated":{"id":"2b61aa8a-6d36-4b2f-ac7b-f29867937c53","name":"Edit user's channel messages","description":"Allows an app to edit channel messages in Microsoft Teams, on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/channelmessage-edit/"},{"permission":"ChannelMessage.Read.All","application":{"id":"7b2449af-6ccd-4f4d-9f78-e550c193f0d1","name":"Read all channel messages","description":"Allows the app to read all channel messages in Microsoft Teams","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"767156cb-16ae-4d10-8f8b-41b657c8c8c8","name":"Read user channel messages","description":"Allows an app to read a channel's messages in Microsoft Teams, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/channelmessage-read-all/"},{"permission":"ChannelMessage.ReadWrite","application":null,"delegated":{"id":"5922d31f-46c8-4404-9eaf-2117e390a8a4","name":"Read and write user channel messages","description":"Allows the app to read and write channel messages, on behalf of the signed-in user. This doesn't allow the app to edit the policyViolation of a channel message.","adminConsent":true,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/channelmessage-readwrite/"},{"permission":"ChannelMessage.Send","application":null,"delegated":{"id":"ebf0f66e-9fb1-49e4-a278-222f76911cf4","name":"Send channel messages","description":"Allows an app to send channel messages in Microsoft Teams, on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/channelmessage-send/"},{"permission":"ChannelMessage.UpdatePolicyViolation.All","application":{"id":"4d02b0cc-d90b-441f-8d82-4fb55c34d6bb","name":"Flag channel messages for violating policy","description":"Allows the app to update Microsoft Teams channel messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/channelmessage-updatepolicyviolation-all/"},{"permission":"ChannelSettings.Read.All","application":{"id":"c97b873f-f59f-49aa-8a0e-52b32d762124","name":"Read the names, descriptions, and settings of all channels","description":"Read all channel names, channel descriptions, and channel settings, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"233e0cf1-dd62-48bc-b65b-b38fe87fcf8e","name":"Read the names, descriptions, and settings of channels","description":"Read all channel names, channel descriptions, and channel settings, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/channelsettings-read-all/"},{"permission":"ChannelSettings.ReadWrite.All","application":{"id":"243cded2-bd16-4fd6-a953-ff8177894c3d","name":"Read and write the names, descriptions, and settings of all channels","description":"Read and write the names, descriptions, and settings of all channels, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"d649fb7c-72b4-4eec-b2b4-b15acf79e378","name":"Read and write the names, descriptions, and settings of channels","description":"Read and write the names, descriptions, and settings of all channels, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/channelsettings-readwrite-all/"},{"permission":"Chat.Create","application":{"id":"d9c48af6-9ad9-47ad-82c3-63757137b9af","name":"Create chats","description":"Allows the app to create chats without a signed-in user. ","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"38826093-1258-4dea-98f0-00003be2b8d0","name":"Create chats","description":"Allows the app to create chats on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chat-create/"},{"permission":"Chat.ManageDeletion.All","application":{"id":"9c7abde0-eacd-4319-bf9e-35994b1a1717","name":"Delete and recover deleted chats","description":"Allows the app to delete and recover deleted chats, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"bb64e6fc-6b6d-4752-aea0-dd922dbba588","name":"Delete and recover deleted chats","description":"Allows the app to delete and recover deleted chats, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chat-managedeletion-all/"},{"permission":"Chat.Read","application":null,"delegated":{"id":"f501c180-9344-439a-bca0-6cbf209fd270","name":"Read user chat messages","description":"Allows an app to read 1 on 1 or group chats threads, on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chat-read/"},{"permission":"Chat.Read.All","application":{"id":"6b7d71aa-70aa-4810-a8d9-5d9fb2830017","name":"Read all chat messages","description":"Allows the app to read all 1-to-1 or group chat messages in Microsoft Teams.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chat-read-all/"},{"permission":"Chat.Read.WhereInstalled","application":{"id":"1c1b4c8e-3cc7-4c58-8470-9b92c9d5848b","name":"Read all chat messages for chats where the associated Teams application is installed.","description":"Allows the app to read all one-to-one or group chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chat-read-whereinstalled/"},{"permission":"Chat.ReadBasic","application":null,"delegated":{"id":"9547fcb5-d03f-419d-9948-5928bbf71b0f","name":"Read names and members of user chat threads","description":"Allows an app to read the members and descriptions of one-to-one and group chat threads, on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chat-readbasic/"},{"permission":"Chat.ReadBasic.All","application":{"id":"b2e060da-3baf-4687-9611-f4ebc0f0cbde","name":"Read names and members of all chat threads","description":"Read names and members of all one-to-one and group chats in Microsoft Teams, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chat-readbasic-all/"},{"permission":"Chat.ReadBasic.WhereInstalled","application":{"id":"818ba5bd-5b3e-4fe0-bbe6-aa4686669073","name":"Read names and members of all chat threads where the associated Teams application is installed.","description":"Allows the app to read names and members of all one-to-one and group chats in Microsoft Teams where the associated Teams application is installed, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chat-readbasic-whereinstalled/"},{"permission":"Chat.ReadWrite","application":null,"delegated":{"id":"9ff7295e-131b-4d94-90e1-69fde507ac11","name":"Read and write user chat messages","description":"Allows an app to read and write 1 on 1 or group chats threads, on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chat-readwrite/"},{"permission":"Chat.ReadWrite.All","application":{"id":"294ce7c9-31ba-490a-ad7d-97a7d075e4ed","name":"Read and write all chat messages","description":"Allows an app to read and write all chat messages in Microsoft Teams, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"7e9a077b-3711-42b9-b7cb-5fa5f3f7fea7","name":"Read and write all chat messages","description":"Allows an app to read and write all one-to-one and group chats in Microsoft Teams, without a signed-in user. Does not allow sending messages.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chat-readwrite-all/"},{"permission":"Chat.ReadWrite.WhereInstalled","application":{"id":"ad73ce80-f3cd-40ce-b325-df12c33df713","name":"Read and write all chat messages for chats where the associated Teams application is installed.","description":"Allows the app to read and write all chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chat-readwrite-whereinstalled/"},{"permission":"Chat.UpdatePolicyViolation.All","application":{"id":"7e847308-e030-4183-9899-5235d7270f58","name":"Flag chat messages for violating policy","description":"Allows the app to update Microsoft Teams 1-to-1 or group chat messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chat-updatepolicyviolation-all/"},{"permission":"ChatMember.Read","application":null,"delegated":{"id":"c5a9e2b1-faf6-41d4-8875-d381aa549b24","name":"Read the members of chats","description":"Read the members of chats, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chatmember-read/"},{"permission":"ChatMember.Read.All","application":{"id":"a3410be2-8e48-4f32-8454-c29a7465209d","name":"Read the members of all chats","description":"Read the members of all chats, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chatmember-read-all/"},{"permission":"ChatMember.Read.WhereInstalled","application":{"id":"93e7c9e4-54c5-4a41-b796-f2a5adaacda7","name":"Read the members of all chats where the associated Teams application is installed.","description":"Allows the app to read the members of all chats where the associated Teams application is installed, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chatmember-read-whereinstalled/"},{"permission":"ChatMember.ReadWrite","application":null,"delegated":{"id":"dea13482-7ea6-488f-8b98-eb5bbecf033d","name":"Add and remove members from chats","description":"Add and remove members from chats, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chatmember-readwrite/"},{"permission":"ChatMember.ReadWrite.All","application":{"id":"57257249-34ce-4810-a8a2-a03adf0c5693","name":"Add and remove members from all chats","description":"Add and remove members from all chats, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chatmember-readwrite-all/"},{"permission":"ChatMember.ReadWrite.WhereInstalled","application":{"id":"e32c2cd9-0124-4e44-88fc-772cd98afbdb","name":"Add and remove members from all chats where the associated Teams application is installed.","description":"Allows the app to add and remove members from all chats where the associated Teams application is installed, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chatmember-readwrite-whereinstalled/"},{"permission":"ChatMessage.Read","application":null,"delegated":{"id":"cdcdac3a-fd45-410d-83ef-554db620e5c7","name":"Read user chat messages","description":"Allows an app to read one-to-one and group chat messages, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chatmessage-read/"},{"permission":"ChatMessage.Read.All","application":{"id":"b9bb2381-47a4-46cd-aafb-00cb12f68504","name":"Read all chat messages","description":"Allows the app to read all one-to-one and group chats messages in Microsoft Teams, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chatmessage-read-all/"},{"permission":"ChatMessage.Send","application":null,"delegated":{"id":"116b7235-7cc6-461e-b163-8e55691d839e","name":"Send user chat messages","description":"Allows an app to send one-to-one and group chat messages in Microsoft Teams, on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/chatmessage-send/"},{"permission":"CloudApp-Discovery.Read.All","application":{"id":"64a59178-dad3-4673-89db-84fdcd622fec","name":"Read all discovered cloud applications data","description":"Allows the app to read all details of discovered cloud apps in the organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ad46d60e-1027-4b75-af88-7c14ccf43a19","name":"Read discovered cloud applications data","description":"Allows the app to read details of discovered cloud apps in the organization, on behalf of the signed in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/cloudapp-discovery-read-all/"},{"permission":"CloudPC.Read.All","application":{"id":"a9e09520-8ed4-4cde-838e-4fdea192c227","name":"Read Cloud PCs","description":"Allows the app to read the properties of Cloud PCs, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"5252ec4e-fd40-4d92-8c68-89dd1d3c6110","name":"Read Cloud PCs","description":"Allows the app to read the properties of Cloud PCs on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/cloudpc-read-all/"},{"permission":"CloudPC.ReadWrite.All","application":{"id":"3b4349e1-8cf5-45a3-95b7-69d1751d3e6a","name":"Read and write Cloud PCs","description":"Allows the app to read and write the properties of Cloud PCs, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"9d77138f-f0e2-47ba-ab33-cd246c8b79d1","name":"Read and write Cloud PCs","description":"Allows the app to read and write the properties of Cloud PCs on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/cloudpc-readwrite-all/"},{"permission":"Community.Read.All","application":{"id":"407f0cce-3212-441f-9f55-3bc91342cf86","name":"Read all Viva Engage communities","description":"Allows the app to list Viva Engage communities, and to read their properties without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"12ae2e92-14b5-47b2-babb-4e890bbedc0a","name":"Read all Viva Engage communities","description":"Allows the app to list Viva Engage communities, and to read their properties on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/community-read-all/"},{"permission":"Community.ReadWrite.All","application":{"id":"35d59e32-eab5-4553-9345-abb62b4c703c","name":"Read and write all Viva Engage communities","description":"Allows the app to create Viva Engage communities, read all community properties, update community properties, and delete communities without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"9e69467d-e0e2-402b-a926-3d796990197f","name":"Read and write all Viva Engage communities","description":"Allows the app to create Viva Engage communities and read all community properties on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/community-readwrite-all/"},{"permission":"ConfigurationMonitoring.Read.All","application":{"id":"aca929ec-9830-44dc-bda1-85cf938aaa95","name":"Read all Configuration Monitoring entities","description":"Allows the app to read all Configuration Monitoring entities, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"c645bb69-adc4-4242-b620-02e635f03bf6","name":"Read all Configuration Monitoring entities","description":"Allows the app to read all Configuration Monitoring entities on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/configurationmonitoring-read-all/"},{"permission":"ConfigurationMonitoring.ReadWrite.All","application":{"id":"cfa85bfb-2ee8-4e13-8e7f-489e57a015a1","name":"Read and write all Configuration Monitoring entities","description":"Allows the app to read and write all Configuration Monitoring entities, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"54505ce9-e719-41f7-a7cc-dbe114e1d811","name":"Read and write all Configuration Monitoring entities","description":"Allows the app to read and write all Configuration Monitoring entities on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/configurationmonitoring-readwrite-all/"},{"permission":"ConsentRequest.Create","application":null,"delegated":{"id":"f2143d35-9b4b-480d-951c-d083e69eeb2c","name":"Create consent requests","description":"Allows the app to read create consent requests on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/consentrequest-create/"},{"permission":"ConsentRequest.Read","application":null,"delegated":{"id":"5942b2f6-5a7b-40af-aa37-4b6ea5447506","name":"Read consent requests created by the user","description":"Allows the app to read consent requests and approvals created by the signed-in user, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/consentrequest-read/"},{"permission":"ConsentRequest.Read.All","application":{"id":"1260ad83-98fb-4785-abbb-d6cc1806fd41","name":"Read all consent requests","description":"Allows the app to read consent requests and approvals without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"f3bfad56-966e-4590-a536-82ecf548ac1e","name":"Read consent requests","description":"Allows the app to read consent requests and approvals on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/consentrequest-read-all/"},{"permission":"ConsentRequest.ReadApprove.All","application":null,"delegated":{"id":"e694a3a1-7878-46d8-8c29-3d195f6589f4","name":"Read and approve consent requests","description":"Allows the app to read and approve consent requests on behalf of the signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/consentrequest-readapprove-all/"},{"permission":"ConsentRequest.ReadWrite.All","application":{"id":"9f1b81a7-0223-4428-bfa4-0bcb5535f27d","name":"Read and write all consent requests","description":"Allows the app to read app consent requests and approvals, and deny or approve those requests without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"497d9dfa-3bd1-481a-baab-90895e54568c","name":"Read and write consent requests","description":"Allows the app to read app consent requests and approvals, and deny or approve those requests on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/consentrequest-readwrite-all/"},{"permission":"Contacts-OnPremisesSyncBehavior.ReadWrite.All","application":{"id":"c8948c23-e66b-42db-83fd-770b71ab78d2","name":"Read and update the on-premises sync behavior of contacts","description":"Allows the app to update the on-premises sync behavior of all contacts in all mailboxes without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"1e4c6c41-0803-4f52-85ef-0a5d63ad8670","name":"Read and update the on-premises sync behavior of contacts","description":"Allows the app to read and update the on-premises sync behavior of contacts a user has permissions to, including their own and shared contacts.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/contacts-onpremisessyncbehavior-readwrite-all/"},{"permission":"Contacts.Read","application":{"id":"089fe4d0-434a-44c5-8827-41ba8a0b17f5","name":"Read contacts in all mailboxes","description":"Allows the app to read all contacts in all mailboxes without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"ff74d97f-43af-4b68-9f2a-b77ee6968c5d","name":"Read user contacts ","description":"Allows the app to read user contacts.  ","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/contacts-read/"},{"permission":"Contacts.Read.Shared","application":null,"delegated":{"id":"242b9d9e-ed24-4d09-9a52-f43769beb9d4","name":"Read user and shared contacts","description":"Allows the app to read contacts a user has permissions to access, including their own and shared contacts.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/contacts-read-shared/"},{"permission":"Contacts.ReadWrite","application":{"id":"6918b873-d17a-4dc1-b314-35f528134491","name":"Read and write contacts in all mailboxes","description":"Allows the app to create, read, update, and delete all contacts in all mailboxes without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"d56682ec-c09e-4743-aaf4-1a3aac4caa21","name":"Have full access to user contacts ","description":"Allows the app to create, read, update, and delete user contacts.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/contacts-readwrite/"},{"permission":"Contacts.ReadWrite.Shared","application":null,"delegated":{"id":"afb6c84b-06be-49af-80bb-8f3f77004eab","name":"Read and write user and shared contacts","description":"Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/contacts-readwrite-shared/"},{"permission":"Content.Process.All","application":{"id":"5ad511bf-571c-4ef6-8c3c-85b94b85df98","name":"Process content for data security, governance and compliance","description":"Allows the app to process and evaluate content for data security, governance and compliance outcomes at tenant scope.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"7e2467d1-f874-46bb-828e-24cb06b29d3f","name":"Process content for data security, governance and compliance","description":"Allows the app to process and evaluate content for data security, governance and compliance outcomes at tenant scope.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/content-process-all/"},{"permission":"Content.Process.User","application":{"id":"24ceb246-ad29-4680-90b4-3e91ffad15eb","name":"Process content for data security, governance and compliance","description":"Allows the app to process and evaluate content for data security, governance and compliance outcomes for a user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"1d787a13-f750-4ad6-875a-fcbd2725596b","name":"Process content for data security, governance and compliance","description":"Allows the app to process and evaluate content for data security, governance and compliance outcomes for a user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/content-process-user/"},{"permission":"ContentActivity.Read","application":{"id":"368425e7-6954-4f5a-9d92-90b75bd580c9","name":"Read contents activity audit log from the audit store.","description":"Read contents activity audit log from the audit store.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"62c55b2f-a2b1-4312-8385-be57afd901b4","name":"Read contents activity audit log from the audit store.","description":"Read contents activity audit log from the audit store.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/contentactivity-read/"},{"permission":"ContentActivity.Write","application":{"id":"2932e07a-3c29-44e4-bb36-6d0fc176387f","name":"Upload content activity audit logs to the audit store.","description":"Allows the application to upload bulk contents activity audit logs to the audit store.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"948caae6-152a-48cd-a746-4844af30e8e9","name":"Upload contents activity audit logs to the audit store.","description":"Allows the application to upload bulk contents activity audit logs to the audit store.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/contentactivity-write/"},{"permission":"ContentHub-Catalog.Read.All","application":{"id":"73fac914-e726-4af5-9a46-62f65f7b0a8b","name":"Read the Content Hub catalog","description":"Allows the app to read the Content Hub catalog of published security content packages and the content items they ship, without a signed-in user. Does not grant access to what the organization has installed.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"31da6e02-bb98-49de-b898-6c4017bf4d80","name":"Read the Content Hub catalog","description":"Allows the app to read the Content Hub catalog of published security content packages and the content items they ship, on behalf of the signed-in user. Does not grant access to what your organization has installed.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/contenthub-catalog-read-all/"},{"permission":"ContentHub-Installed.Read.All","application":{"id":"cc44d51e-040e-4631-a93a-1982ea54b428","name":"Read Content Hub installed packages","description":"Allows the app to read which Content Hub security content packages and package-scoped content items the organization has installed and at what versions, without a signed-in user. Does not grant access to the published catalog or the ability to install, update, or remove installed content.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"324ffa40-1e6c-4101-8757-802306798c4d","name":"Read Content Hub installed packages","description":"Allows the app to read which Content Hub security content packages and package-scoped content items your organization has installed and at what versions, on behalf of the signed-in user. Does not grant access to the published catalog or the ability to install, update, or remove installed content.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/contenthub-installed-read-all/"},{"permission":"ContentHub-Installed.ReadWrite.All","application":{"id":"0c6404f6-8e7a-413b-adc0-e9b750d959c8","name":"Read and write Content Hub installed packages","description":"Allows the app to read which Content Hub security content packages and content items the organization has installed, and to create, update, and delete installed packages and package-scoped content items in the organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"6e84bce8-6b4b-4249-80b9-04fe0dc4ca08","name":"Read and write Content Hub installed packages","description":"Allows the app to read which Content Hub security content packages and content items your organization has installed, and to create, update, and delete installed packages and package-scoped content items in your organization, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/contenthub-installed-readwrite-all/"},{"permission":"Contracts.Read.All","application":{"id":"f9af4646-98b0-4e9d-a53e-40d4f6452fc4","name":"Read contracts","description":"Allows the app to read available properties on contracts, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9df4d5b0-7921-4437-9ea8-adf0c9e276dc","name":"Read contracts","description":"Allows the app to read available properties of contracts, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/contracts-read-all/"},{"permission":"CopilotConversation.Delete","application":null,"delegated":{"id":"ed510a02-ac32-45f9-93e6-04864f7f7e47","name":"Delete Microsoft 365 Copilot conversations","description":"Allows the app to delete Microsoft 365 Copilot conversations on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/copilotconversation-delete/"},{"permission":"CopilotPackages.Read.All","application":{"id":"72f0655d-6228-4ddc-8e1b-164973b9213b","name":"Read all packages information","description":"Allows the app to read packages information without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"a2dcfcb9-cbe8-4d42-812d-952e55cf7f3f","name":"Read all packages information","description":"Allows the user to read the packages information","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/copilotpackages-read-all/"},{"permission":"CopilotPackages.ReadWrite.All","application":{"id":"ed31732f-9495-47ed-ba3b-4ed0948c1c64","name":"Read and update all packages information","description":"Allows the app to read and update packages information without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"e9c5fd18-ac15-43dd-9f5c-6f9611dd5604","name":"Read and update all packages information","description":"Allows the user to read and update the packages information","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/copilotpackages-readwrite-all/"},{"permission":"CopilotPolicySettings.Read","application":{"id":"556d5e2e-1081-4452-8147-26c3a1b06f58","name":"Read Copilot policy settings","description":"Allows the app to read Copilot policy settings for the organization, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"b7281c63-cd4d-40c3-b721-73aa8ee7c3a8","name":"Read Copilot policy settings","description":"Allows the app to read Copilot policy settings for the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/copilotpolicysettings-read/"},{"permission":"CopilotPolicySettings.ReadWrite","application":{"id":"cc147c17-b8e8-4d3f-9f94-aa9e279a079a","name":"Read and write Copilot policy settings","description":"Allows the app to read and write Copilot policy settings for the organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"e2edbde8-4448-4e49-8ebb-d53ba72df0f3","name":"Read and write Copilot policy settings","description":"Allows the app to read and write Copilot policy settings for the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/copilotpolicysettings-readwrite/"},{"permission":"CopilotSettings-LimitedMode.Read","application":null,"delegated":{"id":"aeb2982d-632d-4155-b533-18756ab6fdd8","name":"Read organization-wide copilot limited mode setting","description":"Allows the app to read organization-wide copilot limited mode setting on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/copilotsettings-limitedmode-read/"},{"permission":"CopilotSettings-LimitedMode.ReadWrite","application":null,"delegated":{"id":"4704e5b2-0ada-4aa0-b18c-00ad7525bc06","name":"Read and write organization-wide copilot limited mode setting","description":"Allows the app to read and write organization-wide copilot limited mode setting on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/copilotsettings-limitedmode-readwrite/"},{"permission":"CrossTenantContentMigration.Read.All","application":{"id":"0ef71a66-690d-439b-96ef-41705a240606","name":"Read all cross tenant content migration job details","description":"Allows the app to read your tenant's all cross tenant content migration job details without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/crosstenantcontentmigration-read-all/"},{"permission":"CrossTenantContentMigration.ReadWrite.All","application":{"id":"c5a29fd1-4629-4f52-8316-4d639ffa95d0","name":"Read and write all cross tenant content migration job details","description":"Allows the app to read and write your tenant's all cross tenant content migration job details without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/crosstenantcontentmigration-readwrite-all/"},{"permission":"CrossTenantInformation.ReadBasic.All","application":{"id":"cac88765-0581-4025-9725-5ebc13f729ee","name":"Read cross-tenant basic information","description":"Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"81594d25-e88e-49cf-ac8c-fecbff49f994","name":"Read cross-tenant basic information","description":"Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/crosstenantinformation-readbasic-all/"},{"permission":"CrossTenantUserProfileSharing.Read","application":null,"delegated":{"id":"cb1ba48f-d22b-4325-a07f-74135a62ee41","name":"Read shared cross-tenant user profile and export data","description":"Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/crosstenantuserprofilesharing-read/"},{"permission":"CrossTenantUserProfileSharing.Read.All","application":{"id":"8b919d44-6192-4f3d-8a3b-f86f8069ae3c","name":"Read all shared cross-tenant user profiles and export their data","description":"Allows the application to list and query any shared user profile information associated with the current tenant without a signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"759dcd16-3c90-463c-937e-abf89f991c18","name":"Read all shared cross-tenant user profiles and export their data","description":"Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/crosstenantuserprofilesharing-read-all/"},{"permission":"CrossTenantUserProfileSharing.ReadWrite","application":null,"delegated":{"id":"eed0129d-dc60-4f30-8641-daf337a39ffd","name":"Read shared cross-tenant user profile and export or delete data","description":"Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/crosstenantuserprofilesharing-readwrite/"},{"permission":"CrossTenantUserProfileSharing.ReadWrite.All","application":{"id":"306785c5-c09b-4ba0-a4ee-023f3da165cb","name":"Read all shared cross-tenant user profiles and export or delete their data","description":"Allows the application to list and query any shared user profile information associated with the current tenant without a signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"64dfa325-cbf8-48e3-938d-51224a0cac01","name":"Read all shared cross-tenant user profiles and export or delete their data","description":"Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/crosstenantuserprofilesharing-readwrite-all/"},{"permission":"CustomAuthenticationExtension.Read.All","application":{"id":"88bb2658-5d9e-454f-aacd-a3933e079526","name":"Read all custom authentication extensions","description":"Allows the app to read your organization's custom authentication extensions without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"b2052569-c98c-4f36-a5fb-43e5c111e6d0","name":"Read your organization's custom authentication extensions","description":"Allows the app to read your organization's custom authentication extensions on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customauthenticationextension-read-all/"},{"permission":"CustomAuthenticationExtension.ReadWrite.All","application":{"id":"c2667967-7050-4e7e-b059-4cbbb3811d03","name":"Read and write all custom authentication extensions","description":"Allows the app to read or write your organization's custom authentication extensions without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"8dfcf82f-15d0-43b3-bc78-a958a13a5792","name":"Read and write your organization's custom authentication extensions","description":"Allows the app to read or write your organization's custom authentication extensions on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customauthenticationextension-readwrite-all/"},{"permission":"CustomAuthenticationExtension.Receive.Payload","application":{"id":"214e810f-fda8-4fd7-a475-29461495eb00","name":"Receive custom authentication extension HTTP requests","description":"Allows custom authentication extensions associated with the app to receive HTTP requests triggered by an authentication event. The request can include information about a user, client and resource service principals, and other information about the authentication.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customauthenticationextension-receive-payload/"},{"permission":"CustomDetection.Read.All","application":{"id":"673a007a-9e0f-4c97-b066-3c0164486909","name":"Read all custom detection rules","description":"Allows the app to read custom detection rules without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"b13ff42e-f321-4d7d-a462-141c46a1b832","name":"Read custom detection rules","description":"Allows the app to read custom detection rules on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customdetection-read-all/"},{"permission":"CustomDetection.ReadWrite.All","application":{"id":"e0fd9c8d-a12e-4cc9-9827-20c8c3cd6fb8","name":"Read and write all custom detection rules","description":"Allows the app to read and write custom detection rules without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"c34088fb-0649-4714-af0b-bcbfec155897","name":"Read and write custom detection rules","description":"Allows the app to read and write custom detection rules on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customdetection-readwrite-all/"},{"permission":"CustomObject.Read.All","application":{"id":"7eb97e53-a7bc-4492-9113-1cd84a1ef8d8","name":"Read all custom objects","description":"Allows the app to read tenant-defined custom object instances without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"c4d45078-098e-45c7-966b-855ce89b157f","name":"Read all custom objects","description":"Allows the app to read tenant-defined custom object instances on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customobject-read-all/"},{"permission":"CustomObject.ReadWrite.All","application":{"id":"2ebdaf81-319a-4058-9cb1-7c2c20cda877","name":"Read and write all custom objects","description":"Allows the app to create, read, update, and retire tenant-defined custom objects without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"e5285887-5e95-4670-87a3-cb02d141e70c","name":"Read and write all custom objects","description":"Allows the app to create, read, update, and retire tenant-defined custom objects on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customobject-readwrite-all/"},{"permission":"CustomObjectDefinition.Read.All","application":{"id":"3bb529ad-d59a-499c-abe2-736f636068a5","name":"Read all custom object definitions","description":"Allows the app to read tenant-defined custom object definitions without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"28621fe2-a83d-4769-89f4-05130f0fe072","name":"Read all custom object definitions","description":"Allows the app to read tenant-defined custom object definitions on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customobjectdefinition-read-all/"},{"permission":"CustomObjectDefinition.ReadBasic.All","application":{"id":"4d482dd7-21ae-4e2d-97f9-58cd926f5c5e","name":"Read basic information about custom object definitions","description":"Allows the app to read the ID and display name of tenant-defined custom object definitions without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"90177fb8-02b9-48d8-b91a-bc8061f335b8","name":"Read basic information about custom object definitions","description":"Allows the app to read the ID and display name of tenant-defined custom object definitions on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customobjectdefinition-readbasic-all/"},{"permission":"CustomObjectDefinition.ReadWrite.All","application":{"id":"19f10513-d519-42cf-b01a-b3b662f46b8f","name":"Manage all custom object definitions","description":"Allows the app to read, create, update, and retire tenant-defined custom object definitions without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"469b592c-2844-41f0-b800-61afd6b449c1","name":"Manage all custom object definitions","description":"Allows the app to read, create, update, and retire tenant-defined custom object definitions on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customobjectdefinition-readwrite-all/"},{"permission":"CustomSecAttributeAssignment.Read.All","application":{"id":"3b37c5a4-1226-493d-bec3-5d6c6b866f3f","name":"Read custom security attribute assignments","description":"Allows the app to read custom security attribute assignments for all principals in the tenant without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"b46ffa80-fe3d-4822-9a1a-c200932d54d0","name":"Read custom security attribute assignments","description":"Allows the app to read custom security attribute assignments for all principals in the tenant on behalf of a signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customsecattributeassignment-read-all/"},{"permission":"CustomSecAttributeAssignment.ReadWrite.All","application":{"id":"de89b5e4-5b8f-48eb-8925-29c2b33bd8bd","name":"Read and write custom security attribute assignments","description":"Allows the app to read and write custom security attribute assignments for all principals in the tenant without a signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"ca46335e-8453-47cd-a001-8459884efeae","name":"Read and write custom security attribute assignments","description":"Allows the app to read and write custom security attribute assignments for all principals in the tenant on behalf of a signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customsecattributeassignment-readwrite-all/"},{"permission":"CustomSecAttributeAuditLogs.Read.All","application":{"id":"2a4f026d-e829-4e84-bdbf-d981a2703059","name":"Read all custom security attribute audit logs","description":"Allows the app to read all audit logs for events that contain information about custom security attributes, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"1fcdeaab-b519-44dd-bffc-ed1fd15a24e0","name":"Read custom security attribute audit logs","description":"Allows the app to read audit logs for events that contain information about custom security attributes, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customsecattributeauditlogs-read-all/"},{"permission":"CustomSecAttributeDefinition.Read.All","application":{"id":"b185aa14-d8d2-42c1-a685-0f5596613624","name":"Read custom security attribute definitions","description":"Allows the app to read custom security attribute definitions for the tenant without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ce026878-a0ff-4745-a728-d4fedd086c07","name":"Read custom security attribute definitions","description":"Allows the app to read custom security attribute definitions for the tenant on behalf of a signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customsecattributedefinition-read-all/"},{"permission":"CustomSecAttributeDefinition.ReadWrite.All","application":{"id":"12338004-21f4-4896-bf5e-b75dfaf1016d","name":"Read and write custom security attribute definitions","description":"Allows the app to read and write custom security attribute definitions for the tenant without a signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"8b0160d4-5743-482b-bb27-efc0a485ca4a","name":"Read and write custom security attribute definitions","description":"Allows the app to read and write custom security attribute definitions for the tenant on behalf of a signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customsecattributedefinition-readwrite-all/"},{"permission":"CustomSecAttributeProvisioning.Read.All","application":{"id":"9fd1f8bf-a443-4df6-bc2a-5d00c5ec7828","name":"Read the provisioning configuration of all active custom security attributes","description":"Allows the app to read the provisioning configuration of all active custom security attributes without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9ddd870d-077c-49e7-b3e3-6b3012a8a880","name":"Read the provisioning configuration of all active custom security attributes","description":"Allows the app to read the provisioning configuration of all active custom security attributes on behalf of a signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customsecattributeprovisioning-read-all/"},{"permission":"CustomSecAttributeProvisioning.ReadWrite.All","application":{"id":"1db69e9c-8d0a-498d-a5df-11fd0b68ceab","name":"Read and edit the provisioning configuration of all active custom security attributes","description":"Allows the app to read and edit the provisioning configuration of all active custom security attributes without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"1140d9e4-6776-433e-a9e4-b9831adbb2e0","name":"Read and edit the provisioning configuration of all active custom security attributes","description":"Allows the app to read and edit the provisioning configuration of all active custom security attributes on behalf of a signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customsecattributeprovisioning-readwrite-all/"},{"permission":"CustomTags.Read.All","application":{"id":"ab8a5872-7c88-47a6-8141-7becce939190","name":"Read all custom tags data","description":"Read custom tags data, without a signed-in user","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"de6ea87d-10bd-467c-8682-d525a0c61b89","name":"Read all custom tags data","description":"Read custom tags data on behalf of the signed-in user","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customtags-read-all/"},{"permission":"CustomTags.ReadWrite.All","application":{"id":"2f503208-e509-4e39-974c-8cc16e5785c9","name":"Read and write custom tags data","description":"Read and write custom tags data, without a signed-in user","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"2f1bbe0a-f34b-4efb-9edb-8db8dcb50eca","name":"Read and write custom tags data","description":"Read and write custom tags data on behalf of the signed-in user","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/customtags-readwrite-all/"},{"permission":"DelegatedAdminRelationship.Read.All","application":{"id":"f6e9e124-4586-492f-adc0-c6f96e4823fd","name":"Read Delegated Admin relationships with customers","description":"Allows the app to read details of delegated admin relationships with customers like access details (that includes roles) and the duration as well as specific role assignments to security groups without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"0c0064ea-477b-4130-82a5-4c2cc4ff68aa","name":"Read Delegated Admin relationships with customers","description":"Allows the app to read details of delegated admin relationships with customers like access details (that includes roles) and the duration as well as specific role assignments to security groups on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/delegatedadminrelationship-read-all/"},{"permission":"DelegatedAdminRelationship.ReadWrite.All","application":{"id":"cc13eba4-8cd8-44c6-b4d4-f93237adce58","name":"Manage Delegated Admin relationships with customers","description":"Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers and role assignments to security groups for active Delegated Admin relationships without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"885f682f-a990-4bad-a642-36736a74b0c7","name":"Manage Delegated Admin relationships with customers","description":"Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers as well as role assignments to security groups for active Delegated Admin relationships on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/delegatedadminrelationship-readwrite-all/"},{"permission":"DelegatedPermissionGrant.Read.All","application":{"id":"81b4724a-58aa-41c1-8a55-84ef97466587","name":"Read all delegated permission grants","description":"Allows the app to read all delegated permission grants, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"a197cdc4-a8e8-4d49-9d35-4ca7c83887b4","name":"Read delegated permission grants","description":"Allows the app to read delegated permission grants, on behalf of the signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/delegatedpermissiongrant-read-all/"},{"permission":"DelegatedPermissionGrant.ReadWrite.All","application":{"id":"8e8e4742-1d95-4f68-9d56-6ee75648c72a","name":"Manage all delegated permission grants","description":"Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), without a signed-in user.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"delegated":{"id":"41ce6ca6-6826-4807-84f1-1c82854f7ee5","name":"Manage all delegated permission grants","description":"Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), on behalf of the signed in user.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/delegatedpermissiongrant-readwrite-all/"},{"permission":"Device.Command","application":null,"delegated":{"id":"bac3b9c2-b516-4ef4-bd3b-c2ef73d8d804","name":"Communicate with user devices","description":"Allows the app to launch another app or communicate with another app on a user's device on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/device-command/"},{"permission":"Device.CreateFromOwnedTemplate","application":null,"delegated":{"id":"edc92e89-a987-48a9-911a-a7b1967dd7b1","name":"Create devices based on owned device templates","description":"Allows the app to create device objects based on device templates owned by the signed-in user, on behalf of the signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/device-createfromownedtemplate/"},{"permission":"Device.Read","application":null,"delegated":{"id":"11d4cd79-5ba5-460f-803f-e22c8ab85ccd","name":"Read user devices","description":"Allows the app to read a user's list of devices on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/device-read/"},{"permission":"Device.Read.All","application":{"id":"7438b122-aefc-4978-80ed-43db9fcc7715","name":"Read all devices","description":"Allows the app to read your organization's devices' configuration information without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"951183d1-1a61-466f-a6d1-1fde911bfd95","name":"Read all devices","description":"Allows the app to read your organization's devices' configuration information on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/device-read-all/"},{"permission":"Device.ReadWrite.All","application":{"id":"1138cb37-bd11-4084-a2b7-9f71582aeddb","name":"Read and write devices","description":"Allows the app to read and write all device properties without a signed in user.  Does not allow device creation, device deletion or update of device alternative security identifiers.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/device-readwrite-all/"},{"permission":"DeviceLocalCredential.Read.All","application":{"id":"884b599e-4d48-43a5-ba94-15c414d00588","name":"Read device local credential passwords","description":"Allows the app to read device local credential properties including passwords, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"280b3b69-0437-44b1-bc20-3b2fca1ee3e9","name":"Read device local credential passwords","description":"Allows the app to read device local credential properties including passwords, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicelocalcredential-read-all/"},{"permission":"DeviceLocalCredential.ReadBasic.All","application":{"id":"db51be59-e728-414b-b800-e0f010df1a79","name":"Read device local credential properties","description":"Allows the app to read device local credential properties excluding passwords, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9917900e-410b-4d15-846e-42a357488545","name":"Read device local credential properties","description":"Allows the app to read device local credential properties excluding passwords, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicelocalcredential-readbasic-all/"},{"permission":"DeviceManagementApps.Read.All","application":{"id":"7a6ee1e7-141e-4cec-ae74-d9db155731ff","name":"Read Microsoft Intune apps","description":"Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"4edf5f54-4666-44af-9de9-0144fb4b6e8c","name":"Read Microsoft Intune apps","description":"Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementapps-read-all/"},{"permission":"DeviceManagementApps.ReadWrite.All","application":{"id":"78145de6-330d-4800-a6ce-494ff2d33d07","name":"Read and write Microsoft Intune apps","description":"Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"7b3f05d5-f68c-4b8d-8c59-a2ecd12f24af","name":"Read and write Microsoft Intune apps","description":"Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementapps-readwrite-all/"},{"permission":"DeviceManagementCloudCA.Read.All","application":{"id":"315b6e8c-d92a-4691-919d-00ce76d1344a","name":"Read Microsoft Cloud PKI objects","description":"Allows the app to read certification authority information without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"ac5c8443-d999-471f-9247-ce92cf5c5560","name":"Read Microsoft Cloud PKI objects","description":"Allows the app to read certification authority information on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementcloudca-read-all/"},{"permission":"DeviceManagementCloudCA.ReadWrite.All","application":{"id":"f15eb2ba-ef8a-4f70-991d-da5d045154e2","name":"Read and write Microsoft Cloud PKI objects","description":"Allows the app to read and write certification authority information without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"93028c58-65aa-48db-a706-1fe4ada325ec","name":"Read and write Microsoft Cloud PKI objects","description":"Allows the app to read and write certification authority information on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementcloudca-readwrite-all/"},{"permission":"DeviceManagementConfiguration.Read.All","application":{"id":"dc377aa6-52d8-4e23-b271-2a7ae04cedf3","name":"Read Microsoft Intune device configuration and policies","description":"Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"f1493658-876a-4c87-8fa7-edb559b3476a","name":"Read Microsoft Intune Device Configuration and Policies","description":"Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementconfiguration-read-all/"},{"permission":"DeviceManagementConfiguration.ReadWrite.All","application":{"id":"9241abd9-d0e6-425a-bd4f-47ba86e767a4","name":"Read and write Microsoft Intune device configuration and policies","description":"Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"0883f392-0a7a-443d-8c76-16a6d39c7b63","name":"Read and write Microsoft Intune Device Configuration and Policies","description":"Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":"If the app only reads configuration, use DeviceManagementConfiguration.Read.All.","url":"https://azureblog.co.uk/graph-permissions/devicemanagementconfiguration-readwrite-all/"},{"permission":"DeviceManagementDeploymentPlans.Read.All","application":{"id":"c5825671-0390-4bf2-b99b-80496fd4b673","name":"Read Microsoft Intune Deployment Plans","description":"Allows the app to read properties of Microsoft Intune-managed deployment plans and their ring configurations, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"700bfe0b-b3bd-4fa4-bec2-6849edd7fb7b","name":"Read Microsoft Intune Deployment Plans","description":"Allows the app to read properties of Microsoft Intune-managed deployment plans and their ring configurations.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementdeploymentplans-read-all/"},{"permission":"DeviceManagementDeploymentPlans.ReadWrite.All","application":{"id":"68356fd1-028d-4ce3-b724-241dec11127a","name":"Read and write Microsoft Intune Deployment Plans","description":"Allows the app to read and write properties of Microsoft Intune-managed deployment plans and their ring configurations, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"9d95843d-67b9-48b2-8e20-e42372db8549","name":"Read and write Microsoft Intune Deployment Plans","description":"Allows the app to read and write properties of Microsoft Intune-managed deployment plans and their ring configurations.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementdeploymentplans-readwrite-all/"},{"permission":"DeviceManagementManagedDevices.PrivilegedOperations.All","application":{"id":"5b07b0dd-2377-4e44-a38d-703f09a0dc3c","name":"Perform user-impacting remote actions on Microsoft Intune devices","description":"Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"3404d2bf-2b13-457e-a330-c24615765193","name":"Perform user-impacting remote actions on Microsoft Intune devices","description":"Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementmanageddevices-privilegedoperations-all/"},{"permission":"DeviceManagementManagedDevices.Read.All","application":{"id":"2f51be20-0bb4-4fed-bf7b-db946066c75e","name":"Read Microsoft Intune devices","description":"Allows the app to read the properties of devices managed by Microsoft Intune, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"314874da-47d6-4978-88dc-cf0d37f0bb82","name":"Read Microsoft Intune devices","description":"Allows the app to read the properties of devices managed by Microsoft Intune.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementmanageddevices-read-all/"},{"permission":"DeviceManagementManagedDevices.ReadWrite.All","application":{"id":"243333ab-4d21-40cb-a475-36241daa0842","name":"Read and write Microsoft Intune devices","description":"Allows the app to read and write the properties of devices managed by Microsoft Intune, without a signed-in user. Does not allow high impact operations such as remote wipe and password reset on the device’s owner","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"44642bfe-8385-4adc-8fc6-fe3cb2c375c3","name":"Read and write Microsoft Intune devices","description":"Allows the app to read and write the properties of devices managed by Microsoft Intune. Does not allow high impact operations such as remote wipe and password reset on the device’s owner.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":"If the app only reads devices, use DeviceManagementManagedDevices.Read.All.","url":"https://azureblog.co.uk/graph-permissions/devicemanagementmanageddevices-readwrite-all/"},{"permission":"DeviceManagementRBAC.Read.All","application":{"id":"58ca0d9a-1575-47e1-a3cb-007ef2e4583b","name":"Read Microsoft Intune RBAC settings","description":"Allows the app to read the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"49f0cc30-024c-4dfd-ab3e-82e137ee5431","name":"Read Microsoft Intune RBAC settings","description":"Allows the app to read the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementrbac-read-all/"},{"permission":"DeviceManagementRBAC.ReadWrite.All","application":{"id":"e330c4f0-4170-414e-a55a-2f022ec2b57b","name":"Read and write Microsoft Intune RBAC settings","description":"Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"0c5e8a55-87a6-4556-93ab-adc52c4d862d","name":"Read and write Microsoft Intune RBAC settings","description":"Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementrbac-readwrite-all/"},{"permission":"DeviceManagementScripts.Read.All","application":{"id":"c7a5be92-2b3d-4540-8a67-c96dcaae8b43","name":"Read Microsoft Intune Scripts","description":"Allows the app to read Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"d32381d8-ee89-4220-9c83-b672aa68d404","name":"Read Microsoft Intune Scripts","description":"Allows the app to read Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementscripts-read-all/"},{"permission":"DeviceManagementScripts.ReadWrite.All","application":{"id":"9255e99d-faf5-445e-bbf7-cb71482737c4","name":"Read and write Microsoft Intune Scripts","description":"Allows the app to read and write Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"8b9d79d0-ad75-4566-8619-f7500ecfcebe","name":"Read and write Microsoft Intune Scripts","description":"Allows the app to read and write Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementscripts-readwrite-all/"},{"permission":"DeviceManagementServiceConfig.Read.All","application":{"id":"06a5fe6d-c49d-46a7-b082-56b1b14103c7","name":"Read Microsoft Intune configuration","description":"Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"8696daa5-bce5-4b2e-83f9-51b6defc4e1e","name":"Read Microsoft Intune configuration","description":"Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementserviceconfig-read-all/"},{"permission":"DeviceManagementServiceConfig.ReadWrite.All","application":{"id":"5ac13192-7ace-4fcf-b828-1a26f28068ee","name":"Read and write Microsoft Intune configuration","description":"Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"662ed50a-ac44-4eef-ad86-62eed9be2a29","name":"Read and write Microsoft Intune configuration","description":"Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicemanagementserviceconfig-readwrite-all/"},{"permission":"DeviceTemplate.Create","application":{"id":"abf6441f-0772-4932-96e7-0191478dd73a","name":"Create device template","description":"Allows the app to create device templates. The app is marked as owner of the created device template. As a member of owners, the app will be allowed to manage devices created from the template.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"0b1717ff-3e42-4a73-8c29-e6b2e1093960","name":"Create device templates","description":"Allows the app to create device templates on behalf of the signed in user. The user is marked as owners of the created device template. As a member of owners, the user will be allowed to manage devices created from the template.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicetemplate-create/"},{"permission":"DeviceTemplate.Read.All","application":{"id":"dd9febb5-0c6d-419f-b256-3afe12c6adeb","name":"Read all device templates","description":"Allows the app to read all device templates, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2bcae0b0-aa93-48e4-a9e4-855482dffdcd","name":"Read all device templates","description":"Allows the app to read all device templates, on behalf of the signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicetemplate-read-all/"},{"permission":"DeviceTemplate.ReadWrite.All","application":{"id":"9fadb66e-6421-4744-aede-4ab6fb98a884","name":"Read and write all device templates","description":"Allows the app to create, read, update and delete any device template, without a signed-in user. It also allows the app to add or remove owners on any device template.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"2d372e98-f1ae-406c-a157-2ea83f6f5e4a","name":"Read and write all device templates","description":"Allows the app to create, read, update and delete the device template, on behalf of the signed in user. It also allows the app to add or remove owners on any device template.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/devicetemplate-readwrite-all/"},{"permission":"Directory.AccessAsUser.All","application":null,"delegated":{"id":"0e263e50-5827-48a4-b97c-d940288653c7","name":"Access directory as the signed in user","description":"Allows the app to have the same access to information in the directory as the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/directory-accessasuser-all/"},{"permission":"Directory.Read.All","application":{"id":"7ab1d382-f21e-4acd-a863-ba3e13f7da61","name":"Read directory data","description":"Allows the app to read data in your organization's directory, such as users, groups and apps, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"06da0dbc-49e2-44d2-8312-53f166ab848a","name":"Read directory data","description":"Allows the app to read data in your organization's directory, such as users, groups and apps.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":"Use the specific permission for what you read, such as User.Read.All, Group.Read.All or Device.Read.All.","url":"https://azureblog.co.uk/graph-permissions/directory-read-all/"},{"permission":"Directory.ReadWrite.All","application":{"id":"19dbc75e-c2e2-444c-a770-ec69d8559fc7","name":"Read and write directory data","description":"Allows the app to read and write data in your organization's directory, such as users, and groups, without a signed-in user.  Does not allow user or group deletion.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"delegated":{"id":"c5366453-9fb0-48a5-a156-24f0c49a4b84","name":"Read and write directory data","description":"Allows the app to read and write data in your organization's directory, such as users, and groups.  It does not allow the app to delete users or groups, or reset user passwords.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"leastPrivilege":"Use specific write permissions such as User.ReadWrite.All or GroupMember.ReadWrite.All, scoped to what the app changes.","url":"https://azureblog.co.uk/graph-permissions/directory-readwrite-all/"},{"permission":"DirectoryRecommendations.Read.All","application":{"id":"ae73097b-cb2a-4447-b064-5d80f6093921","name":"Read all Azure AD recommendations","description":"Allows the app to read all Azure AD recommendations, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"34d3bd24-f6a6-468c-b67c-0c365c1d6410","name":"Read Azure AD recommendations","description":"Allows the app to read Azure AD recommendations, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/directoryrecommendations-read-all/"},{"permission":"DirectoryRecommendations.ReadWrite.All","application":{"id":"0e9eea12-4f01-45f6-9b8d-3ea4c8144158","name":"Read and update all Azure AD recommendations","description":"Allows the app to read and update all Azure AD recommendations, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"f37235e8-90a0-4189-93e2-e55b53867ccd","name":"Read and update Azure AD recommendations","description":"Allows the app to read and update Azure AD recommendations, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/directoryrecommendations-readwrite-all/"},{"permission":"Domain-InternalFederation.Read.All","application":{"id":"c0e5a7b0-e8b7-40a7-b8e0-8249e6ea81d5","name":"Read internal federation configuration for a domain.","description":"Allows the app to read internal federation configuration for a domain.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"33203a2a-a761-40f0-8a7c-a7e74a9f8ac6","name":"Read internal federation configuration for a domain.","description":"Allows the app to read internal federation configuration for a domain.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/domain-internalfederation-read-all/"},{"permission":"Domain-InternalFederation.ReadWrite.All","application":{"id":"64d40371-8d58-4270-bc8a-b4a66de36b9a","name":"Create, read, update and delete internal federation configuration for a domain.","description":"Allows the app to create, read, update and delete internal federation configuration for a domain.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"857bd3ea-490e-4284-88a7-a7de1893b6ee","name":"Create, read, update and delete internal federation configuration for a domain.","description":"Allows the app to create, read, update and delete internal federation configuration for a domain.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/domain-internalfederation-readwrite-all/"},{"permission":"Domain.Read.All","application":{"id":"dbb9058a-0e50-45d7-ae91-66909b5d4664","name":"Read domains","description":"Allows the app to read all domain properties without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2f9ee017-59c1-4f1d-9472-bd5529a7b311","name":"Read domains.","description":"Allows the app to read all domain properties on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/domain-read-all/"},{"permission":"Domain.ReadWrite.All","application":{"id":"7e05723c-0bb0-42da-be95-ae9f08a6e53c","name":"Read and write domains","description":"Allows the app to read and write all domain properties without a signed in user.  Also allows the app to add,  verify and remove domains.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"delegated":{"id":"0b5d694c-a244-4bde-86e6-eb5cd07730fe","name":"Read and write domains","description":"Allows the app to read and write all domain properties on behalf of the signed-in user. Also allows the app to add, verify and remove domains.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/domain-readwrite-all/"},{"permission":"EAS.AccessAsUser.All","application":null,"delegated":{"id":"ff91d191-45a0-43fd-b837-bd682c4a0b0f","name":"Access mailboxes via Exchange ActiveSync","description":"Allows the app to have the same access to mailboxes as the signed-in user via Exchange ActiveSync.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eas-accessasuser-all/"},{"permission":"eDiscovery.Read.All","application":{"id":"50180013-6191-4d1e-a373-e590ff4e66af","name":"Read all eDiscovery objects","description":"Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"99201db3-7652-4d5a-809a-bdb94f85fe3c","name":"Read all eDiscovery objects","description":"Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/ediscovery-read-all/"},{"permission":"eDiscovery.ReadWrite.All","application":{"id":"b2620db1-3bf7-4c5b-9cb9-576d29eac736","name":"Read and write all eDiscovery objects","description":"Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"acb8f680-0834-4146-b69e-4ab1b39745ad","name":"Read and write all eDiscovery objects","description":"Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/ediscovery-readwrite-all/"},{"permission":"EduAdministration.Read","application":null,"delegated":{"id":"8523895c-6081-45bf-8a5d-f062a2f12c9f","name":"Read education app settings","description":"Read the state and settings of all Microsoft education apps on behalf of the user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduadministration-read/"},{"permission":"EduAdministration.Read.All","application":{"id":"7c9db06a-ec2d-4e7b-a592-5a1e30992566","name":"Read Education app settings","description":"Read the state and settings of all Microsoft education apps.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduadministration-read-all/"},{"permission":"EduAdministration.ReadWrite","application":null,"delegated":{"id":"63589852-04e3-46b4-bae9-15d5b1050748","name":"Manage education app settings","description":"Manage the state and settings of all Microsoft education apps on behalf of the user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduadministration-readwrite/"},{"permission":"EduAdministration.ReadWrite.All","application":{"id":"9bc431c3-b8bc-4a8d-a219-40f10f92eff6","name":"Manage education app settings","description":"Manage the state and settings of all Microsoft education apps.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduadministration-readwrite-all/"},{"permission":"EduAssignments.Read","application":null,"delegated":{"id":"091460c9-9c4a-49b2-81ef-1f3d852acce2","name":"Read users' class assignments and their grades","description":"Allows the app to read assignments and their grades on behalf of the user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduassignments-read/"},{"permission":"EduAssignments.Read.All","application":{"id":"4c37e1b6-35a1-43bf-926a-6f30f2cdf585","name":"Read all class assignments with grades","description":"Allows the app to read all class assignments with grades for all users without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduassignments-read-all/"},{"permission":"EduAssignments.ReadBasic","application":null,"delegated":{"id":"c0b0103b-c053-4b2e-9973-9f3a544ec9b8","name":"Read users' class assignments without grades","description":"Allows the app to read assignments without grades on behalf of the user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduassignments-readbasic/"},{"permission":"EduAssignments.ReadBasic.All","application":{"id":"6e0a958b-b7fc-4348-b7c4-a6ab9fd3dd0e","name":"Read all class assignments without grades","description":"Allows the app to read all class assignments without grades for all users without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduassignments-readbasic-all/"},{"permission":"EduAssignments.ReadWrite","application":null,"delegated":{"id":"2f233e90-164b-4501-8bce-31af2559a2d3","name":"Read and write users' class assignments and their grades","description":"Allows the app to read and write assignments and their grades on behalf of the user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduassignments-readwrite/"},{"permission":"EduAssignments.ReadWrite.All","application":{"id":"0d22204b-6cad-4dd0-8362-3e3f2ae699d9","name":"Create, read, update and delete all class assignments with grades","description":"Allows the app to create, read, update and delete all class assignments with grades for all users without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduassignments-readwrite-all/"},{"permission":"EduAssignments.ReadWriteBasic","application":null,"delegated":{"id":"2ef770a1-622a-47c4-93ee-28d6adbed3a0","name":"Read and write users' class assignments without grades","description":"Allows the app to read and write assignments without grades on behalf of the user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduassignments-readwritebasic/"},{"permission":"EduAssignments.ReadWriteBasic.All","application":{"id":"f431cc63-a2de-48c4-8054-a34bc093af84","name":"Create, read, update and delete all class assignments without grades","description":"Allows the app to create, read, update and delete all class assignments without grades for all users without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduassignments-readwritebasic-all/"},{"permission":"EduCurricula.Read","application":null,"delegated":{"id":"484859e8-b9e2-4e92-b910-84db35dadd29","name":"Read the user's class modules and resources","description":"Allows the app to read the user's modules and resources on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/educurricula-read/"},{"permission":"EduCurricula.Read.All","application":{"id":"6cdb464c-3a03-40f8-900b-4cb7ea1da9c0","name":"Read all class modules and resources","description":"Allows the app to read all modules and resources, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/educurricula-read-all/"},{"permission":"EduCurricula.ReadWrite","application":null,"delegated":{"id":"4793c53b-df34-44fd-8d26-d15c517732f5","name":"Read and write the user's class modules and resources","description":"Allows the app to read and write user's modules and resources on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/educurricula-readwrite/"},{"permission":"EduCurricula.ReadWrite.All","application":{"id":"6a0c2318-d59d-4c7d-bf2e-5f3902dc2593","name":"Read and write all class modules and resources","description":"Allows the app to read and write all modules and resources, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/educurricula-readwrite-all/"},{"permission":"EduReports-Reading.Read.All","application":{"id":"ad248c30-1919-40c8-b3d2-304481894e88","name":"Read all tenant reading assignments submissions data","description":"Allows the app to read all tenant users reading assignments submissions data without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/edureports-reading-read-all/"},{"permission":"EduReports-Reading.ReadAnonymous.All","application":{"id":"040330d7-be7e-4130-b349-a6eb3a56e2f8","name":"Read all tenant reading assignments submissions data","description":"Allows the app to read all tenant users reading assignments submissions data (excludes student-identifying information) without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/edureports-reading-readanonymous-all/"},{"permission":"EduReports-Reflect.Read.All","application":{"id":"c5debf73-bdc8-473d-bf07-f4074ad05f71","name":"Read all tenant reflect check-ins submissions data","description":"Allows the app to read all tenant users reflect check-ins submissions data without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/edureports-reflect-read-all/"},{"permission":"EduReports-Reflect.ReadAnonymous.All","application":{"id":"f5d05dba-7ef0-46fc-b62c-a7282555f428","name":"Read all tenant reflect check-ins submissions data","description":"Allows the app to read all tenant users reflect check-ins submissions data (excludes responder-identifying information) without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/edureports-reflect-readanonymous-all/"},{"permission":"EduRoster.Read","application":null,"delegated":{"id":"a4389601-22d9-4096-ac18-36a927199112","name":"Read users' view of the roster","description":"Allows the app to read the structure of schools and classes in an organization's roster and education-specific information about users to be read on behalf of the user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduroster-read/"},{"permission":"EduRoster.Read.All","application":{"id":"e0ac9e1b-cb65-4fc5-87c5-1a8bc181f648","name":"Read the organization's roster","description":"Allows the app to read the structure of schools and classes in the organization's roster and education-specific information about all users to be read.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduroster-read-all/"},{"permission":"EduRoster.ReadBasic","application":null,"delegated":{"id":"5d186531-d1bf-4f07-8cea-7c42119e1bd9","name":"Read a limited subset of users' view of the roster","description":"Allows the app to read a limited subset of the properties from the structure of schools and classes in an organization's roster and a limited subset of properties about users to be read on behalf of the user. Includes name, status, education role, email address and photo.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduroster-readbasic/"},{"permission":"EduRoster.ReadBasic.All","application":{"id":"0d412a8c-a06c-439f-b3ec-8abcf54d2f96","name":"Read a limited subset of the organization's roster","description":"Allows the app to read a limited subset of properties from both the structure of schools and classes in the organization's roster and education-specific information about all users. Includes name, status, role, email address and photo.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduroster-readbasic-all/"},{"permission":"EduRoster.ReadWrite","application":null,"delegated":{"id":"359e19a6-e3fa-4d7f-bcab-d28ec592b51e","name":"Read and write users' view of the roster","description":"Allows the app to read and write the structure of schools and classes in an organization's roster and education-specific information about users to be read and written on behalf of the user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduroster-readwrite/"},{"permission":"EduRoster.ReadWrite.All","application":{"id":"d1808e82-ce13-47af-ae0d-f9b254e6d58a","name":"Read and write the organization's roster","description":"Allows the app to read and write the structure of schools and classes in the organization's roster and education-specific information about all users to be read and written.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eduroster-readwrite-all/"},{"permission":"email","application":null,"delegated":{"id":"64a6cdd6-aab1-4aaf-94b8-3cc8405e90d0","name":"View users' email address","description":"Allows the app to read your users' primary email address","adminConsent":false,"risk":"Low","riskReason":"Basic sign-in and profile information."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/email/"},{"permission":"EngagementConversation.Migration.All","application":{"id":"e1d2136d-eaaf-427a-a7db-f97dbe847c27","name":"Read and write all Viva Engage conversations","description":"Allows the app to create Viva Engage conversations without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/engagementconversation-migration-all/"},{"permission":"EngagementConversation.Read.All","application":{"id":"2c495153-cd0e-41b4-9980-3bcecf1ca22f","name":"Read all Viva Engage conversations","description":"Allows the app to list Viva Engage conversations, and to read their properties without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"c55541d9-2cdd-4fad-8ead-0c08fae5b0c8","name":"Read all Viva Engage conversations","description":"Allows the app to read Viva Engage conversations, and to read their properties on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/engagementconversation-read-all/"},{"permission":"EngagementConversation.ReadWrite.All","application":{"id":"bfbd4840-fba0-43a7-93a9-465b687e47d0","name":"Read and write all Viva Engage conversations","description":"Allows the app to create Viva Engage conversations, read all conversation properties, update conversation properties, and delete conversations without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"ebbfd079-1634-4640-8618-68b19ebbed1d","name":"Read and write all Viva Engage conversations","description":"Allows the app to create Viva Engage conversations and read all conversation properties on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/engagementconversation-readwrite-all/"},{"permission":"EngagementExport.Read.All","application":{"id":"eda8c187-a7d5-42cb-b2e1-c9142f63899f","name":"Export Viva Engage data","description":"Allows the app to export Viva Engage data for compliance, GDPR, and admin scenarios without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/engagementexport-read-all/"},{"permission":"EngagementMeetingConversation.Read.All","application":{"id":"d746beae-b46e-446e-924a-5b805a5c4467","name":"Read all Viva Engage Teams QA conversations","description":"Allows the app to list Viva Engage Teams QA conversations, and to read their properties without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"58c5819e-29bd-4400-ad52-82cd82a63fbd","name":"Read all Viva Engage Teams QA conversations","description":"Allows the app to read Viva Engage Teams QA conversations, and to read their properties on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/engagementmeetingconversation-read-all/"},{"permission":"EngagementRole.Read","application":null,"delegated":{"id":"9f1da0fc-345c-4dfb-bab5-5215a073a417","name":"Read a user's Viva Engage roles ","description":"Allows the app to list a user's Viva Engage roles, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/engagementrole-read/"},{"permission":"EngagementRole.Read.All","application":{"id":"30614864-4114-45ef-bdd9-0dd7894a1cc4","name":"Read all Viva Engage roles and role memberships","description":"Allows the app to list all Viva Engage roles and role memberships without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"3cad91a5-8413-4c4a-acfe-dfeb83d1366d","name":"Read all Viva Engage roles and role memberships","description":"Allows the app to list all Viva Engage roles and role memberships on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/engagementrole-read-all/"},{"permission":"EngagementRole.ReadWrite.All","application":{"id":"3ede5358-7366-4da8-a2f7-472bf9c7cc34","name":"Modify Viva Engage role membership","description":"Allows the app to assign Viva Engage role to a user, and remove a Viva Engage role from a user without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"4905982d-6459-4ccd-949c-949fefc0a8f2","name":"Modify Viva Engage role membership","description":"Allows the app to assign Viva Engage role to a user, and remove a Viva Engage role from a user behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/engagementrole-readwrite-all/"},{"permission":"EntitlementManagement.Read.All","application":{"id":"c74fd47d-ed3c-45c3-9a9e-b8676de685d2","name":"Read all entitlement management resources","description":"Allows the app to read access packages and related entitlement management resources without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"5449aa12-1393-4ea2-a7c7-d0e06c1a56b2","name":"Read all entitlement management resources","description":"Allows the app to read access packages and related entitlement management resources on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/entitlementmanagement-read-all/"},{"permission":"EntitlementManagement.ReadWrite.All","application":{"id":"9acd699f-1e81-4958-b001-93b1d2506e19","name":"Read and write all entitlement management resources","description":"Allows the app to read and write access packages and related entitlement management resources without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"ae7a573d-81d7-432b-ad44-4ed5c9d89038","name":"Read and write entitlement management resources","description":"Allows the app to request access to and management of access packages and related entitlement management resources on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/entitlementmanagement-readwrite-all/"},{"permission":"EntitlementMgmt-SubjectAccess.ReadWrite","application":null,"delegated":{"id":"e9fdcbbb-8807-410f-b9ec-8d5468c7c2ac","name":"Read and write entitlement management resources related to self-service operations","description":"Allows the app to manage self-service entitlement management resources on behalf of the signed-in user.  This includes operations such as requesting access and approving access of others.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/entitlementmgmt-subjectaccess-readwrite/"},{"permission":"EntraBackup.Read.All","application":{"id":"56eda3c5-3834-4815-bd41-6f8fa1295247","name":"Read Preview jobs and snapshots","description":"Allows the app to list the all the snapshots, jobs and enumerate the changes of a specific preview job, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"a6ea9dd7-4dd9-4484-a80a-ac9ad981dcf1","name":"Read Preview jobs and snapshots","description":"Allows the app to list the all the snapshots, jobs and enumerate the changes of a specific preview job, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/entrabackup-read-all/"},{"permission":"EntraBackup.ReadWrite.Preview","application":null,"delegated":{"id":"cef123a8-c18c-4eba-852e-d90cfbf67c91","name":"Create a preview job, read preview job and snapshots","description":"Allows the app to  list the all the snapshots, create a preview job and enumerate the changes of a specific preview job, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/entrabackup-readwrite-preview/"},{"permission":"EntraBackup.ReadWrite.Recovery","application":null,"delegated":{"id":"8269c6ff-41d7-4172-a783-b2ce38322e42","name":"Create preview and recovery job, read recovery job and snapshots","description":"Allows the app to  list the all the snapshots, create a recovery job and enumerate the changes of a specific recovery job, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/entrabackup-readwrite-recovery/"},{"permission":"EventListener.Read.All","application":{"id":"b7f6385c-6ce6-4639-a480-e23c42ed9784","name":"Read all authentication event listeners","description":"Allows the app to read your organization's authentication event listeners without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"f7dd3bed-5eec-48da-bc73-1c0ef50bc9a1","name":"Read your organization's authentication event listeners","description":"Allows the app to read your organization's authentication event listeners on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eventlistener-read-all/"},{"permission":"EventListener.ReadWrite.All","application":{"id":"0edf5e9e-4ce8-468a-8432-d08631d18c43","name":"Read and write all authentication event listeners","description":"Allows the app to read or write your organization's authentication event listeners without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"d11625a6-fe21-4fc6-8d3d-063eba5525ad","name":"Read and write your organization's authentication event listeners","description":"Allows the app to read or write your organization's authentication event listeners on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/eventlistener-readwrite-all/"},{"permission":"EWS.AccessAsUser.All","application":null,"delegated":{"id":"9769c687-087d-48ac-9cb3-c37dde652038","name":"Access mailboxes as the signed-in user via Exchange Web Services","description":"Allows the app to have the same access to mailboxes as the signed-in user via Exchange Web Services.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/ews-accessasuser-all/"},{"permission":"ExchangeMessageTrace.Read.All","application":{"id":"89b20d8a-76e2-4057-867b-9961f800b9a4","name":"Search the email message trace","description":"Allows the app to search the email message trace, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"b2e7d27e-14e7-41ad-bb15-a88ceb9c3e90","name":"Search the email message trace","description":"Allows the app to search the email message trace on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/exchangemessagetrace-read-all/"},{"permission":"ExternalConnection.Read.All","application":{"id":"1914711b-a1cb-4793-b019-c2ce0ed21b8c","name":"Read all external connections","description":"Allows the app to read all external connections without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"a38267a5-26b6-4d76-9493-935b7599116b","name":"Read all external connections","description":"Allows the app to read all external connections on behalf of a signed-in user. The signed-in user must be an administrator.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/externalconnection-read-all/"},{"permission":"ExternalConnection.ReadWrite.All","application":{"id":"34c37bc0-2b40-4d5e-85e1-2365cd256d79","name":"Read and write all external connections","description":"Allows the app to read and write all external connections without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"bbbbd9b3-3566-4931-ac37-2b2180d9e334","name":"Read and write all external connections","description":"Allows the app to read and write all external connections on behalf of a signed-in user. The signed-in user must be an administrator.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/externalconnection-readwrite-all/"},{"permission":"ExternalConnection.ReadWrite.OwnedBy","application":{"id":"f431331c-49a6-499f-be1c-62af19c34a9d","name":"Read and write external connections","description":"Allows the app to read and write external connections without a signed-in user. The app can only read and write external connections that it is authorized to, or it can create new external connections.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"4082ad95-c812-4f02-be92-780c4c4f1830","name":"Read and write external connections","description":"Allows the app to read and write settings of external connections on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read and write settings of connections that it is authorized to.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/externalconnection-readwrite-ownedby/"},{"permission":"ExternalItem.Read.All","application":{"id":"7a7cffad-37d2-4f48-afa4-c6ab129adcc2","name":"Read all external items","description":"Allows the app to read all external items without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"922f9392-b1b7-483c-a4be-0089be7704fb","name":"Read items in external datasets","description":"Allow the app to read external datasets and content, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/externalitem-read-all/"},{"permission":"ExternalItem.ReadWrite.All","application":{"id":"38c3d6ee-69ee-422f-b954-e17819665354","name":"Read and write items in external datasets","description":"Allow the app to read or write items in all external datasets that the app is authorized to access","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"b02c54f8-eb48-4c50-a9f0-a149e5a2012f","name":"Read and write all external items","description":"Allows the app to read and write all external items on behalf of a signed-in user. The signed-in user must be an administrator.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/externalitem-readwrite-all/"},{"permission":"ExternalItem.ReadWrite.OwnedBy","application":{"id":"8116ae0f-55c2-452d-9944-d18420f5b2c8","name":"Read and write external items","description":"Allows the app to read and write external items without a signed-in user. The app can only read external items of the connection that it is authorized to.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"4367b9d7-cee7-4995-853c-a0bdfe95c1f9","name":"Read and write external items","description":"Allows the app to read and write external items on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read external items of the connection that it is authorized to.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/externalitem-readwrite-ownedby/"},{"permission":"ExternalUserProfile.Read.All","application":{"id":"1987d7a0-d602-4262-ab90-cfdd43b37545","name":"Read all external user profiles","description":"Allows the app to read available properties of external user profiles, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"47167bec-55a7-4caf-9ecc-8d4566e3cfb1","name":"Read external user profiles","description":"Allows the app to read available properties of external user profiles, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/externaluserprofile-read-all/"},{"permission":"ExternalUserProfile.ReadWrite.All","application":{"id":"761327c9-d819-4c08-9a5f-874cd2826608","name":"Read and write all external user profiles","description":"Allows the app to read and write available properties of external user profiles, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"c6068dc7-a791-46a4-a811-b8228e6649ab","name":"Read and write external user profiles","description":"Allows the app to read and write available properties of external user profiles, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/externaluserprofile-readwrite-all/"},{"permission":"Family.Read","application":null,"delegated":{"id":"3a1e4806-a744-4c70-80fc-223bf8582c46","name":"Read your family info","description":"Allows the app to read your family information, members and their basic profile.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/family-read/"},{"permission":"FileIngestion.Ingest","application":{"id":"65891b00-2fd9-4e33-be27-04a53132e3df","name":"Ingest SharePoint and OneDrive content to make it available in the search index","description":"Allows the app to ingest SharePoint and OneDrive content to make it available in the search index, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/fileingestion-ingest/"},{"permission":"FileIngestionHybridOnboarding.Manage","application":{"id":"766c601b-c009-4438-8290-c8b05fa00c4b","name":"Manage onboarding for a Hybrid Cloud tenant","description":"Allows the app to manage onboarding for a Hybrid Cloud tenant, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/fileingestionhybridonboarding-manage/"},{"permission":"Files.Read","application":null,"delegated":{"id":"10465720-29dd-4523-a11a-6a75c743c9d9","name":"Read user files","description":"Allows the app to read the signed-in user's files.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/files-read/"},{"permission":"Files.Read.All","application":{"id":"01d4889c-1287-42c6-ac1f-5d1e02578ef6","name":"Read files in all site collections","description":"Allows the app to read all files in all site collections without a signed in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"df85f4d6-205c-4ac5-a5ea-6bf408dba283","name":"Read all files that user can access","description":"Allows the app to read all files the signed-in user can access.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":"Use Sites.Selected, or delegated Files.Read for the user's own files.","url":"https://azureblog.co.uk/graph-permissions/files-read-all/"},{"permission":"Files.Read.Selected","application":null,"delegated":{"id":"5447fe39-cb82-4c1a-b977-520e67e724eb","name":"Read files that the user selects (preview)","description":"(Preview) Allows the app to read files that the user selects. The app has access for several hours after the user selects a file.","adminConsent":false,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/files-read-selected/"},{"permission":"Files.ReadWrite","application":null,"delegated":{"id":"5c28f0bf-8a70-41f1-8ab2-9032436ddb65","name":"Have full access to user files","description":"Allows the app to read, create, update and delete the signed-in user's files.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/files-readwrite/"},{"permission":"Files.ReadWrite.All","application":{"id":"75359482-378d-4052-8f01-80520e7db3cd","name":"Read and write files in all site collections","description":"Allows the app to read, create, update and delete all files in all site collections without a signed in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"863451e7-0667-486c-a5d6-d135439485f0","name":"Have full access to all files user can access","description":"Allows the app to read, create, update and delete all files the signed-in user can access.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":"Use Sites.Selected where the files live in specific sites, or delegated Files.ReadWrite for the signed-in user's own files.","url":"https://azureblog.co.uk/graph-permissions/files-readwrite-all/"},{"permission":"Files.ReadWrite.AppFolder","application":{"id":"b47b160b-1054-4efd-9ca0-e2f614696086","name":"Have full access to the application's folder without a signed in user.","description":"Allows the app to read, create, update and delete files in the application's folder without a signed in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"8019c312-3263-48e6-825e-2b833497195b","name":"Have full access to the application's folder (preview)","description":"(Preview) Allows the app to read, create, update and delete files in the application's folder.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/files-readwrite-appfolder/"},{"permission":"Files.ReadWrite.Selected","application":null,"delegated":{"id":"17dde5bd-8c17-420f-a486-969730c1b827","name":"Read and write files that the user selects (preview)","description":"(Preview) Allows the app to read and write files that the user selects. The app has access for several hours after the user selects a file.","adminConsent":false,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/files-readwrite-selected/"},{"permission":"Files.SelectedOperations.Selected","application":{"id":"bd61925e-3bf4-4d62-bc0b-06b06c96d95c","name":"Access selected Files without a signed in user.","description":"Allow the application to access a subset of files without a signed in user.  The specific files and the permissions granted will be configured in SharePoint Online or OneDrive.","adminConsent":true,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"delegated":{"id":"ef2779dc-ef1b-4211-8310-8a0ac2450081","name":"Access selected Files, on behalf of the signed-in user","description":"Allow the application to access files explicitly permissioned to the application on behalf of the signed in user.  The specific files and the permissions granted will be configured in SharePoint Online or OneDrive.","adminConsent":true,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/files-selectedoperations-selected/"},{"permission":"FileStorageContainer.Manage.All","application":null,"delegated":{"id":"527b6d64-cdf5-4b8b-b336-4aa0b8ca2ce5","name":"Manage all file storage containers","description":"Allows the application to utilize the file storage container administration capabilities on behalf of an administrator user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/filestoragecontainer-manage-all/"},{"permission":"FileStorageContainer.Selected","application":{"id":"40dc41bc-0f7e-42ff-89bd-d9516947e474","name":"Access selected file storage containers","description":"Allows the application to utilize the file storage container platform to manage containers, without a signed-in user. The specific file storage containers and the permissions granted to them will be configured in Microsoft 365 by the developer of each container type.","adminConsent":true,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"delegated":{"id":"085ca537-6565-41c2-aca7-db852babc212","name":"Access selected file storage containers","description":"Allows the application to utilize the file storage container platform to manage containers on behalf of the signed in user. The specific file storage containers and the permissions granted to them will be configured in Microsoft 365 by the developer of each container type.","adminConsent":false,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/filestoragecontainer-selected/"},{"permission":"FileStorageContainerType.Manage.All","application":null,"delegated":{"id":"8e6ec84c-5fcd-4cc7-ac8a-2296efc0ed9b","name":"Manage file storage container types on behalf of the signed in user","description":"Allows the application to manage file storage container types on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/filestoragecontainertype-manage-all/"},{"permission":"FileStorageContainerTypeReg.Manage.All","application":null,"delegated":{"id":"c319a7df-930e-44c0-a43b-7e5e9c7f4f24","name":"Manage file storage container type registrations on behalf of the signed in user","description":"Allows the application to manage file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/filestoragecontainertypereg-manage-all/"},{"permission":"FileStorageContainerTypeReg.Selected","application":{"id":"2dcc6599-bd30-442b-8f11-90f88ad441dc","name":"Access selected file storage container type registrations","description":"Allows the application to manage file storage container type registrations without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"delegated":{"id":"d1e4f63a-1569-475c-b9b2-bdc140405e38","name":"Access selected file storage container type registrations.","description":"Allows the application to manage selected file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.","adminConsent":false,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/filestoragecontainertypereg-selected/"},{"permission":"Financials.ReadWrite.All","application":null,"delegated":{"id":"f534bf13-55d4-45a9-8f3c-c92fe64d6131","name":"Read and write financials data","description":"Allows the app to read and write financials data on behalf of the signed-in user.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/financials-readwrite-all/"},{"permission":"Goals-Export.Read.All","application":null,"delegated":{"id":"092211d9-ca1a-427b-813e-b79c7653fe71","name":"Read all goals and export jobs that a user can access","description":"Allows the app to read all goals and export jobs that the signed-in user can access.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/goals-export-read-all/"},{"permission":"Goals-Export.ReadWrite.All","application":null,"delegated":{"id":"2edeb9fd-4228-480c-a26d-2ed52011cf3d","name":"Have full access to all goals and export jobs a user can access","description":"Allows the app to read goals, create and read export jobs that the signed-in user can access.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/goals-export-readwrite-all/"},{"permission":"Group-Conversation.Read.All","application":{"id":"4f0a8235-6f6f-4ec7-9500-34b452a4a0c3","name":"Read all group conversations","description":"Allows the app to read conversations of the groups this app has access to without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"c92fbbc2-50e0-4842-93ef-385c3293ea3d","name":"Read group conversations","description":"Allows the app to read group conversations that the signed-in user has access to.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/group-conversation-read-all/"},{"permission":"Group-Conversation.ReadWrite.All","application":{"id":"6679c91b-820a-4900-ab47-e97b197a89c4","name":"Read and write all group conversations","description":"Allows the app to read and write conversations of the groups this app has access to without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"302bcbb5-855a-4e49-ae20-94a331b0281e","name":"Read and write group conversations","description":"Allows the app to read and write group conversations that the signed-in user has access to.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/group-conversation-readwrite-all/"},{"permission":"Group-NestingSupport.ReadWrite.All","application":{"id":"2d53948b-d2c5-4008-9c4e-6361bf192555","name":"Read and write groups' disableNesting property","description":"Allows the app to read and write groups' disableNesting property without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"afc507db-8793-4d2f-999d-6e34cff02b7c","name":"Read and write groups' disableNesting property","description":"Allows the app to read and write groups' disableNesting property on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/group-nestingsupport-readwrite-all/"},{"permission":"Group-OnPremisesSyncBehavior.ReadWrite.All","application":{"id":"2d9bd318-b883-40be-9df7-63ec4fcdc424","name":"Read and update the on-premises sync behavior of groups","description":"Allows the app to update the on-premises sync behavior of all groups without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"37e00479-5776-4659-aecf-4841ec5d590a","name":"Read and update the on-premises sync behavior of groups","description":"Allows the app to read and update the on-premises sync behavior of groups on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/group-onpremisessyncbehavior-readwrite-all/"},{"permission":"Group-PreferredDataLocation.ReadWrite.All","application":{"id":"603ce4e3-fb05-4b63-91ba-729bb1dca667","name":"Read and write all groups’ preferred data location property","description":"Allows the app to create, read and update all groups’ preferred data location property, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"7ba6c25f-c181-4bfd-80b1-3ac184ac5629","name":"Read and write all groups’ preferred data location property that user can access","description":"Allows the app to create, read and update groups’ preferred data location property that you have access to in the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/group-preferreddatalocation-readwrite-all/"},{"permission":"Group-XTenantIdentitySync.Read.All","application":{"id":"35b96aac-d839-4362-abd4-7381f2b27ccd","name":"Read all Group Cross-Tenant Identity Synchronization properties","description":"Allows the app to read all Cross-Tenant Identity Synchronization properties on Groups, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"f7c0661b-4247-48ac-a371-05ff047614c6","name":"Read all Group Cross-Tenant Identity Synchronization properties","description":"Allows the app to read all Cross-Tenant Identity Synchronization properties on Groups, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/group-xtenantidentitysync-read-all/"},{"permission":"Group.Create","application":{"id":"bf7b1a76-6e77-406b-b258-bf5c7720e98f","name":"Create groups","description":"Allows the app to create groups without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/group-create/"},{"permission":"Group.ManageProtection.All","application":{"id":"60f8cea0-2476-45c9-ab18-70e79e60ad14","name":"Manage the Microsoft Information Protection (MIP) label for M365 and security groups.","description":"Allows the app to list groups, and to read their basic properties and manage the MIP label for all label enabled groups without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"36263ed6-285e-4f84-b25a-62ec2ba17d29","name":"Manage the Microsoft Information Protection (MIP) label for M365 and security groups.","description":"Allows the app to list groups, and to read their basic properties and manage the MIP label for all label enabled groups on behalf of the signed-in user. ","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/group-manageprotection-all/"},{"permission":"Group.Read.All","application":{"id":"5b567255-7703-4780-807c-7be8301ae99b","name":"Read all groups","description":"Allows the app to read group properties and memberships, and read conversations for all groups, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"5f8c59db-677d-491f-a6b8-5f174b11ec1d","name":"Read all groups","description":"Allows the app to list groups, and to read their properties and all group memberships on behalf of the signed-in user.  Also allows the app to read calendar, conversations, files, and other group content for all groups the signed-in user can access.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":"If you only need membership, use GroupMember.Read.All.","url":"https://azureblog.co.uk/graph-permissions/group-read-all/"},{"permission":"Group.ReadBasic.All","application":{"id":"07d67222-3a10-4d3b-9ddc-b8aa43198a00","name":"Read all groups’ basic property","description":"Allows the app to read all group basic properties. All of these operations can be performed by the app without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ba1917bc-a64b-4c71-b66d-229d4a520e66","name":"Read all groups’ basic property","description":"Allows the app to read all group basic properties on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/group-readbasic-all/"},{"permission":"Group.ReadWrite.All","application":{"id":"62a82d76-70ea-41e2-9197-370581804d09","name":"Read and write all groups","description":"Allows the app to create groups, read all group properties and memberships, update group properties and memberships, and delete groups. Also allows the app to read and write conversations. All of these operations can be performed by the app without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"4e46008b-f24c-477d-8fff-7bb4ec7aafe0","name":"Read and write all groups","description":"Allows the app to create groups and read all group properties and memberships on behalf of the signed-in user.  Additionally allows group owners to manage their groups and allows group members to update group content.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":"If the app only manages membership, use GroupMember.ReadWrite.All.","url":"https://azureblog.co.uk/graph-permissions/group-readwrite-all/"},{"permission":"GroupMember.Read.All","application":{"id":"98830695-27a2-44f7-8c18-0c3ebc9698f6","name":"Read all group memberships","description":"Allows the app to read memberships and basic group properties for all groups without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"bc024368-1153-4739-b217-4326f2e966d0","name":"Read group memberships","description":"Allows the app to list groups, read basic group properties and read membership of all groups the signed-in user has access to.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/groupmember-read-all/"},{"permission":"GroupMember.ReadBasic.All","application":{"id":"8222c640-cae5-4860-8d11-b32cfad95e03","name":"Read all group memberships","description":"Allows the app to read all basic group memberships in the organization, without signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"28539367-358c-4ed9-b7f0-793eccb8fd34","name":"Read group memberships","description":"Allows the app to read basic group memberships that you have access to in the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/groupmember-readbasic-all/"},{"permission":"GroupMember.ReadWrite.All","application":{"id":"dbaae8cf-10b5-4b86-a4a1-f871c94c6695","name":"Read and write all group memberships","description":"Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"f81125ac-d3b7-4573-a3b2-7099cc39df9e","name":"Read and write group memberships","description":"Allows the app to list groups, read basic properties, read and update the membership of the groups the signed-in user has access to. Group properties and owners cannot be updated and groups cannot be deleted.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/groupmember-readwrite-all/"},{"permission":"GroupSettings.Read.All","application":{"id":"f3c4f514-c65a-43f5-bfce-1735872258dd","name":"Read all group settings","description":"Allows the app to read a list of tenant-level or group-specific group settings objects, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2eb2bc92-94ef-4c6b-b4ab-2a09bc975e0e","name":"Read all group settings that user can access","description":"Allows the app to read a list of tenant-level or group-specific group settings objects, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/groupsettings-read-all/"},{"permission":"GroupSettings.ReadWrite.All","application":{"id":"546168c3-1183-4281-9491-fafb24dea37e","name":"Read and write all group settings","description":"Allows the app to create, read, update, and delete on the list of tenant-level or group-specific group settings objects, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"c1691a6d-99e2-4cfa-b4b5-9e4d67dc0f36","name":"Read and write all group settings that user can access","description":"Allows the app to create, read, update, and delete on the list of tenant-level or group-specific group settings objects that you have access to in the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/groupsettings-readwrite-all/"},{"permission":"HealthMonitoringAlert.Read.All","application":{"id":"5183ed5d-b7f8-4e9a-915e-dafb46b9cb62","name":"Read all scenario health monitoring alert","description":"Allows the app to read all scenario health monitoring alerts, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"74b4ff32-4917-4536-a66d-38a4861e6220","name":"Read all scenario health monitoring alerts","description":"Allows the app to read all scenario health monitoring alerts","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/healthmonitoringalert-read-all/"},{"permission":"HealthMonitoringAlert.ReadWrite.All","application":{"id":"ac29eb50-f2f9-4518-a117-4bef18e84c7d","name":"Read and write all scenario monitoring alerts","description":"Allows the app to read and write all scenario monitoring alerts, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"b7c60f27-2195-4d5f-96a7-6b98bdfd9664","name":"Read and write all scenario monitoring alerts","description":"Allows the app to read and write all scenario monitoring alerts, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/healthmonitoringalert-readwrite-all/"},{"permission":"HealthMonitoringAlertConfig.Read.All","application":{"id":"bb424d73-e898-4c97-9d42-688c32810003","name":"Read all scenario health monitoring alert configurations","description":"Allows the app to read all scenario health monitoring alert configurations, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"fb873030-8626-47e6-96ff-8a5bff3b725f","name":"Read all scenario health monitoring alert configurations","description":"Allows the app to read all scenario health monitoring alert configurations","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/healthmonitoringalertconfig-read-all/"},{"permission":"HealthMonitoringAlertConfig.ReadWrite.All","application":{"id":"432e76f0-8af6-4315-a853-66ab9538f480","name":"Read and write all scenario monitoring alerts","description":"Allows the app to read and write all scenario monitoring alerts, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"b3e5ebc6-1c23-4337-8286-3f27165addb4","name":"Read and write all scenario monitoring alert configurations.","description":"Allows the app to read and write all scenario monitoring alert configurations, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/healthmonitoringalertconfig-readwrite-all/"},{"permission":"IdentityDiagnostic.Read","application":null,"delegated":{"id":"3839e465-e636-4c8e-b959-340182fb0567","name":"Read your identity diagnostics","description":"Allows the app to read own identity diagnostics information, including symptoms, runs, statuses, and results for the signed-in user","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identitydiagnostic-read/"},{"permission":"IdentityDiagnostic.Read.All","application":{"id":"bb1e8ab4-fe40-4b26-82ec-65dfaf4d367b","name":"Read all identity diagnostics","description":"Allows the app to read all identity diagnostics information, including symptoms, runs, statuses, and results for all users in the organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9181fb3f-4b8e-45ef-98ae-41774b813b80","name":"Read all identity diagnostics","description":"Allows the app to read all identity diagnostics information, including symptoms, runs, statuses, and results for all users in the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identitydiagnostic-read-all/"},{"permission":"IdentityDiagnostic.StartDiagnosis","application":null,"delegated":{"id":"1ad58246-a11b-4ea3-9b75-8b6c315cbe21","name":"Start identity diagnostics","description":"Allows the app to start identity diagnostic processes for the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identitydiagnostic-startdiagnosis/"},{"permission":"IdentityDiagnostic.StartDiagnosis.All","application":{"id":"2607bb8b-0a9b-4f53-9d2f-6f81b99ac145","name":"Start identity diagnostics for all users","description":"Allows the app to start identity diagnostic processes for all users in the organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"51470ff5-62b6-4aef-9a3a-d8c8a1e66d09","name":"Start identity diagnostics for all users","description":"Allows the app to start identity diagnostic processes for all users in the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identitydiagnostic-startdiagnosis-all/"},{"permission":"IdentityNotifications.Read.All","application":{"id":"52ced3dd-dbb6-41a0-9ce5-61a056be97b8","name":"Read all identity notification settings and templates","description":"Allows the app to read identity notification settings, email templates, and prerequisites without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"59cd3e28-aa9c-4f72-a734-1b592eb06853","name":"Read identity notification settings and templates","description":"Allows the app to read identity notification settings, email templates, and prerequisites on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identitynotifications-read-all/"},{"permission":"IdentityNotifications.ReadWrite.All","application":{"id":"d9fe7b9f-cb27-4289-9cb4-54debd9d3c25","name":"Read and write all identity notification settings and templates","description":"Allows the app to read and write identity notification settings, customize email templates, and send test emails without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"c9c9fdea-4ecc-4d82-a2ea-3feff3489275","name":"Read and write identity notification settings and templates","description":"Allows the app to read and write identity notification settings, customize email templates, and send test emails on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identitynotifications-readwrite-all/"},{"permission":"IdentityProvider.Read.All","application":{"id":"e321f0bb-e7f7-481e-bb28-e3b0b32d4bd0","name":"Read identity providers","description":"Allows the app to read your organization’s identity (authentication) providers’ properties without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"43781733-b5a7-4d1b-98f4-e8edff23e1a9","name":"Read identity providers","description":"Allows the app to read your organization’s identity (authentication) providers’ properties on behalf of the user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identityprovider-read-all/"},{"permission":"IdentityProvider.ReadWrite.All","application":{"id":"90db2b9a-d928-4d33-a4dd-8442ae3d41e4","name":"Read and write identity providers","description":"Allows the app to read and write your organization’s identity (authentication) providers’ properties without a signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"f13ce604-1677-429f-90bd-8a10b9f01325","name":"Read and write identity providers","description":"Allows the app to read and write your organization’s identity (authentication) providers’ properties on behalf of the user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identityprovider-readwrite-all/"},{"permission":"IdentityRiskEvent.Read.All","application":{"id":"6e472fd1-ad78-48da-a0f0-97ab2c6b769e","name":"Read all identity risk event information","description":"Allows the app to read the identity risk event information for your organization without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"8f6a01e7-0391-4ee5-aa22-a3af122cef27","name":"Read identity risk event information","description":"Allows the app to read identity risk event information for all users in your organization on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identityriskevent-read-all/"},{"permission":"IdentityRiskEvent.ReadWrite.All","application":{"id":"db06fb33-1953-4b7b-a2ac-f1e2c854f7ae","name":"Read and write all risk detection information","description":"Allows the app to read and update identity risk detection information for your organization without a signed-in user. Update operations include confirming risk event detections. ","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"9e4862a5-b68f-479e-848a-4e07e25c9916","name":"Read and write identity risk event information","description":"Allows the app to read and update identity risk event information for all users in your organization on behalf of the signed-in user. Update operations include confirming risk event detections.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identityriskevent-readwrite-all/"},{"permission":"IdentityRiskyAgent.Read.All","application":{"id":"4aadfb66-d49a-414a-a883-d8c240b6fa33","name":"Read all risky agents information","description":"Allows the app to read the risky agents information in your organization without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"3215c57f-3faa-4295-95c2-6f14a5bc6124","name":"Read risky agents information","description":"Allows the app to read risky agents information in your organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identityriskyagent-read-all/"},{"permission":"IdentityRiskyAgent.ReadWrite.All","application":{"id":"dca4e4fd-a7cf-4e6f-86d1-d1ec094d766e","name":"Read and write risky agents information","description":"Allows the app to read and update risky agents information in your organization without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"d343bdeb-db6a-4e06-97da-9dafc2d61c60","name":"Read and write risky agents information","description":"Allows the app to read and update identity risky agents information for all agents in your organization on behalf of the signed-in user. Update operations include dismissing risky agents.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identityriskyagent-readwrite-all/"},{"permission":"IdentityRiskyServicePrincipal.Read.All","application":{"id":"607c7344-0eed-41e5-823a-9695ebe1b7b0","name":"Read all identity risky service principal information","description":"Allows the app to read all risky service principal information for your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ea5c4ab0-5a73-4f35-8272-5d5337884e5d","name":"Read all identity risky service principal information","description":"Allows the app to read all identity risky service principal information for your organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identityriskyserviceprincipal-read-all/"},{"permission":"IdentityRiskyServicePrincipal.ReadWrite.All","application":{"id":"cb8d6980-6bcb-4507-afec-ed6de3a2d798","name":"Read and write all identity risky service principal information","description":"Allows the app to read and update identity risky service principal for your organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"bb6f654c-d7fd-4ae3-85c3-fc380934f515","name":"Read and write all identity risky service principal information","description":"Allows the app to read and update identity risky service principal information for all service principals in your organization, on behalf of the signed-in user. Update operations include dismissing risky service principals.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identityriskyserviceprincipal-readwrite-all/"},{"permission":"IdentityRiskyUser.Read.All","application":{"id":"dc5007c0-2d7d-4c42-879c-2dab87571379","name":"Read all identity risky user information","description":"Allows the app to read the identity risky user information for your organization without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"d04bb851-cb7c-4146-97c7-ca3e71baf56c","name":"Read identity risky user information","description":"Allows the app to read identity risky user information for all users in your organization on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identityriskyuser-read-all/"},{"permission":"IdentityRiskyUser.ReadWrite.All","application":{"id":"656f6061-f9fe-4807-9708-6a2e0934df76","name":"Read and write all risky user information","description":"Allows the app to read and update identity risky user information for your organization without a signed-in user.  Update operations include dismissing risky users.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"e0a7cdbb-08b0-4697-8264-0069786e9674","name":"Read and write risky user information","description":"Allows the app to read and update identity risky user information for all users in your organization on behalf of the signed-in user. Update operations include dismissing risky users.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identityriskyuser-readwrite-all/"},{"permission":"IdentityUserFlow.Read.All","application":{"id":"1b0c317f-dd31-4305-9932-259a8b6e8099","name":"Read all identity user flows","description":"Allows the app to read your organization's user flows, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2903d63d-4611-4d43-99ce-a33f3f52e343","name":"Read all identity user flows","description":"Allows the app to read your organization's user flows, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identityuserflow-read-all/"},{"permission":"IdentityUserFlow.ReadWrite.All","application":{"id":"65319a09-a2be-469d-8782-f6b07debf789","name":"Read and write all identity user flows","description":"Allows the app to read or write your organization's user flows, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"281892cc-4dbf-4e3a-b6cc-b21029bb4e82","name":"Read and write all identity user flows","description":"Allows the app to read or write your organization's user flows, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/identityuserflow-readwrite-all/"},{"permission":"IMAP.AccessAsUser.All","application":null,"delegated":{"id":"652390e4-393a-48de-9484-05f9b1212954","name":"Read and write access to mailboxes via IMAP.","description":"Allows the app to have the same access to mailboxes as the signed-in user via IMAP protocol.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/imap-accessasuser-all/"},{"permission":"IndustryData-DataConnector.Read.All","application":{"id":"7ab52c2f-a2ee-4d98-9ebc-725e3934aae2","name":"View data connector definitions","description":"Allows the app to read data connectors without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"d19c0de5-7ecb-4aba-b090-da35ebcd5425","name":"View data connector definitions","description":"Allows the app to read data connectors on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-dataconnector-read-all/"},{"permission":"IndustryData-DataConnector.ReadWrite.All","application":{"id":"eda0971c-482e-4345-b28f-69c309cb8a34","name":"Manage data connector definitions","description":"Allows the app to read and write data connectors without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"5ce933ac-3997-4280-aed0-cc072e5c062a","name":"Manage data connector definitions","description":"Allows the app to read and write data connectors on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-dataconnector-readwrite-all/"},{"permission":"IndustryData-DataConnector.Upload","application":{"id":"9334c44b-a7c6-4350-8036-6bf8e02b4c1f","name":"Upload files to a data connector","description":"Allows the app to upload data files to a data connector without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"fc47391d-ab2c-410f-9059-5600f7af660d","name":"Upload files to a data connector","description":"Allows the app to upload data files to a data connector on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-dataconnector-upload/"},{"permission":"IndustryData-InboundFlow.Read.All","application":{"id":"305f6ba2-049a-4b1b-88bb-fe7e08758a00","name":"View inbound flow definitions","description":"Allows the app to read inbound data flows without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"cb0774da-a605-42af-959c-32f438fb38f4","name":"View inbound flow definitions","description":"Allows the app to read inbound data flows on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-inboundflow-read-all/"},{"permission":"IndustryData-InboundFlow.ReadWrite.All","application":{"id":"e688c61f-d4c6-4d64-a197-3bcf6ba1d6ad","name":"Manage inbound flow definitions","description":"Allows the app to read and write inbound data flows without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"97044676-2cec-40ee-bd70-38df444c9e70","name":"Manage inbound flow definitions","description":"Allows the app to read and write inbound data flows on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-inboundflow-readwrite-all/"},{"permission":"IndustryData-OutboundFlow.Read.All","application":{"id":"61d0354c-5d88-483c-b974-a37ec3395a2c","name":"View outbound flow definitions","description":"Allows the app to read outbound data flows without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"4741a003-8952-4be4-9217-33a0ac327122","name":"View outbound flow definitions","description":"Allows the app to read outbound data flows on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-outboundflow-read-all/"},{"permission":"IndustryData-OutboundFlow.ReadWrite.All","application":{"id":"24a65b4a-e501-47e2-8849-d679517887f0","name":"Manage outbound flow definitions","description":"Allows the app to read and write outbound data flows without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"aeb68e0b-e562-4a1f-b6dd-3484ad0cbb4b","name":"Manage outbound flow definitions","description":"Allows the app to read and write outbound data flows on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-outboundflow-readwrite-all/"},{"permission":"IndustryData-ReferenceDefinition.Read.All","application":{"id":"6ee891c3-74a4-4148-8463-0c834375dfaf","name":"View reference definitions","description":"Allows the app to read reference definitions without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"a3f96ffe-cb84-40a8-ac85-582d7ef97c2a","name":"View reference definitions","description":"Allows the app to read reference definitions on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-referencedefinition-read-all/"},{"permission":"IndustryData-ReferenceDefinition.ReadWrite.All","application":{"id":"bda16293-63d3-45b7-b16b-833841d27d56","name":"Manage reference definitions","description":"Allows the app to read and write reference definitions without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"a757d430-be6d-430f-af57-28aabe79d247","name":"Manage reference definitions","description":"Allows the app to read and write reference definitions on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-referencedefinition-readwrite-all/"},{"permission":"IndustryData-Run.Read.All","application":{"id":"f6f5d10b-3024-4d1d-b674-aae4df4a1a73","name":"View current and previous runs","description":"Allows the app to read current and previous IndustryData runs without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"92685235-50c4-4702-b2c8-36043db6fa79","name":"View current and previous runs","description":"Allows the app to read current and previous IndustryData runs on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-run-read-all/"},{"permission":"IndustryData-Run.Start","application":{"id":"7e429772-5b5e-47c0-8fd6-7279294c8033","name":"View and start runs","description":"Allows the app to view and start IndustryData runs without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"f03a6d0e-0989-460f-80b2-e57c8561763e","name":"View and start runs","description":"Allows the app to view and start IndustryData runs on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-run-start/"},{"permission":"IndustryData-SourceSystem.Read.All","application":{"id":"bc167a60-39fe-4865-8b44-78400fc6ed03","name":"View source system definitions","description":"Allows the app to read source system definitions without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"49b7016c-89ae-41e7-bd6f-b7170c5490bf","name":"View source system definitions","description":"Allows the app to read source system definitions on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-sourcesystem-read-all/"},{"permission":"IndustryData-SourceSystem.ReadWrite.All","application":{"id":"7d866958-e06e-4dd6-91c6-a086b3f5cfeb","name":"Manage source system definitions","description":"Allows the app to read and write source system definitions without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"9599f005-05d6-4ea7-b1b1-4929768af5d0","name":"Manage source system definitions","description":"Allows the app to read and write source system definitions on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-sourcesystem-readwrite-all/"},{"permission":"IndustryData-TimePeriod.Read.All","application":{"id":"7c55c952-b095-4c23-a522-022bce4cc1e3","name":"Read time period definitions","description":"Allows the app to read time period definitions without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"c9d51f28-8ccd-42b2-a836-fd8fe9ebf2ae","name":"Read time period definitions","description":"Allows the app to read time period definitions on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-timeperiod-read-all/"},{"permission":"IndustryData-TimePeriod.ReadWrite.All","application":{"id":"7afa7744-a782-4a32-b8c2-e3db637e8de7","name":"Manage time period definitions","description":"Allows the app to read and write time period definitions without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"b6d56528-3032-4f9d-830f-5a24a25e6661","name":"Manage time period definitions","description":"Allows the app to read and write time period definitions on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-timeperiod-readwrite-all/"},{"permission":"IndustryData.ReadBasic.All","application":{"id":"4f5ac95f-62fd-472c-b60f-125d24ca0bc5","name":"View basic service and resource information","description":"Allows the app to read basic service and resource information without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"60382b96-1f5e-46ea-a544-0407e489e588","name":"Read basic Industry Data service and resource definitions","description":"Allows the app to read basic Industry Data service and resource information on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/industrydata-readbasic-all/"},{"permission":"InfoProtectABACPolicy.Read.All","application":{"id":"66905074-ba83-4bb3-b5a1-1bb769025947","name":"Read all ABAC policies.","description":"Allows the app to read ABAC policies in the organization's policy catalog, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2a75d691-aeca-481b-9112-0df294395d74","name":"Read ABAC policies.","description":"Allows the app to read ABAC policies in the organization's policy catalog, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/infoprotectabacpolicy-read-all/"},{"permission":"InfoProtectABACPolicy.ReadWrite.All","application":{"id":"4bfc1735-3a0c-4602-a159-9cfa07213339","name":"Read and write all ABAC policies.","description":"Allows the app to read and write ABAC policies in the organization's policy catalog, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"30a06a6d-4a75-400f-84a1-13717e5ba7a3","name":"Read and write ABAC policies.","description":"Allows the app to read and write ABAC policies in the organization's policy catalog, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/infoprotectabacpolicy-readwrite-all/"},{"permission":"InfoProtectAttributeAssignment.Read.All","application":{"id":"64e5621c-1c93-43aa-ac76-c58f9fd136c7","name":"Read all information protection attribute assignments.","description":"Allows the app to read ABAC attribute assignments for users, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"53216fbf-d31e-415b-9c4c-486a30f2aa8f","name":"Read information protection attribute assignments.","description":"Allows the app to read ABAC attribute assignments for users, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/infoprotectattributeassignment-read-all/"},{"permission":"InfoProtectAttributeAssignment.ReadWrite.All","application":{"id":"bc81c4f9-5b1f-4107-b330-4665a9cebecf","name":"Read and write all information protection attribute assignments.","description":"Allows the app to read and write ABAC attribute assignments for users, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"82fc7b0a-cdf4-4e5e-98ee-646f5bdd8861","name":"Read and write information protection attribute assignments.","description":"Allows the app to read and write ABAC attribute assignments for users, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/infoprotectattributeassignment-readwrite-all/"},{"permission":"InfoProtectAttributeDefinition.Read.All","application":{"id":"1a8b595b-d654-4a0c-9b37-caf656a24853","name":"Read all information protection attribute definitions.","description":"Allows the app to read information protection attribute definitions in the organization's attribute catalog, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"3f3ad769-005a-4976-869a-71dd9210c3e6","name":"Read information protection attribute definitions.","description":"Allows the app to read information protection attribute definitions in the organization's attribute catalog, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/infoprotectattributedefinition-read-all/"},{"permission":"InfoProtectAttributeDefinition.ReadWrite.All","application":{"id":"7ec4dbde-910f-4bbb-9717-d1cde4470763","name":"Read and write all information protection attribute definitions.","description":"Allows the app to read and write information protection attribute definitions in the organization's attribute catalog, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"09b3ecc2-f2c3-43ea-8131-c6503ed50dd3","name":"Read and write information protection attribute definitions.","description":"Allows the app to read and write information protection attribute definitions in the organization's attribute catalog, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/infoprotectattributedefinition-readwrite-all/"},{"permission":"InformationProtectionConfig.Read","application":null,"delegated":{"id":"12f4bffb-b598-413c-984b-db99728f8b54","name":"Read configurations for protecting organizational data applicable to the user","description":"Allows the app to read the configurations applicable to the signed-in user for protecting organizational data, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/informationprotectionconfig-read/"},{"permission":"InformationProtectionConfig.Read.All","application":{"id":"14f49b9f-4bf2-4d24-b80e-b27ec58409bd","name":"Read all configurations for protecting organizational data applicable to users","description":"Allows the app to read all configurations applicable to users for protecting organizational data, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/informationprotectionconfig-read-all/"},{"permission":"InformationProtectionContent.Sign.All","application":{"id":"cbe6c7e4-09aa-4b8d-b3c3-2dbb59af4b54","name":"Sign digests for data","description":"Allows an app to sign digests for data without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/informationprotectioncontent-sign-all/"},{"permission":"InformationProtectionContent.Write.All","application":{"id":"287bd98c-e865-4e8c-bade-1a85523195b9","name":"Create protected content","description":"Allows the app to create protected content without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/informationprotectioncontent-write-all/"},{"permission":"InformationProtectionPolicy.Read","application":null,"delegated":{"id":"4ad84827-5578-4e18-ad7a-86530b12f884","name":"Read user sensitivity labels and label policies.","description":"Allows an app to read information protection sensitivity labels and label policy settings, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/informationprotectionpolicy-read/"},{"permission":"InformationProtectionPolicy.Read.All","application":{"id":"19da66cb-0fb0-4390-b071-ebc76a349482","name":"Read all published labels and label policies for an organization.","description":"Allows an app to read published sensitivity labels and label policy settings for the entire organization or a specific user, without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/informationprotectionpolicy-read-all/"},{"permission":"Insights-UserMetric.Read.All","application":{"id":"34cbd96c-d824-4755-90d3-1008ef47efc1","name":"Read all user metrics insights","description":"Allows an app to read all user metrics insights, such as daily and monthly active users, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"7d249730-51a3-4180-8ec1-214f144f1bff","name":"Read user metrics insights","description":"Allows an app to read user metrics insights, such as daily and monthly active users, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/insights-usermetric-read-all/"},{"permission":"LearningAssignedCourse.Read","application":null,"delegated":{"id":"ac08cdae-e845-41db-adf9-5899a0ec9ef6","name":"Read user's assignments","description":"Allows the app to read data for the learner's assignments in the organization's directory, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/learningassignedcourse-read/"},{"permission":"LearningAssignedCourse.Read.All","application":{"id":"535e6066-2894-49ef-ab33-e2c6d064bb81","name":"Read all assignments","description":"Allows the app to read data for all assignments in the organization's directory, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/learningassignedcourse-read-all/"},{"permission":"LearningAssignedCourse.ReadWrite.All","application":{"id":"236c1cbd-1187-427f-b0f5-b1852454973b","name":"Read and write all assignments","description":"Allows the app to create, update, read and delete all assignments in the organization's directory, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/learningassignedcourse-readwrite-all/"},{"permission":"LearningContent.Read.All","application":{"id":"8740813e-d8aa-4204-860e-2a0f8f84dbc8","name":"Read all learning content","description":"Allows the app to read all learning content in the organization's directory, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ea4c1fd9-6a9f-4432-8e5d-86e06cc0da77","name":"Read learning content","description":"Allows the app to read learning content in the organization's directory, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/learningcontent-read-all/"},{"permission":"LearningContent.ReadWrite.All","application":{"id":"444d6fcb-b738-41e5-b103-ac4f2a2628a3","name":"Manage all learning content","description":"Allows the app to manage all learning content in the organization's directory, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"53cec1c4-a65f-4981-9dc1-ad75dbf1c077","name":"Manage learning content","description":"Allows the app to manage learning content in the organization's directory, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/learningcontent-readwrite-all/"},{"permission":"LearningProvider.Read","application":null,"delegated":{"id":"dd8ce36f-9245-45ea-a99e-8ac398c22861","name":"Read learning provider","description":"Allows the app to read data for the learning provider in the organization's directory, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/learningprovider-read/"},{"permission":"LearningProvider.ReadWrite","application":null,"delegated":{"id":"40c2eb57-abaf-49f5-9331-e90fd01f7130","name":"Manage learning provider","description":"Allows the app to create, update, read, and delete data for the learning provider in the organization's directory, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/learningprovider-readwrite/"},{"permission":"LearningSelfInitiatedCourse.Read","application":null,"delegated":{"id":"f6403ef7-4a96-47be-a190-69ba274c3f11","name":"Read user's self-initiated courses","description":"Allows the app to read data for the learner's self-initiated courses in the organization's directory, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/learningselfinitiatedcourse-read/"},{"permission":"LearningSelfInitiatedCourse.Read.All","application":{"id":"467524fc-ed22-4356-a910-af61191e3503","name":"Read all self-initiated courses","description":"Allows the app to read data for all self-initiated courses in the organization's directory, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/learningselfinitiatedcourse-read-all/"},{"permission":"LearningSelfInitiatedCourse.ReadWrite.All","application":{"id":"7654ed61-8965-4025-846a-0856ec02b5b0","name":"Read and write all self-initiated courses","description":"Allows the app to create, update, read and delete all self-initiated courses in the organization's directory, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/learningselfinitiatedcourse-readwrite-all/"},{"permission":"LicenseAssignment.Read.All","application":{"id":"e2f98668-2877-4f38-a2f4-8202e0717aa1","name":"Read all license assignments.","description":"Allows an app to read license assignments for users and groups, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"f395577a-0960-456b-979f-7228de0c5996","name":"Read all license assignments.","description":"Allows an app to read license assignments for users and groups, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/licenseassignment-read-all/"},{"permission":"LicenseAssignment.ReadWrite.All","application":{"id":"5facf0c1-8979-4e95-abcf-ff3d079771c0","name":"Manage all license assignments","description":"Allows an app to manage license assignments for users and groups, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"f55016cc-149c-447e-8f21-7cf3ec1d6350","name":"Manage all license assignments","description":"Allows an app to manage license assignments for users and groups, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/licenseassignment-readwrite-all/"},{"permission":"LifecyclePolicies-AgentId.Read.All","application":{"id":"6343d63f-034f-45b5-832d-9f9d7632e182","name":"Read identity lifecycle policies for agent identities","description":"Allows the app to read identity lifecycle policies for agent identities in the organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"65857db0-62ac-4279-aa73-c2b5dab186f5","name":"Read identity lifecycle policies for agent identities","description":"Allows the app to read identity lifecycle policies for agent identities that the signed-in user has access to in the organization.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecyclepolicies-agentid-read-all/"},{"permission":"LifecyclePolicies-AgentId.ReadWrite.All","application":{"id":"00d1c504-8dc7-461b-8a0b-dc15c8f1bd5a","name":"Read and write identity lifecycle policies for agent identities","description":"Allows the app to read, create, update and delete identity lifecycle policies for agent identities in the organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"f2292ca5-46fc-4195-9b4d-16491bf9bf7f","name":"Read and write identity lifecycle policies for agent identities","description":"Allows the app to read, create, update and delete identity lifecycle policies for agent identities that the signed-in user has access to in the organization.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecyclepolicies-agentid-readwrite-all/"},{"permission":"LifecyclePolicies-Guests.Read.All","application":null,"delegated":{"id":"1bbb7916-b98a-449f-8ee4-c68bfcba5724","name":"Read identity lifecycle policies for external guests","description":"Allows the app to read identity lifecycle policies for external guests on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecyclepolicies-guests-read-all/"},{"permission":"LifecyclePolicies-Guests.ReadWrite.All","application":null,"delegated":{"id":"d9ec82ed-63db-4905-b1b3-859b74d2bbf5","name":"Read and write identity lifecycle policies for external guests","description":"Allows the app to create, update, and delete identity lifecycle policies for external guests on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecyclepolicies-guests-readwrite-all/"},{"permission":"LifecycleWorkflows-CustomExt.Read.All","application":{"id":"2cb19e7d-9012-40bf-9a22-69fc776af8b0","name":"Read all Lifecycle workflows custom task extensionss","description":"Allows the app to read all Lifecycle workflows custom task extensions without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2973a298-1d69-4f87-8d30-7025f0ec19d7","name":"Read all Lifecycle workflows custom task extensions","description":"Allows the app to read all Lifecycle workflows custom task extensions on behalf of a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecycleworkflows-customext-read-all/"},{"permission":"LifecycleWorkflows-CustomExt.ReadWrite.All","application":{"id":"3351c766-bacc-4d93-94fa-f2c8b1986ee7","name":"Read and write all Lifecycle workflows custom task extensions","description":"Allows the app to create, update, list, read and delete all Lifecycle workflows custom task extensions without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"ef6bafb1-3019-4a22-a332-103aff92225f","name":"Read and write all Lifecycle workflows custom task extensions","description":"Allows the app to create, update, list, read and delete all Lifecycle workflows custom task extensions on behalf of a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecycleworkflows-customext-readwrite-all/"},{"permission":"LifecycleWorkflows-Reports.Read.All","application":{"id":"fe615156-48b5-4c83-b613-e6e31a43c446","name":"Read all Lifecycle workflows reports","description":"Allows the app to read all Lifecycle workflows reports without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"4d3d7f81-163f-426a-8432-5638d2e82083","name":"Read all Lifecycle workflows reports","description":"Allows the app to read all Lifecycle workflows reports on behalf of a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecycleworkflows-reports-read-all/"},{"permission":"LifecycleWorkflows-Workflow.Activate","application":{"id":"3a87a643-13d2-47aa-8d6a-b0a8377cb03b","name":"Run workflows on-demand in Lifecycle workflows","description":"Allows the app run workflows on-demand without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"df1c25b3-072c-45cd-8403-c63441e4cca1","name":"Run workflows on-demand in Lifecycle workflows","description":"Allows the app to run workflows on-demand on behalf of a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecycleworkflows-workflow-activate/"},{"permission":"LifecycleWorkflows-Workflow.Read.All","application":{"id":"03b0ad3e-fc2b-4ef1-b0ff-252e865cb608","name":"Read all workflows in Lifecycle workflows","description":"Allows the app to list and read all workflows and tasks without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"7fabe5bd-2e47-4e61-b924-327117024e18","name":"Read all workflows in Lifecycle workflows","description":"Allows the app to list and read all workflows and tasks on behalf of a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecycleworkflows-workflow-read-all/"},{"permission":"LifecycleWorkflows-Workflow.ReadBasic.All","application":{"id":"021ea6db-c06b-45c6-8c9c-c1cd9a37a483","name":"List all workflows in Lifecycle workflows","description":"Allows the app to list all workflows without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"789c445d-433c-4575-a1fc-367a58a1bd4a","name":"List all workflows in Lifecycle workflows","description":"Allows the app to list all workflows on behalf of a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecycleworkflows-workflow-readbasic-all/"},{"permission":"LifecycleWorkflows-Workflow.ReadWrite.All","application":{"id":"94c88098-1d9d-4c42-a356-4d5a95312554","name":"Read and write all workflows in Lifecycle workflows","description":"Allows the app to create, update, list, read and delete all workflows and tasks in lifecycle workflows without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"29e49f0c-a053-4cc5-a4b1-7da0c8c1e643","name":"Read and write all workflows in Lifecycle workflows","description":"Allows the app to create, update, list, read and delete all workflows and tasks in lifecycle workflows on behalf of a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecycleworkflows-workflow-readwrite-all/"},{"permission":"LifecycleWorkflows.Read.All","application":{"id":"7c67316a-232a-4b84-be22-cea2c0906404","name":"Read all lifecycle workflows resources","description":"Allows the app to list and read all workflows, tasks and related lifecycle workflows resources without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9bcb9916-765a-42af-bf77-02282e26b01a","name":"Read all lifecycle workflows resources","description":"Allows the app to list and read all workflows, tasks and related lifecycle workflows resources on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecycleworkflows-read-all/"},{"permission":"LifecycleWorkflows.ReadWrite.All","application":{"id":"5c505cf4-8424-4b8e-aa14-ee06e3bb23e3","name":"Read and write all lifecycle workflows resources","description":"Allows the app to create, update, list, read and delete all workflows, tasks and related lifecycle workflows resources without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"84b9d731-7db8-4454-8c90-fd9e95350179","name":"Read and write all lifecycle workflows resources","description":"Allows the app to create, update, list, read and delete all workflows, tasks and related lifecycle workflows resources on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lifecycleworkflows-readwrite-all/"},{"permission":"ListItems.SelectedOperations.Selected","application":{"id":"de4e4161-a10a-4dfd-809c-e328d89aefeb","name":"Access selected ListItems without a signed in user.","description":"Allow the application to access a subset of listitems without a signed in user.  The specific listitems and the permissions granted will be configured in SharePoint Online.","adminConsent":true,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"delegated":{"id":"d6d361b3-211a-4191-9fa7-15f72de4aac4","name":"Access selected ListItems, on behalf of the signed-in user","description":"Allow the application to access a subset of listitems on behalf of the signed in user.  The specific listitems and the permissions granted will be configured in SharePoint Online.","adminConsent":true,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/listitems-selectedoperations-selected/"},{"permission":"Lists.SelectedOperations.Selected","application":{"id":"23c5a9bd-d900-4ecf-be26-a0689755d9e5","name":"Access selected Lists without a signed in user.","description":"Allow the application to access a subset of lists without a signed in user.  The specific lists and the permissions granted will be configured in SharePoint Online.","adminConsent":true,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"delegated":{"id":"033b51ee-d6fa-4add-b627-ee680c7212b5","name":"Access selected Lists, on behalf of the signed-in user","description":"Allow the application to access a subset of lists on behalf of the signed in user.  The specific lists and the permissions granted will be configured in SharePoint Online.","adminConsent":true,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lists-selectedoperations-selected/"},{"permission":"LockboxRequest.Read.All","application":null,"delegated":{"id":"a368a3ce-713b-46d9-9c93-bb559acf38ca","name":"Read lockbox requests","description":"Allows the app to read lockbox requests on behalf of the signed-in user","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lockboxrequest-read-all/"},{"permission":"LockboxRequest.ReadWrite.All","application":null,"delegated":{"id":"524d6259-f823-43c4-964a-97e3b8ddb56c","name":"Read and manage lockbox requests","description":"Allows the app to read and manage lockbox requests on behalf of the signed-in user","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lockboxrequest-readwrite-all/"},{"permission":"LockboxSettings.Read.All","application":null,"delegated":{"id":"2ea429a7-d1fa-4f96-b451-e91ecc5e5fe2","name":"Read lockbox settings","description":"Allows the app to read lockbox configuration settings on behalf of the signed-in user","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lockboxsettings-read-all/"},{"permission":"LockboxSettings.ReadWrite.All","application":null,"delegated":{"id":"bdc52289-9ed7-4339-83ab-772ae618713c","name":"Read and write lockbox settings","description":"Allows the app to read and modify lockbox configuration settings on behalf of the signed-in user","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/lockboxsettings-readwrite-all/"},{"permission":"Mail-Advanced.ReadWrite","application":null,"delegated":{"id":"f3af82f6-18e0-4a41-8dc8-a03c11854a8d","name":"Read and write the user's mail, including modifying existing non-draft mails","description":"Allows the app to create, read, update, and delete email, including contents of non-draft emails in user mailboxes, on behalf of the signed-in user. Does not include permission to send mail.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mail-advanced-readwrite/"},{"permission":"Mail-Advanced.ReadWrite.All","application":{"id":"e118f1da-5c1c-46cf-bff6-8858d786f46f","name":"Read and write mail in all mailboxes, including modifying existing non-draft mails","description":"Allows the app to create, read, update, and delete all email, including contents of non-draft emails in user mailboxes, without a signed-in user. Does not include permission to send mail.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mail-advanced-readwrite-all/"},{"permission":"Mail-Advanced.ReadWrite.Shared","application":null,"delegated":{"id":"bebf0bb6-2ff3-4295-a17d-f3561da294fb","name":"Read and write all mail the user can access, including modifying existing non-draft mails","description":"Allows the app to create, read, update, and delete mail including contents of non-draft emails for all mails a user has permission to access, on behalf of the signed-in user. This includes their own and shared mail. Does not include permission to send mail.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mail-advanced-readwrite-shared/"},{"permission":"Mail.Read","application":{"id":"810c84a8-4a9e-49e6-bf7d-12d183f40d01","name":"Read mail in all mailboxes","description":"Allows the app to read mail in all mailboxes without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"570282fd-fa5c-430d-a7fd-fc8dc98a9dca","name":"Read user mail ","description":"Allows the app to read the signed-in user's mailbox.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":"If you only need headers and metadata, use Mail.ReadBasic. For application permissions, limit which mailboxes the app can reach with Exchange Online RBAC for applications.","url":"https://azureblog.co.uk/graph-permissions/mail-read/"},{"permission":"Mail.Read.Shared","application":null,"delegated":{"id":"7b9103a5-4610-446b-9670-80643382c1fa","name":"Read user and shared mail","description":"Allows the app to read mail a user can access, including their own and shared mail.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mail-read-shared/"},{"permission":"Mail.ReadBasic","application":{"id":"6be147d2-ea4f-4b5a-a3fa-3eab6f3c140a","name":"Read basic mail in all mailboxes","description":"Allows the app to read basic mail properties in all mailboxes without a signed-in user. Includes all properties except body, previewBody, attachments and any extended properties.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"a4b8392a-d8d1-4954-a029-8e668a39a170","name":"Read user basic mail","description":"Allows the app to read email in the signed-in user's mailbox except body, previewBody, attachments and any extended properties.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mail-readbasic/"},{"permission":"Mail.ReadBasic.All","application":{"id":"693c5e45-0940-467d-9b8a-1022fb9d42ef","name":"Read basic mail in all mailboxes","description":"Allows the app to read basic mail properties in all mailboxes without a signed-in user. Includes all properties except body, previewBody, attachments and any extended properties.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mail-readbasic-all/"},{"permission":"Mail.ReadBasic.Shared","application":null,"delegated":{"id":"b11fa0e7-fdb7-4dc9-b1f1-59facd463480","name":"Read user and shared basic mail","description":"Allows the app to read mail the signed-in user can access, including their own and shared mail, except for body, bodyPreview, uniqueBody, attachments, extensions, and any extended properties.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mail-readbasic-shared/"},{"permission":"Mail.ReadWrite","application":{"id":"e2a3a72e-5f79-4c64-b1b1-878b674786c9","name":"Read and write mail in all mailboxes","description":"Allows the app to create, read, update, and delete mail in all mailboxes without a signed-in user. Does not include permission to send mail.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"024d486e-b451-40bb-833d-3e66d98c5c73","name":"Read and write access to user mail ","description":"Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":"For application permissions, limit which mailboxes the app can reach with Exchange Online RBAC for applications.","url":"https://azureblog.co.uk/graph-permissions/mail-readwrite/"},{"permission":"Mail.ReadWrite.Shared","application":null,"delegated":{"id":"5df07973-7d5d-46ed-9847-1271055cbd51","name":"Read and write user and shared mail","description":"Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mail-readwrite-shared/"},{"permission":"Mail.Send","application":{"id":"b633e1c5-b582-4048-a93e-9f11b44c7e96","name":"Send mail as any user","description":"Allows the app to send mail as any user without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"e383f46e-2787-4529-855e-0e479a3ffac0","name":"Send mail as a user ","description":"Allows the app to send mail as users in the organization.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":"For application permissions, limit which mailboxes can be sent from with Exchange Online RBAC for applications.","url":"https://azureblog.co.uk/graph-permissions/mail-send/"},{"permission":"Mail.Send.Shared","application":null,"delegated":{"id":"a367ab51-6b49-43bf-a716-a1fb06d2a174","name":"Send mail on behalf of others","description":"Allows the app to send mail as the signed-in user, including sending on-behalf of others.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mail-send-shared/"},{"permission":"MailboxConfigItem.Read","application":{"id":"27d9d776-f4d2-426d-80ad-5f22f2b01b0a","name":"Read all users' UserConfiguration objects","description":"Allows the app to read all users' UserConfiguration objects.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"dce2e6fc-0f4b-40da-94e2-14b4477f3d92","name":"Read user's UserConfiguration objects","description":"Allows the app to read user's UserConfiguration objects, on behalf of the the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxconfigitem-read/"},{"permission":"MailboxConfigItem.ReadWrite","application":{"id":"aa6d92d4-b25a-4640-aefe-3e3231e5e736","name":"Read and write all users' UserConfiguration objects","description":"Allows the app to create, read, update and delete all users' UserConfiguration objects.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"7d461784-7715-4b09-9f90-91a6d8722652","name":"Read and write user's UserConfiguration objects","description":"Allows the app to create, read, update and delete user's UserConfiguration objects, on behalf of the the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxconfigitem-readwrite/"},{"permission":"MailboxFolder.Read","application":null,"delegated":{"id":"52dc2051-4958-4636-8f2a-281d39c6981c","name":"Read a user's mailbox folders","description":"Allows the app to read the user's mailbox folders, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxfolder-read/"},{"permission":"MailboxFolder.Read.All","application":{"id":"99280d24-a782-4793-93cc-0888549957f6","name":"Read all the users' mailbox folders","description":"Allows the app to read all the users' mailbox folders, without signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxfolder-read-all/"},{"permission":"MailboxFolder.ReadWrite","application":null,"delegated":{"id":"077fde41-7e0b-4c5b-bcd1-e9d743a30c80","name":"Read and write a user's mailbox folders","description":"Allows the app to read and write the user's mailbox folders, on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxfolder-readwrite/"},{"permission":"MailboxFolder.ReadWrite.All","application":{"id":"fef87b92-8391-4589-9da7-eb93dab7dc8a","name":"Read and write all the users' mailbox folders","description":"Allows the app to read and write all the users' mailbox folders, without signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxfolder-readwrite-all/"},{"permission":"MailboxItem.Export","application":null,"delegated":{"id":"58d3e7fa-3ce9-4a0c-9baa-0971f64709d9","name":"Export a user's mailbox items","description":"Allows the app to export the user's mailbox items, on behalf of the the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxitem-export/"},{"permission":"MailboxItem.Export.All","application":{"id":"937550e9-33a3-494b-88ae-d9cd394b1fbb","name":"Export all the users' mailbox items","description":"Allows the app to export all the users' mailbox items, without signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxitem-export-all/"},{"permission":"MailboxItem.ImportExport","application":null,"delegated":{"id":"df96e8a0-f4e1-4ecf-8d83-a429f822cbd6","name":"Export and import a user's mailbox items","description":"Allows the app to export and import the user's mailbox items, on behalf of the the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxitem-importexport/"},{"permission":"MailboxItem.ImportExport.All","application":{"id":"76577085-e73d-4f1d-b26a-85fb33892327","name":"Export and import all the users' mailbox items","description":"Allows the app to export and import all the users' mailbox items, without signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxitem-importexport-all/"},{"permission":"MailboxItem.Read","application":null,"delegated":{"id":"82305458-296d-4edd-8b0b-74dd74c34526","name":"Read a user's mailbox items","description":"Allows the app to read the user's mailbox items, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxitem-read/"},{"permission":"MailboxItem.Read.All","application":{"id":"7d9f353d-a7bd-4fbb-822a-26d5dd39a3ce","name":"Read all the users' mailbox items","description":"Allows the app to read all the users' mailbox items, without signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxitem-read-all/"},{"permission":"MailboxItem.ReadWrite","application":null,"delegated":{"id":"ec1ade38-5268-4bc8-87fa-b230e42f7a88","name":"Read and write your mailbox items","description":"Allows the app to read, write, and delete the user's mailbox items, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxitem-readwrite/"},{"permission":"MailboxItem.ReadWrite.All","application":{"id":"1583d471-fede-4e7c-b062-57e9d60cfb49","name":"Read and write all users' mailbox items","description":"Allows the app to read, write, and delete all users' mailbox items, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxitem-readwrite-all/"},{"permission":"MailboxSettings.Read","application":{"id":"40f97065-369a-49f4-947c-6a255697ae91","name":"Read all user mailbox settings","description":"Allows the app to read user's mailbox settings without a signed-in user. Does not include permission to send mail.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"87f447af-9fa4-4c32-9dfa-4a57a73d18ce","name":"Read user mailbox settings","description":"Allows the app to the read user's mailbox settings. Does not include permission to send mail.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxsettings-read/"},{"permission":"MailboxSettings.ReadWrite","application":{"id":"6931bccd-447a-43d1-b442-00a195474933","name":"Read and write all user mailbox settings","description":"Allows the app to create, read, update, and delete user's mailbox settings without a signed-in user. Does not include permission to send mail.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"818c620a-27a9-40bd-a6a5-d96f7d610b4b","name":"Read and write user mailbox settings","description":"Allows the app to create, read, update, and delete user's mailbox settings. Does not include permission to send mail.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailboxsettings-readwrite/"},{"permission":"MailTips.ReadBasic.All","application":{"id":"a2c9652d-4d7f-4e4e-9d75-ac32fdc6f413","name":"Read mail tips for all users","description":"Allows the app to read mail tips for all users in the organization without a signed-in user. Mail tips include automatic replies, mailbox status, custom tips, and delivery information.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailtips-readbasic-all/"},{"permission":"MailTips.ReadBasic.Shared","application":null,"delegated":{"id":"4776cae1-54bd-4dfd-823c-e5861ed49a98","name":"Read mail tips for mailboxes you can access","description":"Allows the app to read mail tips on behalf of the signed-in user for mailboxes they have access to. Mail tips include automatic replies, mailbox status, custom tips, and delivery information.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mailtips-readbasic-shared/"},{"permission":"ManagedTenants.Read.All","application":null,"delegated":{"id":"dc34164e-6c4a-41a0-be89-3ae2fbad7cd3","name":"Read all managed tenant information","description":"Allows the app to read all managed tenant information on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/managedtenants-read-all/"},{"permission":"ManagedTenants.ReadWrite.All","application":null,"delegated":{"id":"b31fa710-c9b3-4d9e-8f5e-8036eecddab9","name":"Read and write all managed tenant information","description":"Allows the app to read and write all managed tenant information on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/managedtenants-readwrite-all/"},{"permission":"Member.Read.Hidden","application":{"id":"658aa5d8-239f-45c4-aa12-864f4fc7e490","name":"Read all hidden memberships","description":"Allows the app to read the memberships of hidden groups and administrative units without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"f6a3db3e-f7e8-4ed2-a414-557c8c9830be","name":"Read hidden memberships","description":"Allows the app to read the memberships of hidden groups and administrative units on behalf of the signed-in user, for those hidden groups and administrative units that the signed-in user has access to.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/member-read-hidden/"},{"permission":"MultiTenantOrganization.Read.All","application":{"id":"4f994bc0-31bb-44bb-b480-7a7c1be8c02e","name":"Read all multi-tenant organization details and tenants","description":"Allows the app to read all multi-tenant organization details and tenants, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"526aa72a-5878-49fe-bf4e-357973af9b06","name":"Read multi-tenant organization details and tenants","description":"Allows the app to read multi-tenant organization details and tenants on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/multitenantorganization-read-all/"},{"permission":"MultiTenantOrganization.ReadBasic.All","application":{"id":"f9c2b2a7-3895-4b2e-80f6-c924b456e50b","name":"Read multi-tenant organization basic details and active tenants","description":"Allows the app to read multi-tenant organization basic details and active tenants, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"225db56b-15b2-4daa-acb3-0eec2bbe4849","name":"Read multi-tenant organization basic details and active tenants","description":"Allows the app to read multi-tenant organization basic details and active tenants on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/multitenantorganization-readbasic-all/"},{"permission":"MultiTenantOrganization.ReadWrite.All","application":{"id":"920def01-ca61-4d2d-b3df-105b46046a70","name":"Read and write all multi-tenant organization details and tenants","description":"Allows the app to read and write all multi-tenant organization details and tenants, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"77af1528-84f3-4023-8d90-d219cd433108","name":"Read and write multi-tenant organization details and tenants","description":"Allows the app to read and write multi-tenant organization details and tenants on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/multitenantorganization-readwrite-all/"},{"permission":"MutualTlsOauthConfiguration.Read.All","application":{"id":"6daaff82-2880-496d-9d80-57e8e31195e2","name":"Read all configurations used for mutual-TLS client authentication.","description":"Allows the app to read configuration used for OAuth 2.0 mutual-TLS client authentication, without a signed-in user. This includes reading trusted certificate authorities.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"51ae584e-e736-4718-897b-10af70f8e3cc","name":"Read all configurations used for mutual-TLS client authentication.","description":"Allows the app to read configuration used for OAuth 2.0 mutual-TLS client authentication, on behalf of the signed-in user. This includes reading trusted certificate authorities.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mutualtlsoauthconfiguration-read-all/"},{"permission":"MutualTlsOauthConfiguration.ReadWrite.All","application":{"id":"78bbf8cf-07d8-45ba-b0eb-1a7b48efbcf1","name":"Read and write all configurations used for mutual-TLS client authentication.","description":"Allows the app to read and update configuration used for OAuth 2.0 mutual-TLS client authentication, without a signed-in user. This includes reading and updating trusted certificate authorities.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"a51115bc-f64f-498f-bcee-00dcd28f4a03","name":"Read and write all configurations used for mutual-TLS client authentication.","description":"Allows the app to read and update configuration used for OAuth 2.0 mutual-TLS client authentication, on behalf of the signed-in user. This includes adding and updating trusted certificate authorities.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/mutualtlsoauthconfiguration-readwrite-all/"},{"permission":"NetworkAccess-Reports.Read.All","application":{"id":"40049381-3cc1-42af-94ec-5ce755db4b0d","name":"Read all network access reports","description":"Allows the app to read all network access reports without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"b0c61509-cfc3-42bd-9bd4-66d81785fee4","name":"Read all network access reports","description":"Allows the app to read all network access reports on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/networkaccess-reports-read-all/"},{"permission":"NetworkAccess.Read.All","application":{"id":"e30060de-caa5-4331-99d3-6ac6c966a9a4","name":"Read all network access information","description":"Allows the app to read all network access information and configuration settings without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2f7013e0-ab4e-447f-a5e1-5d419950692d","name":"Read all network access information","description":"Allows the app to read all network access information on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/networkaccess-read-all/"},{"permission":"NetworkAccess.ReadWrite.All","application":{"id":"b10642fc-a6cf-4c46-87f9-e1f96c2a18aa","name":"Read and write all network access information","description":"Allows the app to read and write all network access information and configuration settings without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"ae2df9c5-f18d-4ec4-a51b-bdeb807f177b","name":"Read and write all network access information","description":"Allows the app to read and write all network access information and configuration settings on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/networkaccess-readwrite-all/"},{"permission":"NetworkAccessBranch.Read.All","application":{"id":"39ae4a24-1ef0-49e8-9d63-2a66f5c39edd","name":"Read properties of all branches for network access","description":"Allows the app to read your organization's network access branches, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"4051c7fc-b429-4804-8d80-8f1f8c24a6f7","name":"Read properties of branches for network access","description":"Allows the app to read your organization's branches for network access on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/networkaccessbranch-read-all/"},{"permission":"NetworkAccessBranch.ReadWrite.All","application":{"id":"8137102d-ec16-4191-aaf8-7aeda8026183","name":"Read and write properties of all branches for network access","description":"Allows the app to read and write your organization's network access branches, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"b8a36cc2-b810-461a-baa4-a7281e50bd5c","name":"Read and write properties of branches for network access","description":"Allows the app to read and write your organization's branches for network access on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/networkaccessbranch-readwrite-all/"},{"permission":"NetworkAccessPolicy.Read.All","application":{"id":"8a3d36bf-cb46-4bcc-bec9-8d92829dab84","name":"Read all security and routing policies for network access","description":"Allows the app to read your organization's network access policies, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ba22922b-752c-446f-89d7-a2d92398fceb","name":"Read security and routing policies for network access","description":"Allows the app to read your organization's security and routing network access policies on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/networkaccesspolicy-read-all/"},{"permission":"NetworkAccessPolicy.ReadWrite.All","application":{"id":"f0c341be-8348-4989-8e43-660324294538","name":"Read and write all security and routing policies for network access","description":"Allows the app to read and write your organization's network access policies, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"b1fbad0f-ef6e-42ed-8676-bca7fa3e7291","name":"Read and write security and routing policies for network access","description":"Allows the app to read and write your organization's security and routing network access policies on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/networkaccesspolicy-readwrite-all/"},{"permission":"Notes.Create","application":null,"delegated":{"id":"9d822255-d64d-4b7a-afdb-833b9a97ed02","name":"Create user OneNote notebooks","description":"Allows the app to read the titles of OneNote notebooks and sections and to create new pages, notebooks, and sections on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/notes-create/"},{"permission":"Notes.Read","application":null,"delegated":{"id":"371361e4-b9e2-4a3f-8315-2a301a3b0a3d","name":"Read user OneNote notebooks","description":"Allows the app to read OneNote notebooks on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/notes-read/"},{"permission":"Notes.Read.All","application":{"id":"3aeca27b-ee3a-4c2b-8ded-80376e2134a4","name":"Read all OneNote notebooks","description":"Allows the app to read all the OneNote notebooks in your organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"dfabfca6-ee36-4db2-8208-7a28381419b3","name":"Read all OneNote notebooks that user can access","description":"Allows the app to read OneNote notebooks that the signed-in user has access to in the organization.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/notes-read-all/"},{"permission":"Notes.ReadWrite","application":null,"delegated":{"id":"615e26af-c38a-4150-ae3e-c3b0d4cb1d6a","name":"Read and write user OneNote notebooks","description":"Allows the app to read, share, and modify OneNote notebooks on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/notes-readwrite/"},{"permission":"Notes.ReadWrite.All","application":{"id":"0c458cef-11f3-48c2-a568-c66751c238c0","name":"Read and write all OneNote notebooks","description":"Allows the app to read all the OneNote notebooks in your organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"64ac0503-b4fa-45d9-b544-71a463f05da0","name":"Read and write all OneNote notebooks that user can access","description":"Allows the app to read, share, and modify OneNote notebooks that the signed-in user has access to in the organization.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/notes-readwrite-all/"},{"permission":"Notes.ReadWrite.CreatedByApp","application":null,"delegated":{"id":"ed68249d-017c-4df5-9113-e684c7f8760b","name":"Limited notebook access (deprecated)","description":"This is deprecated!  Do not use! This permission no longer has any effect. You can safely consent to it. No additional privileges will be granted to the app.","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/notes-readwrite-createdbyapp/"},{"permission":"Notifications.ReadWrite.CreatedByApp","application":null,"delegated":{"id":"89497502-6e42-46a2-8cb2-427fd3df970a","name":"Deliver and manage user notifications for this app","description":"Allows the app to deliver its notifications on behalf of signed-in users. Also allows the app to read, update, and delete the user's notification items for this app.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/notifications-readwrite-createdbyapp/"},{"permission":"offline_access","application":null,"delegated":{"id":"7427e0e9-2fba-42fe-b0c0-848c9e6a8182","name":"Maintain access to data you have given it access to","description":"Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions.","adminConsent":false,"risk":"Low","riskReason":"Basic sign-in and profile information."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/offline-access/"},{"permission":"OnlineMeetingAiInsight.Read.All","application":{"id":"c0cf7895-985f-42d4-a693-b618f36674ad","name":"Read all AI Insights for online meetings.","description":"Allows the app to read all AI Insights for all online meetings, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"166741d6-eeb8-46fe-91f4-817d2af7bc88","name":"Read all AI Insights for online meetings.","description":"Allows the app to read all AI Insights for online meetings, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/onlinemeetingaiinsight-read-all/"},{"permission":"OnlineMeetingAiInsight.Read.Chat","application":{"id":"01892c31-3b66-4bcf-b5f5-bf0a03d5ed9f","name":"Read all AI Insights for online meetings where the Teams application is installed.","description":"Allows the teams-app to read all aiInsights for online meetings where the Teams-app is installed, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/onlinemeetingaiinsight-read-chat/"},{"permission":"OnlineMeetingArtifact.Read.All","application":{"id":"df01ed3b-eb61-4eca-9965-6b3d789751b2","name":"Read online meeting artifacts","description":"Allows the app to read online meeting artifacts in your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"110e5abb-a10c-4b59-8b55-9b4daa4ef743","name":"Read user's online meeting artifacts","description":"Allows the app to read online meeting artifacts on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/onlinemeetingartifact-read-all/"},{"permission":"OnlineMeetingRecording.Read.All","application":{"id":"a4a08342-c95d-476b-b943-97e100569c8d","name":"Read all recordings of online meetings.","description":"Allows the app to read all recordings of all online meetings, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"190c2bb6-1fdd-4fec-9aa2-7d571b5e1fe3","name":"Read all recordings of online meetings.","description":"Allows the app to read all recordings of online meetings, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/onlinemeetingrecording-read-all/"},{"permission":"OnlineMeetings.Read","application":null,"delegated":{"id":"9be106e1-f4e3-4df5-bdff-e4bc531cbe43","name":"Read user's online meetings","description":"Allows the app to read online meeting details on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/onlinemeetings-read/"},{"permission":"OnlineMeetings.Read.All","application":{"id":"c1684f21-1984-47fa-9d61-2dc8c296bb70","name":"Read online meeting details","description":"Allows the app to read online meeting details in your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/onlinemeetings-read-all/"},{"permission":"OnlineMeetings.ReadWrite","application":null,"delegated":{"id":"a65f2972-a4f8-4f5e-afd7-69ccb046d5dc","name":"Read and create user's online meetings","description":"Allows the app to read and create online meetings on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/onlinemeetings-readwrite/"},{"permission":"OnlineMeetings.ReadWrite.All","application":{"id":"b8bb2037-6e08-44ac-a4ea-4674e010e2a4","name":"Read and create online meetings","description":"Allows the app to read and create online meetings as an application in your organization.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/onlinemeetings-readwrite-all/"},{"permission":"OnlineMeetingTranscript.Read.All","application":{"id":"a4a80d8d-d283-4bd8-8504-555ec3870630","name":"Read all transcripts of online meetings.","description":"Allows the app to read all transcripts of all online meetings, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"30b87d18-ebb1-45db-97f8-82ccb1f0190c","name":"Read all transcripts of online meetings.","description":"Allows the app to read all transcripts of online meetings, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/onlinemeetingtranscript-read-all/"},{"permission":"OnPremDirectorySynchronization.Read.All","application":{"id":"bb70e231-92dc-4729-aff5-697b3f04be95","name":"Read all on-premises directory synchronization information","description":"Allows the app to read all on-premises directory synchronization information for the organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"f6609722-4100-44eb-b747-e6ca0536989d","name":"Read all on-premises directory synchronization information","description":"Allows the app to read all on-premises directory synchronization information for the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/onpremdirectorysynchronization-read-all/"},{"permission":"OnPremDirectorySynchronization.ReadWrite.All","application":{"id":"c22a92cc-79bf-4bb1-8b6c-e0a05d3d80ce","name":"Read and write all on-premises directory synchronization information","description":"Allows the app to read and write all on-premises directory synchronization information for the organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"c2d95988-7604-4ba1-aaed-38a5f82a51c7","name":"Read and write all on-premises directory synchronization information","description":"Allows the app to read and write all on-premises directory synchronization information for the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/onpremdirectorysynchronization-readwrite-all/"},{"permission":"OnPremisesPublishingProfiles.ReadWrite.All","application":{"id":"0b57845e-aa49-4e6f-8109-ce654fffa618","name":"Manage on-premises published resources","description":"Allows the app to create, view, update and delete on-premises published resources, on-premises agents and agent groups, as part of a hybrid identity configuration, without a signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"8c4d5184-71c2-4bf8-bb9d-bc3378c9ad42","name":"Manage on-premises published resources","description":"Allows the app to manage hybrid identity service configuration by creating, viewing, updating and deleting on-premises published resources, on-premises agents and agent groups, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/onpremisespublishingprofiles-readwrite-all/"},{"permission":"openid","application":null,"delegated":{"id":"37f7f235-527c-4136-accd-4a02d197296e","name":"Sign users in","description":"Allows users to sign in to the app with their work or school accounts and allows the app to see basic user profile information.","adminConsent":false,"risk":"Low","riskReason":"Basic sign-in and profile information."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/openid/"},{"permission":"Organization.Read.All","application":{"id":"498476ce-e0fe-48b0-b801-37ba7e2685c6","name":"Read organization information","description":"Allows the app to read the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"4908d5b9-3fb2-4b1e-9336-1888b7937185","name":"Read organization information","description":"Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed skus and tenant branding information.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/organization-read-all/"},{"permission":"Organization.ReadWrite.All","application":{"id":"292d869f-3427-49a8-9dab-8c70152b74e9","name":"Read and write organization information","description":"Allows the app to read and write the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"46ca0847-7e6b-426e-9775-ea810a948356","name":"Read and write organization information","description":"Allows the app to read and write the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed skus and tenant branding information.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/organization-readwrite-all/"},{"permission":"OrganizationalBranding.Read.All","application":{"id":"eb76ac34-0d62-4454-b97c-185e4250dc20","name":"Read organizational branding information","description":"Allows the app to read the organizational branding information, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9082f138-6f02-4f3a-9f4d-5f3c2ce5c688","name":"Read organizational branding information","description":"Allows the app to read the organizational branding information, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/organizationalbranding-read-all/"},{"permission":"OrganizationalBranding.ReadWrite.All","application":{"id":"d2ebfbc1-a5f8-424b-83a6-56ab5927a73c","name":"Read and write organizational branding information","description":"Allows the app to read and write the organizational branding information, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"15ce63de-b141-4c9a-a9a5-241bf27c6aaf","name":"Read and write organizational branding information","description":"Allows the app to read and write the organizational branding information, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/organizationalbranding-readwrite-all/"},{"permission":"OrgContact.Read.All","application":{"id":"e1a88a34-94c4-4418-be12-c87b00e26bea","name":"Read organizational contacts","description":"Allows the app to read all organizational contacts without a signed-in user.  These contacts are managed by the organization and are different from a user's personal contacts.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"08432d1b-5911-483c-86df-7980af5cdee0","name":"Read organizational contacts","description":"Allows the app to read all organizational contacts on behalf of the signed-in user.  These contacts are managed by the organization and are different from a user's personal contacts.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/orgcontact-read-all/"},{"permission":"OrgSettings-AppsAndServices.Read.All","application":{"id":"56c84fa9-ea1f-4a15-90f2-90ef41ece2c9","name":"Read organization-wide apps and services settings","description":"Allows the app to read organization-wide apps and services settings, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"1e9b7a7e-4d64-44ff-acf5-2e9651c1519f","name":"Read organization-wide apps and services settings","description":"Allows the app to read organization-wide apps and services settings on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/orgsettings-appsandservices-read-all/"},{"permission":"OrgSettings-AppsAndServices.ReadWrite.All","application":{"id":"4a8e4191-c1c8-45f8-b801-f9a1a5ee6ad3","name":"Read and write organization-wide apps and services settings","description":"Allows the app to read and write organization-wide apps and services settings, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"c167b0e7-47c0-48e8-9eee-9892f58018fa","name":"Read and write organization-wide apps and services settings","description":"Allows the app to read and write organization-wide apps and services settings on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/orgsettings-appsandservices-readwrite-all/"},{"permission":"OrgSettings-DynamicsVoice.Read.All","application":{"id":"c18ae2dc-d9f3-4495-a93f-18980a0e159f","name":"Read organization-wide Dynamics customer voice settings","description":"Allows the app to read organization-wide Dynamics customer voice settings, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9862d930-5aec-4a98-8d4f-7277a8db9bcb","name":"Read organization-wide Dynamics customer voice settings","description":"Allows the app to read organization-wide Dynamics customer voice settings on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/orgsettings-dynamicsvoice-read-all/"},{"permission":"OrgSettings-DynamicsVoice.ReadWrite.All","application":{"id":"c3f1cc32-8bbd-4ab6-bd33-f270e0d9e041","name":"Read and write organization-wide Dynamics customer voice settings","description":"Allows the app to read and write organization-wide Dynamics customer voice settings, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"4cea26fb-6967-4234-82c4-c044414743f8","name":"Read and write organization-wide Dynamics customer voice settings","description":"Allows the app to read and write organization-wide Dynamics customer voice settings on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/orgsettings-dynamicsvoice-readwrite-all/"},{"permission":"OrgSettings-Forms.Read.All","application":{"id":"434d7c66-07c6-4b1f-ab21-417cf2cdaaca","name":"Read organization-wide Microsoft Forms settings","description":"Allows the app to read organization-wide Microsoft Forms settings, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"210051a0-1ffc-435c-ae76-02d226d05752","name":"Read organization-wide Microsoft Forms settings","description":"Allows the app to read organization-wide Microsoft Forms settings on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/orgsettings-forms-read-all/"},{"permission":"OrgSettings-Forms.ReadWrite.All","application":{"id":"2cb92fee-97a3-4034-8702-24a6f5d0d1e9","name":"Read and write organization-wide Microsoft Forms settings","description":"Allows the app to read and write organization-wide Microsoft Forms settings, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"346c19ff-3fb2-4e81-87a0-bac9e33990c1","name":"Read and write organization-wide Microsoft Forms settings","description":"Allows the app to read and write organization-wide Microsoft Forms settings on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/orgsettings-forms-readwrite-all/"},{"permission":"OrgSettings-Microsoft365Install.Read.All","application":{"id":"6cdf1fb1-b46f-424f-9493-07247caa22e2","name":"Read organization-wide Microsoft 365 apps installation settings","description":"Allows the app to read organization-wide Microsoft 365 apps installation settings, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"8cbdb9f6-9c2e-451a-814d-ec606e5d0212","name":"Read organization-wide Microsoft 365 apps installation settings","description":"Allows the app to read organization-wide Microsoft 365 apps installation settings on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/orgsettings-microsoft365install-read-all/"},{"permission":"OrgSettings-Microsoft365Install.ReadWrite.All","application":{"id":"83f7232f-763c-47b2-a097-e35d2cbe1da5","name":"Read and write organization-wide Microsoft 365 apps installation settings","description":"Allows the app to read and write organization-wide Microsoft 365 apps installation settings, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"1ff35e91-19eb-42d8-aa2d-cc9891127ae5","name":"Read and write organization-wide Microsoft 365 apps installation settings","description":"Allows the app to read and write organization-wide Microsoft 365 apps installation settings on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/orgsettings-microsoft365install-readwrite-all/"},{"permission":"OrgSettings-Todo.Read.All","application":{"id":"e4d9cd09-d858-4363-9410-abb96737f0cf","name":"Read organization-wide Microsoft To Do settings","description":"Allows the app to read organization-wide Microsoft To Do settings, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"7ff96f41-f022-45ba-acd8-ef3f03063d6b","name":"Read organization-wide Microsoft To Do settings","description":"Allows the app to read organization-wide Microsoft To Do settings on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/orgsettings-todo-read-all/"},{"permission":"OrgSettings-Todo.ReadWrite.All","application":{"id":"5febc9da-e0d0-4576-bd13-ae70b2179a39","name":"Read and write organization-wide Microsoft To Do settings","description":"Allows the app to read and write organization-wide Microsoft To Do settings, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"087502c2-5263-433e-abe3-8f77231a0627","name":"Read and write organization-wide Microsoft To Do settings","description":"Allows the app to read and write organization-wide Microsoft To Do settings on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/orgsettings-todo-readwrite-all/"},{"permission":"PartnerBilling.Read.All","application":{"id":"7c3e1994-38ff-4412-a99b-9369f6bb7706","name":"Read all billing data for your company's tenant","description":"Allows the app to read all of billing data from Microsoft for your company's tenant, without a signed-in user. This includes reading billed and unbilled azure usage and invoice reconciliation data.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"8804798e-5934-4e30-8ce3-ef88257cecd4","name":"Read all billing data for your company's tenant","description":"Allows the app to read all of billing data from Microsoft for your company's tenant, on behalf of the signed-in user. This includes reading billed and unbilled Usage and Invoice reconciliation data.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/partnerbilling-read-all/"},{"permission":"PartnerSecurity.Read.All","application":{"id":"21ffa320-2e7f-47d3-a466-7ff04d2dd68d","name":"Read security alerts of customer with CSP relationship","description":"Allows the app to read security alerts of customer with CSP relationship, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"5567b981-0bf1-4796-9038-0648b46e116d","name":"Read security alerts of customer with CSP relationship","description":"Allows the app to read security alerts of customer with CSP relationship on behalf of the partner signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/partnersecurity-read-all/"},{"permission":"PartnerSecurity.ReadWrite.All","application":{"id":"04a2c935-5b4b-474a-be42-11f53111f271","name":"Read security alerts and update status of security alerts of customer with CSP relationship","description":"Allows the app to read security alerts and update status of alerts of customer with CSP relationship, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"0cd2c1f6-94a1-4075-ab8c-0b1aff2e1ad5","name":"Read security alerts and update status of security alerts of customer with CSP relationship","description":"Allows the app to read security alerts and update status of alerts of customer with CSP relationship on behalf of the partner signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/partnersecurity-readwrite-all/"},{"permission":"PendingExternalUserProfile.Read.All","application":{"id":"bdfb26d9-bb36-49be-9b4c-b8cbf4b05808","name":"Read all pending external user profiles","description":"Allows the app to read available properties of pending external user profiles, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"d88fd3fb-53d3-4c1c-8c39-787fcac2ed7a","name":"Read pending external user profiles","description":"Allows the app to read available properties of pending external user profiles, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/pendingexternaluserprofile-read-all/"},{"permission":"PendingExternalUserProfile.ReadWrite.All","application":{"id":"8363c2b8-6ff7-420b-9966-c5884c2d48bc","name":"Read and write all pending external user profiles","description":"Allows the app to read and write available properties of pending external user profiles, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"93a1fb28-c908-4826-904e-0c74ad352b73","name":"Read and write pending external user profiles","description":"Allows the app to read and write available properties of pending external user profiles, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/pendingexternaluserprofile-readwrite-all/"},{"permission":"People.Read","application":null,"delegated":{"id":"ba47897c-39ec-4d83-8086-ee8256fa737d","name":"Read users' relevant people lists","description":"Allows the app to read a ranked list of relevant people of the signed-in user. The list includes local contacts, contacts from social networking, your organization's directory, and people from recent communications (such as email and Skype).","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/people-read/"},{"permission":"People.Read.All","application":{"id":"b528084d-ad10-4598-8b93-929746b4d7d6","name":"Read all users' relevant people lists","description":"Allows the app to read any user's scored list of relevant people, without a signed-in user. The list can include local contacts, contacts from social networking, your organization's directory, and people from recent communications (such as email and Skype).","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"b89f9189-71a5-4e70-b041-9887f0bc7e4a","name":"Read all users' relevant people lists","description":"Allows the app to read a scored list of relevant people of the signed-in user or other users in the signed-in user's organization. The list can include local contacts, contacts from social networking, your organization's directory, and people from recent communications (such as email and Skype).","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/people-read-all/"},{"permission":"PeopleSettings.Read.All","application":{"id":"ef02f2e7-e22d-4c77-8614-8f765683b86e","name":"Read all tenant-wide people settings","description":"Allows the application to read tenant-wide people settings without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ec762c5f-388b-4b16-8693-ac1efbc611bc","name":"Read tenant-wide people settings","description":"Allows the application to read tenant-wide people settings on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/peoplesettings-read-all/"},{"permission":"PeopleSettings.ReadWrite.All","application":{"id":"b6890674-9dd5-4e42-bb15-5af07f541ae1","name":"Read and write all tenant-wide people settings","description":"Allows the application to read and write tenant-wide people settings without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"e67e6727-c080-415e-b521-e3f35d5248e9","name":"Read and write tenant-wide people settings","description":"Allows the application to read and write tenant-wide people settings on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/peoplesettings-readwrite-all/"},{"permission":"Place.Read.All","application":{"id":"913b9306-0ce1-42b8-9137-6a7df690a760","name":"Read all company places","description":"Allows the app to read company places (conference rooms and room lists) for calendar events and other applications, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"cb8f45a0-5c2e-4ea1-b803-84b870a7d7ec","name":"Read all company places","description":"Allows the app to read your company's places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/place-read-all/"},{"permission":"Place.ReadWrite.All","application":{"id":"f1f5e9aa-ad18-4b97-883e-6aa7e95b7a5f","name":"Read and write organization places","description":"Allows the app to manage organization places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"4c06a06a-098a-4063-868e-5dfee3827264","name":"Read and write organization places","description":"Allows the app to manage organization places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/place-readwrite-all/"},{"permission":"PlaceDevice.Read.All","application":{"id":"8b724a84-ceac-4fd9-897e-e31ba8f2d7a3","name":"Read all workplace devices","description":"Allows the app to read all workplace devices, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"4c7f93d2-6b0b-4e05-91aa-87842f0a2142","name":"Read all workplace devices","description":"Allows the app to read all workplace devices, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/placedevice-read-all/"},{"permission":"PlaceDevice.ReadWrite.All","application":{"id":"2d510721-5c4e-43cd-bfdb-ac0f8819fb92","name":"Read and write all workplace devices","description":"Allows the app to read and write all workplace devices, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"eafd6a71-e95a-4f8a-bb6e-fb84ab7fbd9e","name":"Read and write all workplace devices","description":"Allows the app to read and write all workplace devices, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/placedevice-readwrite-all/"},{"permission":"PlaceDeviceTelemetry.ReadWrite.All","application":{"id":"27fc435f-44e2-4b30-bf3c-e0ce74aed618","name":"Read and write telemetry for all workplace devices.","description":"Allows the app to read and write telemetry for all workplace devices, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/placedevicetelemetry-readwrite-all/"},{"permission":"Policy.Read.All","application":{"id":"246dd0d5-5bd0-4def-940b-0421030a5b68","name":"Read your organization's policies","description":"Allows the app to read all your organization's policies without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"572fea84-0151-49b2-9301-11cb16974376","name":"Read your organization's policies","description":"Allows the app to read your organization's policies on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-read-all/"},{"permission":"Policy.Read.AuthenticationMethod","application":{"id":"8e3bc81b-d2f3-4b7b-838c-32c88218d2f0","name":"Read authentication method policies","description":"Allows the app to read all authentication method policies for the tenant, without a signed-in user. ","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"a6ff13ac-1851-4993-8ca9-a671d70de2d5","name":"Read authentication method policies","description":"Allows the app to read the authentication method policies, on behalf of the signed-in user. ","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-read-authenticationmethod/"},{"permission":"Policy.Read.B2BManagementPolicy","application":{"id":"227900ff-df89-40f8-90e2-8157cf6995d5","name":"Read your organization's B2BManagement policies","description":"Allows the app to read all your organization's B2BManagement policies without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"4b293250-121d-4cb4-acc7-5280438c18a6","name":"Read your organization's B2BManagement policies","description":"Allows the app to read your organization's B2BManagement policies on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-read-b2bmanagementpolicy/"},{"permission":"Policy.Read.ConditionalAccess","application":{"id":"37730810-e9ba-4e46-b07e-8ca78d182097","name":"Read your organization's conditional access policies","description":"Allows the app to read your organization's conditional access policies, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"633e0fce-8c58-4cfb-9495-12bbd5a24f7c","name":"Read your organization's conditional access policies","description":"Allows the app to read your organization's conditional access policies on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-read-conditionalaccess/"},{"permission":"Policy.Read.CrossTenantAccess","application":{"id":"8fc84b9a-5c21-479b-ba9d-02d252d062aa","name":"Read your organization's cross tenant access policies","description":"Allows the app to read your organization's cross tenant access policies without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"b337372a-8b4d-428d-9cd8-3d7363865736","name":"Read your organization's cross tenant access policies","description":"Allows the app to read your organization's cross tenant access policies on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-read-crosstenantaccess/"},{"permission":"Policy.Read.DeviceConfiguration","application":{"id":"bdba4817-6ba1-4a7c-8a01-be9bc7c242dd","name":"Read your organization's device configuration policies","description":"Allows the application to read your organization's device configuration policies without a signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"3616a4b0-6746-49c4-a678-4c237599074d","name":"Read your organization's device configuration policies","description":"Allows the app to read your organization's device configuration policies on behalf of the signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-read-deviceconfiguration/"},{"permission":"Policy.Read.IdentityProtection","application":{"id":"b21b72f6-4e6a-4533-9112-47eea9f97b28","name":"Read your organization’s identity protection policy","description":"Allows the app to read your organization’s identity protection policy without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"d146432f-b803-4ed4-8d42-ba74193a6ede","name":"Read your organization’s identity protection policy","description":"Allows the app to read your organization’s identity protection policy on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-read-identityprotection/"},{"permission":"Policy.Read.PermissionGrant","application":{"id":"9e640839-a198-48fb-8b9a-013fd6f6cbcd","name":"Read consent and permission grant policies","description":"Allows the app to read policies related to consent and permission grants for applications, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"414de6ea-2d92-462f-b120-6e2a809a6d01","name":"Read consent and permission grant policies","description":"Allows the app to read policies related to consent and permission grants for applications, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-read-permissiongrant/"},{"permission":"Policy.Read.Recovery","application":{"id":"447f996a-7c58-4ce7-9a9e-da80381a45ab","name":"Read your organization's recovery policy","description":"Allows the application to read and update the organization's recovery policy without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"61faa1e9-0931-4f9a-94ba-bc2e3505c685","name":"Read your organization's recovery policy","description":"Allows the application to read the organization's recovery policy on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-read-recovery/"},{"permission":"Policy.ReadWrite.AccessReview","application":{"id":"77c863fd-06c0-47ce-a7eb-49773e89d319","name":"Read and write your organization's directory access review default policy","description":"Allows the app to read and write your organization's directory access review default policy without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"4f5bc9c8-ea54-4772-973a-9ca119cb0409","name":"Read and write your organization's directory access review default policy","description":"Allows the app to read and write your organization's directory access review default policy on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-accessreview/"},{"permission":"Policy.ReadWrite.ApplicationConfiguration","application":{"id":"be74164b-cff1-491c-8741-e671cb536e13","name":"Read and write your organization's application configuration policies","description":"Allows the app to read and write your organization's application configuration policies, without a signed-in user.  This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy, tokenIssuancePolicy  and tokenLifetimePolicy.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"b27add92-efb2-4f16-84f5-8108ba77985c","name":"Read and write your organization's application configuration policies","description":"Allows the app to read and write your organization's application configuration policies on behalf of the signed-in user.  This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy,  tokenIssuancePolicy and tokenLifetimePolicy.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-applicationconfiguration/"},{"permission":"Policy.ReadWrite.AuthenticationFlows","application":{"id":"25f85f3c-f66c-4205-8cd5-de92dd7f0cec","name":"Read and write authentication flow policies","description":"Allows the app to read and write all authentication flow policies for the tenant, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"edb72de9-4252-4d03-a925-451deef99db7","name":"Read and write authentication flow policies","description":"Allows the app to read and write the authentication flow policies, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-authenticationflows/"},{"permission":"Policy.ReadWrite.AuthenticationMethod","application":{"id":"29c18626-4985-4dcd-85c0-193eef327366","name":"Read and write all authentication method policies ","description":"Allows the app to read and write all authentication method policies for the tenant, without a signed-in user. ","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"7e823077-d88e-468f-a337-e18f1f0e6c7c","name":"Read and write authentication method policies","description":"Allows the app to read and write the authentication method policies, on behalf of the signed-in user. ","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-authenticationmethod/"},{"permission":"Policy.ReadWrite.Authorization","application":{"id":"fb221be6-99f2-473f-bd32-01c6a0e9ca3b","name":"Read and write your organization's authorization policy","description":"Allows the app to read and write your organization's authorization policy without a signed in user. For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"edd3c878-b384-41fd-95ad-e7407dd775be","name":"Read and write your organization's authorization policy","description":"Allows the app to read and write your organization's authorization policy on behalf of the signed-in user.  For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-authorization/"},{"permission":"Policy.ReadWrite.B2BManagementPolicy","application":{"id":"886bd2d9-5b8b-4b49-adea-ca75fb50d9ef","name":"Read and write your organization's B2BManagement policies","description":"Allows the app to read and write all your organization's B2BManagement policies without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"723c4a0c-85b0-4a02-bb2a-c9eb07959de9","name":"Read and write your organization's B2BManagement policies","description":"Allows the app to read and write your organization's B2BManagement policies on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-b2bmanagementpolicy/"},{"permission":"Policy.ReadWrite.ConditionalAccess","application":{"id":"01c0a623-fc9b-48e9-b794-0756f8e8f067","name":"Read and write your organization's conditional access policies","description":"Allows the app to read and write your organization's conditional access policies, without a signed-in user.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"delegated":{"id":"ad902697-1014-4ef5-81ef-2b4301988e8c","name":"Read and write your organization's conditional access policies","description":"Allows the app to read and write your organization's conditional access policies on behalf of the signed-in user.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"leastPrivilege":"If the app only reads policies, use Policy.Read.All.","url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-conditionalaccess/"},{"permission":"Policy.ReadWrite.ConsentRequest","application":{"id":"999f8c63-0a38-4f1b-91fd-ed1947bdd1a9","name":"Read and write your organization's consent request policy","description":"Allows the app to read and write your organization's consent requests policy without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"4d135e65-66b8-41a8-9f8b-081452c91774","name":"Read and write consent request policy","description":"Allows the app to read and write your organization's consent requests policy on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-consentrequest/"},{"permission":"Policy.ReadWrite.CrossTenantAccess","application":{"id":"338163d7-f101-4c92-94ba-ca46fe52447c","name":"Read and write your organization's cross tenant access policies","description":"Allows the app to read and write your organization's cross-tenant access policies and configuration for automatic user consent settings to suppress consent prompts for users of the other tenant on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"014b43d0-6ed4-4fc6-84dc-4b6f7bae7d85","name":"Read and write your organization's cross tenant access policies","description":"Allows the app to read and write your organization's cross-tenant access policies and configuration for automatic user consent settings to suppress consent prompts for users of the other tenant on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-crosstenantaccess/"},{"permission":"Policy.ReadWrite.CrossTenantCapability","application":{"id":"a6325ae7-2b73-4dbd-abed-fbeacfbf8696","name":"Read and write your organization's M365 cross tenant access capabilities","description":"Allows the app to read and write your organization's M365 cross tenant access capabilities without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"9ef7463f-1d39-406f-89ea-3483a4645e1c","name":"Read and write your organization's M365 cross tenant access capabilities","description":"Allows the app to read and write your organization's M365 cross tenant access capabilities on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-crosstenantcapability/"},{"permission":"Policy.ReadWrite.DeviceConfiguration","application":{"id":"230fb2d5-aa21-49c1-bfa7-ae1be179d867","name":"Read and write your organization's device configuration policies","description":"Allows the application to read and write your organization's device configuration policies without a signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"40b534c3-9552-4550-901b-23879c90bcf9","name":"Read and write your organization's device configuration policies","description":"Allows the app to read and write your organization's device configuration policies on behalf of the signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-deviceconfiguration/"},{"permission":"Policy.ReadWrite.ExternalIdentities","application":{"id":"03cc4f92-788e-4ede-b93f-199424d144a5","name":"Read and write your organization's external identities policy","description":"Allows the application to read and update the organization's external identities policy without a signed-in user.  For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"b5219784-1215-45b5-b3f1-88fe1081f9c0","name":"Read and write your organization's external identities policy","description":"Allows the application to read and update the organization's external identities policy on behalf of the signed-in user.  For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-externalidentities/"},{"permission":"Policy.ReadWrite.FeatureRollout","application":{"id":"2044e4f1-e56c-435b-925c-44cd8f6ba89a","name":"Read and write feature rollout policies","description":"Allows the app to read and write feature rollout policies without a signed-in user. Includes abilities to assign and remove users and groups to rollout of a specific feature.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"92a38652-f13b-4875-bc77-6e1dbb63e1b2","name":"Read and write your organization's feature rollout policies","description":"Allows the app to read and write your organization's feature rollout policies on behalf of the signed-in user. Includes abilities to assign and remove users and groups to rollout of a specific feature.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-featurerollout/"},{"permission":"Policy.ReadWrite.FedTokenValidation","application":{"id":"90bbca0b-227c-4cdc-8083-1c6cfb95bac6","name":"Read and write your organization's federated token validation policy","description":"Allows the application to read and update the organization's federated token validation policy without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"be1be369-4540-4ac9-8928-79de99f70d8f","name":"Read and write your organization's federated token validation policy","description":"Allows the application to read and update the organization's federated token validation policy on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-fedtokenvalidation/"},{"permission":"Policy.ReadWrite.IdentityProtection","application":{"id":"2dcf8603-09eb-4078-b1ec-d30a1a76b873","name":"Read and write your organization’s identity protection policy ","description":"Allows the app to read and write your organization’s identity protection policy without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"7256e131-3efb-4323-9854-cf41c6021770","name":"Read and write your organization’s identity protection policy ","description":"Allows the app to read and write your organization’s identity protection policy on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-identityprotection/"},{"permission":"Policy.ReadWrite.MobilityManagement","application":null,"delegated":{"id":"a8ead177-1889-4546-9387-f25e658e2a79","name":"Read and write your organization's mobility management policies","description":"Allows the app to read and write your organization's mobility management policies on behalf of the signed-in user.  For example, a mobility management policy can set the enrollment scope for a given mobility management application.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-mobilitymanagement/"},{"permission":"Policy.ReadWrite.PermissionGrant","application":{"id":"a402ca1c-2696-4531-972d-6e5ee4aa11ea","name":"Manage consent and permission grant policies","description":"Allows the app to manage policies related to consent and permission grants for applications, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"2672f8bb-fd5e-42e0-85e1-ec764dd2614e","name":"Manage consent and permission grant policies","description":"Allows the app to manage policies related to consent and permission grants for applications, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-permissiongrant/"},{"permission":"Policy.ReadWrite.Recovery","application":{"id":"795fc94d-3deb-4632-b1eb-e6d1a5f44918","name":"Read and write your organization's recovery policy","description":"Allows the application to read and update the organization's recovery policy without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"1e7a2f4c-e602-4b1b-9547-304dd65c4cc2","name":"Read and write your organization's recovery policy","description":"Allows the application to read and update the organization's recovery policy on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-recovery/"},{"permission":"Policy.ReadWrite.SecurityDefaults","application":{"id":"1c6e93a6-28e2-4cbb-9f64-1a46a821124d","name":"Read and write your organization's security defaults policy","description":"Allows the app to read and write your organization's security defaults policy, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"0b2a744c-2abf-4f1e-ad7e-17a087e2be99","name":"Read and write your organization's security defaults policy","description":"Allows the app to read and write your organization's security defaults policy on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-securitydefaults/"},{"permission":"Policy.ReadWrite.TrustFramework","application":{"id":"79a677f7-b79d-40d0-a36a-3e6f8688dd7a","name":"Read and write your organization's trust framework policies","description":"Allows the app to read and write your organization's trust framework policies without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"cefba324-1a70-4a6e-9c1d-fd670b7ae392","name":"Read and write your organization's trust framework policies","description":"Allows the app to read and write your organization's trust framework policies on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/policy-readwrite-trustframework/"},{"permission":"POP.AccessAsUser.All","application":null,"delegated":{"id":"d7b7f2d9-0f45-4ea1-9d42-e50810c06991","name":"Read and write access to mailboxes via POP.","description":"Allows the app to have the same access to mailboxes as the signed-in user via POP protocol.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/pop-accessasuser-all/"},{"permission":"PreAuthorizationGrant.Read.All","application":{"id":"66ae8ecc-328f-47f6-97ca-4d9e952df081","name":"Read all preauthorization grants","description":"Allows the app to read preauthorization grants for service principals without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9c98cbde-410c-4719-9058-166504f17863","name":"Read all preauthorization grants","description":"Allows the app to read preauthorization grants for service principals on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/preauthorizationgrant-read-all/"},{"permission":"Presence.Read","application":null,"delegated":{"id":"76bc735e-aecd-4a1d-8b4c-2b915deabb79","name":"Read user's presence information","description":"Allows the app to read presence information on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/presence-read/"},{"permission":"Presence.Read.All","application":{"id":"a70e0c2d-e793-494c-94c4-118fa0a67f42","name":"Read presence information for all users","description":"Allows the app to read presence information of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9c7a330d-35b3-4aa1-963d-cb2b9f927841","name":"Read presence information of all users in your organization","description":"Allows the app to read presence information of all users in the directory on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/presence-read-all/"},{"permission":"Presence.ReadWrite","application":null,"delegated":{"id":"8d3c54a7-cf58-4773-bf81-c0cd6ad522bb","name":"Read and write a user's presence information","description":"Allows the app to read the presence information and write activity and availability on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/presence-readwrite/"},{"permission":"Presence.ReadWrite.All","application":{"id":"83cded22-8297-4ff6-a7fa-e97e9545a259","name":"Read and write presence information for all users","description":"Allows the app to read all presence information and write activity and availability of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, time zone and location.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/presence-readwrite-all/"},{"permission":"PrintConnector.Read.All","application":null,"delegated":{"id":"d69c2d6d-4f72-4f99-a6b9-663e32f8cf68","name":"Read print connectors","description":"Allows the application to read print connectors on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printconnector-read-all/"},{"permission":"PrintConnector.ReadWrite.All","application":null,"delegated":{"id":"79ef9967-7d59-4213-9c64-4b10687637d8","name":"Read and write print connectors","description":"Allows the application to read and write print connectors on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printconnector-readwrite-all/"},{"permission":"Printer.Create","application":null,"delegated":{"id":"90c30bed-6fd1-4279-bf39-714069619721","name":"Register printers  ","description":"Allows the application to create (register) printers on behalf of the signed-in user. ","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printer-create/"},{"permission":"Printer.FullControl.All","application":null,"delegated":{"id":"93dae4bd-43a1-4a23-9a1a-92957e1d9121","name":"Register, read, update, and unregister printers","description":"Allows the application to create (register), read, update, and delete (unregister) printers on behalf of the signed-in user. ","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printer-fullcontrol-all/"},{"permission":"Printer.Read.All","application":{"id":"9709bb33-4549-49d4-8ed9-a8f65e45bb0f","name":"Read printers","description":"Allows the application to read printers without a signed-in user. ","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"3a736c8a-018e-460a-b60c-863b2683e8bf","name":"Read printers","description":"Allows the application to read printers on behalf of the signed-in user. ","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printer-read-all/"},{"permission":"Printer.ReadWrite.All","application":{"id":"f5b3f73d-6247-44df-a74c-866173fddab0","name":"Read and update printers","description":"Allows the application to read and update printers without a signed-in user. Does not allow creating (registering) or deleting (unregistering) printers.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"89f66824-725f-4b8f-928e-e1c5258dc565","name":"Read and update printers","description":"Allows the application to read and update printers on behalf of the signed-in user. Does not allow creating (registering) or deleting (unregistering) printers.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printer-readwrite-all/"},{"permission":"PrinterShare.Read.All","application":null,"delegated":{"id":"ed11134d-2f3f-440d-a2e1-411efada2502","name":"Read printer shares","description":"Allows the application to read printer shares on behalf of the signed-in user. ","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printershare-read-all/"},{"permission":"PrinterShare.ReadBasic.All","application":null,"delegated":{"id":"5fa075e9-b951-4165-947b-c63396ff0a37","name":"Read basic information about printer shares","description":"Allows the application to read basic information about printer shares on behalf of the signed-in user. Does not allow reading access control information.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printershare-readbasic-all/"},{"permission":"PrinterShare.ReadWrite.All","application":null,"delegated":{"id":"06ceea37-85e2-40d7-bec3-91337a46038f","name":"Read and write printer shares","description":"Allows the application to read and update printer shares on behalf of the signed-in user. ","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printershare-readwrite-all/"},{"permission":"PrintJob.Create","application":null,"delegated":{"id":"21f0d9c0-9f13-48b3-94e0-b6b231c7d320","name":"Create print jobs","description":"Allows the application to create print jobs on behalf of the signed-in user and upload document content to print jobs that the signed-in user created.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printjob-create/"},{"permission":"PrintJob.Manage.All","application":{"id":"58a52f47-9e36-4b17-9ebe-ce4ef7f3e6c8","name":"Perform advanced operations on print jobs","description":"Allows the application to perform advanced operations like redirecting a print job to another printer without a signed-in user. Also allows the application to read and update the metadata of print jobs.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printjob-manage-all/"},{"permission":"PrintJob.Read","application":null,"delegated":{"id":"248f5528-65c0-4c88-8326-876c7236df5e","name":"Read user's print jobs","description":"Allows the application to read the metadata and document content of print jobs that the signed-in user created.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printjob-read/"},{"permission":"PrintJob.Read.All","application":{"id":"ac6f956c-edea-44e4-bd06-64b1b4b9aec9","name":"Read print jobs","description":"Allows the application to read the metadata and document content of print jobs without a signed-in user. ","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"afdd6933-a0d8-40f7-bd1a-b5d778e8624b","name":"Read print jobs","description":"Allows the application to read the metadata and document content of print jobs on behalf of the signed-in user. ","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printjob-read-all/"},{"permission":"PrintJob.ReadBasic","application":null,"delegated":{"id":"6a71a747-280f-4670-9ca0-a9cbf882b274","name":"Read basic information of user's print jobs","description":"Allows the application to read the metadata of print jobs that the signed-in user created. Does not allow access to print job document content.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printjob-readbasic/"},{"permission":"PrintJob.ReadBasic.All","application":{"id":"fbf67eee-e074-4ef7-b965-ab5ce1c1f689","name":"Read basic information for print jobs","description":"Allows the application to read the metadata of print jobs without a signed-in user. Does not allow access to print job document content.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"04ce8d60-72ce-4867-85cf-6d82f36922f3","name":"Read basic information of print jobs","description":"Allows the application to read the metadata of print jobs on behalf of the signed-in user. Does not allow access to print job document content.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printjob-readbasic-all/"},{"permission":"PrintJob.ReadWrite","application":null,"delegated":{"id":"b81dd597-8abb-4b3f-a07a-820b0316ed04","name":"Read and write user's print jobs","description":"Allows the application to read and update the metadata and document content of print jobs that the signed-in user created.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printjob-readwrite/"},{"permission":"PrintJob.ReadWrite.All","application":{"id":"5114b07b-2898-4de7-a541-53b0004e2e13","name":"Read and write print jobs","description":"Allows the application to read and update the metadata and document content of print jobs without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"036b9544-e8c5-46ef-900a-0646cc42b271","name":"Read and write print jobs","description":"Allows the application to read and update the metadata and document content of print jobs on behalf of the signed-in user. ","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printjob-readwrite-all/"},{"permission":"PrintJob.ReadWriteBasic","application":null,"delegated":{"id":"6f2d22f2-1cb6-412c-a17c-3336817eaa82","name":"Read and write basic information of user's print jobs","description":"Allows the application to read and update the metadata of print jobs that the signed-in user created. Does not allow access to print job document content.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printjob-readwritebasic/"},{"permission":"PrintJob.ReadWriteBasic.All","application":{"id":"57878358-37f4-4d3a-8c20-4816e0d457b1","name":"Read and write basic information for print jobs","description":"Allows the application to read and update the metadata of print jobs without a signed-in user. Does not allow access to print job document content.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"3a0db2f6-0d2a-4c19-971b-49109b19ad3d","name":"Read and write basic information of print jobs","description":"Allows the application to read and update the metadata of print jobs on behalf of the signed-in user. Does not allow access to print job document content.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printjob-readwritebasic-all/"},{"permission":"PrintSettings.Read.All","application":{"id":"b5991872-94cf-4652-9765-29535087c6d8","name":"Read tenant-wide print settings","description":"Allows the application to read tenant-wide print settings without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"490f32fd-d90f-4dd7-a601-ff6cdc1a3f6c","name":"Read tenant-wide print settings","description":"Allows the application to read tenant-wide print settings on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printsettings-read-all/"},{"permission":"PrintSettings.ReadWrite.All","application":null,"delegated":{"id":"9ccc526a-c51c-4e5c-a1fd-74726ef50b8f","name":"Read and write tenant-wide print settings","description":"Allows the application to read and write tenant-wide print settings on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printsettings-readwrite-all/"},{"permission":"PrintTaskDefinition.ReadWrite.All","application":{"id":"456b71a7-0ee0-4588-9842-c123fcc8f664","name":"Read, write and update print task definitions","description":"Allows the application to read and update print task definitions without a signed-in user. ","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/printtaskdefinition-readwrite-all/"},{"permission":"PrivilegedAccess-CustomExt.Read.All","application":{"id":"e7ebe2d9-6e26-487a-8286-191d623a6904","name":"Read Privileged Access (PIM) custom extensions","description":"Allows the app to read Privileged Access (PIM) custom extensions for your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"bc04fe80-7e6a-4154-8b8f-d1e3465613bf","name":"Read Privileged Access (PIM) custom extensions","description":"Allows the app to read Privileged Access (PIM) custom extensions for your organization, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedaccess-customext-read-all/"},{"permission":"PrivilegedAccess-CustomExt.ReadWrite.All","application":{"id":"124325f3-0c46-4c57-a050-d6d1a82510f6","name":"Read and write Privileged Access (PIM) custom extensions","description":"Allows the app to read and write Privileged Access (PIM) custom extensions for your organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"157efa76-20fd-4db4-876e-90c049322467","name":"Read and write Privileged Access (PIM) custom extensions","description":"Allows the app to read and write Privileged Access (PIM) custom extensions for your organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedaccess-customext-readwrite-all/"},{"permission":"PrivilegedAccess.Read.AzureAD","application":{"id":"4cdc2547-9148-4295-8d11-be0db1391d6b","name":"Read privileged access to Azure AD roles","description":"Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles in your organization, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"b3a539c9-59cb-4ad5-825a-041ddbdc2bdb","name":"Read privileged access to Azure AD","description":"Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedaccess-read-azuread/"},{"permission":"PrivilegedAccess.Read.AzureADGroup","application":{"id":"01e37dc9-c035-40bd-b438-b2879c4870a6","name":"Read privileged access to Azure AD groups","description":"Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"d329c81c-20ad-4772-abf9-3f6fdb7e5988","name":"Read privileged access to Azure AD groups","description":"Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedaccess-read-azureadgroup/"},{"permission":"PrivilegedAccess.Read.AzureResources","application":{"id":"5df6fe86-1be0-44eb-b916-7bd443a71236","name":"Read privileged access to Azure resources","description":"Allows the app to read time-based assignment and just-in-time elevation of user privileges to audit Azure resources in your organization, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"1d89d70c-dcac-4248-b214-903c457af83a","name":"Read privileged access to Azure resources","description":"Allows the app to read time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedaccess-read-azureresources/"},{"permission":"PrivilegedAccess.ReadWrite.AzureAD","application":{"id":"854d9ab1-6657-4ec8-be45-823027bcd009","name":"Read and write privileged access to Azure AD roles","description":"Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles in your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"3c3c74f5-cdaa-4a97-b7e0-4e788bfcfb37","name":"Read and write privileged access to Azure AD","description":"Allows the app to request and manage just in time elevation (including scheduled elevation) of users to Azure AD built-in administrative roles, on behalf of signed-in users.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedaccess-readwrite-azuread/"},{"permission":"PrivilegedAccess.ReadWrite.AzureADGroup","application":{"id":"2f6817f8-7b12-4f0f-bc18-eeaf60705a9e","name":"Read and write privileged access to Azure AD groups","description":"Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"32531c59-1f32-461f-b8df-6f8a3b89f73b","name":"Read and write privileged access to Azure AD groups","description":"Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedaccess-readwrite-azureadgroup/"},{"permission":"PrivilegedAccess.ReadWrite.AzureResources","application":{"id":"6f9d5abc-2db6-400b-a267-7de22a40fb87","name":"Read and write privileged access to Azure resources","description":"Allows the app to request and manage time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) in your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"a84a9652-ffd3-496e-a991-22ba5529156a","name":"Read and write privileged access to Azure resources","description":"Allows the app to request and manage time-based assignment and just-in-time elevation of user privileges to manage Azure resources (like subscriptions, resource groups, storage, compute) on behalf of the signed-in users.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedaccess-readwrite-azureresources/"},{"permission":"PrivilegedAssignmentSchedule.Read.AzureADGroup","application":{"id":"cd4161cb-f098-48f8-a884-1eda9a42434c","name":"Read assignment schedules for access to Azure AD groups","description":"Allows the app to read time-based assignment schedules for access to Azure AD groups, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"02a32cc4-7ab5-4b58-879a-0586e0f7c495","name":"Read assignment schedules for access to Azure AD groups","description":"Allows the app to read time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedassignmentschedule-read-azureadgroup/"},{"permission":"PrivilegedAssignmentSchedule.Read.EntraAppRole","application":{"id":"3a728f2e-df1d-4294-9899-86f601fae70a","name":"Read assignment schedules for app permission grants and app role assignments","description":"Allows the app to read time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"d5767d44-e1c1-4fc7-8fb1-7daa58df022a","name":"Read assignment schedules for app permission grants and app role assignments","description":"Allows the app to read time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedassignmentschedule-read-entraapprole/"},{"permission":"PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup","application":{"id":"41202f2c-f7ab-45be-b001-85c9728b9d69","name":"Read, create, and delete assignment schedules for access to Azure AD groups","description":"Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"06dbc45d-6708-4ef0-a797-f797ee68bf4b","name":"Read, create, and delete assignment schedules for access to Azure AD groups","description":"Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedassignmentschedule-readwrite-azureadgroup/"},{"permission":"PrivilegedAssignmentSchedule.ReadWrite.EntraAppRole","application":{"id":"81adad77-a25a-489d-ac43-321115620139","name":"Read, create, and delete assignment schedules for app permission grants and app role assignments","description":"Allows the app to read, create, and delete time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"e07122a7-d275-4a27-a2f5-eb62349edae0","name":"Read, create, and delete assignment schedules for app permission grants and app role assignments","description":"Allows the app to read, create, and delete time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedassignmentschedule-readwrite-entraapprole/"},{"permission":"PrivilegedAssignmentSchedule.Remove.AzureADGroup","application":{"id":"55d1104b-3821-413d-b3ca-e2393d333cd3","name":"Delete assignment schedules for access to Azure AD groups","description":"Delete time-based assignment schedules for access to Azure AD groups, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"ca5fe595-68ff-4dfd-907d-4509501a0e49","name":"Delete assignment schedules for access to Azure AD groups","description":"Allows the app to delete time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedassignmentschedule-remove-azureadgroup/"},{"permission":"PrivilegedEligibilitySchedule.Read.AzureADGroup","application":{"id":"edb419d6-7edc-42a3-9345-509bfdf5d87c","name":"Read eligibility schedules for access to Azure AD groups","description":"Allows the app to read time-based eligibility schedules for access to Azure AD groups, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"8f44f93d-ecef-46ae-a9bf-338508d44d6b","name":"Read eligibility schedules for access to Azure AD groups","description":"Allows the app to read time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedeligibilityschedule-read-azureadgroup/"},{"permission":"PrivilegedEligibilitySchedule.Read.EntraAppRole","application":{"id":"d2ab45a0-ed46-4f7f-806a-0f1146144d5a","name":"Read eligibility schedules for app permission grants and app role assignments","description":"Allows the app to read time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"9b9eb231-5483-4f3c-89e9-9d5048dafe9d","name":"Read eligibility schedules for app permission grants and app role assignments","description":"Allows the app to read time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedeligibilityschedule-read-entraapprole/"},{"permission":"PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup","application":{"id":"618b6020-bca8-4de6-99f6-ef445fa4d857","name":"Read, create, and delete eligibility schedules for access to Azure AD groups","description":"Allows the app to read, create, and delete time-based eligibility schedules for access to Azure AD groups, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"ba974594-d163-484e-ba39-c330d5897667","name":"Read, create, and delete eligibility schedules for access to Azure AD groups","description":"Allows the app to read, create, and delete time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedeligibilityschedule-readwrite-azureadgroup/"},{"permission":"PrivilegedEligibilitySchedule.ReadWrite.EntraAppRole","application":{"id":"7f4c39f1-1aa7-44b7-ab05-38df2609c37a","name":"Read, create, and delete eligibility schedules for app permission grants and app role assignments","description":"Allows the app to read, create, and delete time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"f7ff1cb0-e255-4bb3-b24a-6708c60c5418","name":"Read, create, and delete eligibility schedules for app permission grants and app role assignments","description":"Allows the app to read, create, and delete time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedeligibilityschedule-readwrite-entraapprole/"},{"permission":"PrivilegedEligibilitySchedule.Remove.AzureADGroup","application":{"id":"55745561-7572-4314-a737-a2c2a1b0dd2e","name":"Delete eligibility schedules for access to Azure AD groups","description":"Delete time-based eligibility schedules for access to Azure AD groups, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"c5ea9ab4-9b41-4c09-a400-53e652fb5096","name":"Delete eligibility schedules for access to Azure AD groups","description":"Allows the app to delete time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/privilegedeligibilityschedule-remove-azureadgroup/"},{"permission":"profile","application":null,"delegated":{"id":"14dad69e-099b-42c9-810b-d002981feec1","name":"View users' basic profile","description":"Allows the app to see your users' basic profile (e.g., name, picture, user name, email address)","adminConsent":false,"risk":"Low","riskReason":"Basic sign-in and profile information."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/profile/"},{"permission":"ProfilePhoto.Read.All","application":{"id":"e24d31aa-e1ab-4c80-85fe-23018690335d","name":"Read profile photo of a user or group","description":"Allows the app to read all profile photos of users and groups, without a signed-in user","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"469cd065-729e-4dee-b1fa-d92e0fab6310","name":"Read profile photo of a user or group","description":"Allows the app to read all profile photos of users and groups, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/profilephoto-read-all/"},{"permission":"ProfilePhoto.ReadWrite.All","application":{"id":"27baa7f6-5dfb-4ba8-b1d3-1e812c143013","name":"Read and write profile photo of a user or group","description":"Allows the app to read and write all profile photos of users and groups, without a signed-in user","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"f5b24df7-511e-48bb-ae88-643f023b55e1","name":"Read and write profile photo of a user or group","description":"Allows the app to read and write all profile photos of users and groups, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/profilephoto-readwrite-all/"},{"permission":"ProgramControl.Read.All","application":{"id":"eedb7fdd-7539-4345-a38b-4839e4a84cbd","name":"Read all programs","description":"Allows the app to read programs and program controls in the organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"c492a2e1-2f8f-4caa-b076-99bbf6e40fe4","name":"Read all programs that user can access","description":"Allows the app to read programs and program controls that the signed-in user has access to in the organization.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/programcontrol-read-all/"},{"permission":"ProgramControl.ReadWrite.All","application":{"id":"60a901ed-09f7-4aa5-a16e-7dd3d6f9de36","name":"Manage all programs","description":"Allows the app to read, update, delete and perform actions on programs and program controls in the organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"50fd364f-9d93-4ae1-b170-300e87cccf84","name":"Manage all programs that user can access","description":"Allows the app to read, update, delete and perform actions on programs and program controls that the signed-in user has access to in the organization.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/programcontrol-readwrite-all/"},{"permission":"ProtectionScopes.Compute.All","application":{"id":"e5a76501-dbb0-492c-ab55-5d09e8837263","name":"Compute Purview policies at tenant scope","description":"Allows the app to identify Purview data protection, compliance and governance policy scopes defined for all users across tenant.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"98f5a27a-539a-48bc-a597-f78e9e1e76bf","name":"Compute Purview policies at tenant scope","description":"Allows the app to identify Purview data protection, compliance and governance policy scopes defined for all users across tenant.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/protectionscopes-compute-all/"},{"permission":"ProtectionScopes.Compute.User","application":{"id":"fe696d63-5e1f-4515-8232-cccc316903c6","name":"Compute Purview policies for an individual user","description":"Allows the app to identify Purview data protection, compliance and governance policy scopes defined for an individual user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"4fc04d16-a9fc-4c5e-8da4-79b6c33638a4","name":"Compute Purview policies for an individual user","description":"Allows the app to identify Purview data protection, compliance and governance policy scopes defined for an individual user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/protectionscopes-compute-user/"},{"permission":"ProvisioningLog.Read.All","application":{"id":"091937d3-3e38-47a1-8649-b2f99d3035f1","name":"Read all provisioning log data","description":"Allows the app to read and query your provisioning log activities, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"95aec97b-cf27-4a8d-a67d-42f60b5b38ef","name":"Read provisioning log data","description":"Allows the app to read and query your provisioning log activities, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/provisioninglog-read-all/"},{"permission":"PublicKeyInfrastructure.Read.All","application":{"id":"214fda0c-514a-4650-b037-b562b1a66124","name":"Read all certificate based authentication configurations","description":"Allows the application to read  certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"04a4b2a2-3f26-4fc8-87ee-9c46e68db175","name":"Read certificate based authentication configurations","description":"Allows the application to read certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/publickeyinfrastructure-read-all/"},{"permission":"PublicKeyInfrastructure.ReadWrite.All","application":{"id":"a2b63618-5350-462d-b1b3-ba6eb3684e26","name":"Read and write all certificate based authentication configurations","description":"Allows the application to read and write certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"3591b7f3-dba8-4bad-b667-7a64bd4f2b83","name":"Read and write certificate based authentication configurations","description":"Allows the application to read  and write certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/publickeyinfrastructure-readwrite-all/"},{"permission":"PullPrintPrinter.FullControl.All","application":null,"delegated":{"id":"ef6b83cd-f762-47ff-97d7-6f6f2d0486ea","name":"Create, read, update and delete pull-print printers and manage member printers","description":"Allows the application to create, read, update and delete pull-print printers and manage member printers on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/pullprintprinter-fullcontrol-all/"},{"permission":"PullPrintPrinter.Read.All","application":{"id":"f369d3b8-fe98-4772-85e1-b23e7cf41982","name":"Read pull-print printers","description":"Allows the application to read pull-print printers without a signed-in user. ","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"deac7994-79bc-44c9-8828-01c1a9a96618","name":"Read pull-print printers","description":"Allows the application to read pull-print printers on behalf of the signed-in user. ","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/pullprintprinter-read-all/"},{"permission":"PullPrintPrinter.ReadWrite.All","application":null,"delegated":{"id":"c628c397-5d7f-4c93-ae0f-4680282fd6d5","name":"Read and update pull-print printers","description":"Allows the application to read and update pull-print printers on behalf of the signed-in user. Does not allow creating or deleting  pull-print printers or managing member printers.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/pullprintprinter-readwrite-all/"},{"permission":"QnA.Read.All","application":{"id":"ee49e170-1dd1-4030-b44c-61ad6e98f743","name":"Read all Question and Answers ","description":"Allows an app to read all question and answers, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"f73fa04f-b9a5-4df9-8843-993ce928925e","name":"Read all Questions and Answers that the user can access.","description":"Allows an app to read all question and answer sets that the signed-in user can access.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/qna-read-all/"},{"permission":"RealTimeActivityFeed.Read.All","application":{"id":"abafe00f-ea87-4c63-b8a8-0e7bb0a88144","name":"Access real-time enriched data in a meeting as an app","description":"Allows the app to get direct access to real-time enriched data in a meeting, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"db5d5bae-0c9e-444e-9390-8a5fea98c253","name":"Access real-time enriched data in a meeting","description":"Allows the app to get direct access to real-time enriched data in a meeting, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/realtimeactivityfeed-read-all/"},{"permission":"RecordsManagement.Read.All","application":{"id":"ac3a2b8e-03a3-4da9-9ce0-cbe28bf1accd","name":"Read Records Management configuration, labels and policies","description":"Allows the application to read any data from Records Management, such as configuration, labels, and policies without the signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"07f995eb-fc67-4522-ad66-2b8ca8ea3efd","name":"Read Records Management configuration, labels, and policies","description":"Allows the application to read any data from Records Management, such as configuration, labels, and policies on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/recordsmanagement-read-all/"},{"permission":"RecordsManagement.ReadWrite.All","application":{"id":"eb158f57-df43-4751-8b21-b8932adb3d34","name":"Read and write Records Management configuration, labels and policies","description":"Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies without the signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"f2833d75-a4e6-40ab-86d4-6dfe73c97605","name":"Read and write Records Management configuration, labels, and policies","description":"Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/recordsmanagement-readwrite-all/"},{"permission":"RemoteTenantGroups.Read.All","application":{"id":"faa08cc0-0dcd-4ea9-9f9c-8b16f842b36e","name":"Read RemoteTenantGroups information","description":"Allows the app to read available properties on remoteTenantGroups, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"d207fff0-6e36-4360-a23b-495e23b60385","name":"Read RemoteTenantGroups information","description":"Allows the app to read available properties of remoteTenantGroups, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/remotetenantgroups-read-all/"},{"permission":"Reports.Read.All","application":{"id":"230c1aed-a721-4c5d-9cb4-a90514e508ef","name":"Read all usage reports","description":"Allows an app to read all service usage reports without a signed-in user.  Services that provide usage reports include Office 365 and Azure Active Directory.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"02e97553-ed7b-43d0-ab3c-f8bace0d040c","name":"Read all usage reports","description":"Allows an app to read all service usage reports on behalf of the signed-in user.  Services that provide usage reports include Office 365 and Azure Active Directory.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/reports-read-all/"},{"permission":"ReportSettings.Read.All","application":{"id":"ee353f83-55ef-4b78-82da-555bfa2b4b95","name":"Read all admin report settings","description":"Allows the app to read all admin report settings, such as whether to display concealed information in reports, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"84fac5f4-33a9-4100-aa38-a20c6d29e5e7","name":"Read admin report settings","description":"Allows the app to read admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/reportsettings-read-all/"},{"permission":"ReportSettings.ReadWrite.All","application":{"id":"2a60023f-3219-47ad-baa4-40e17cd02a1d","name":"Read and write all admin report settings","description":"Allows the app to read and update all admin report settings, such as whether to display concealed information in reports, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"b955410e-7715-4a88-a940-dfd551018df3","name":"Read and write admin report settings","description":"Allows the app to read and update admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/reportsettings-readwrite-all/"},{"permission":"ResourceSpecificPermissionGrant.ReadForChat","application":null,"delegated":{"id":"cb530fca-534b-4e72-aa74-bca7e8bbd06f","name":"Read resource specific permissions granted on a chat","description":"Allows the app to read the resource specific permissions granted on the chat, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/resourcespecificpermissiongrant-readforchat/"},{"permission":"ResourceSpecificPermissionGrant.ReadForChat.All","application":{"id":"2ff643d8-43e4-4a9b-88c1-86cb4a4b4c2f","name":"Read resource specific permissions granted on a chat","description":"Allows the app to read the resource specific permissions granted on the chat without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/resourcespecificpermissiongrant-readforchat-all/"},{"permission":"ResourceSpecificPermissionGrant.ReadForTeam","application":null,"delegated":{"id":"eafad40c-bf7a-415a-b7f8-acdf5706b58f","name":"Read resource specific permissions granted on a team","description":"Allows the app to read the resource specific permissions granted on the team, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/resourcespecificpermissiongrant-readforteam/"},{"permission":"ResourceSpecificPermissionGrant.ReadForTeam.All","application":{"id":"ad4600ae-d900-42cb-a9a2-2415d05593d0","name":"Read resource specific permissions granted on a team","description":"Allows the app to read the resource specific permissions granted on the team without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/resourcespecificpermissiongrant-readforteam-all/"},{"permission":"ResourceSpecificPermissionGrant.ReadForUser","application":null,"delegated":{"id":"f1d91a8f-88e7-4774-8401-b668d5bca0c5","name":"Read resource specific permissions granted on a user account","description":"Allows the app to read the resource specific permissions granted on a user account, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/resourcespecificpermissiongrant-readforuser/"},{"permission":"ResourceSpecificPermissionGrant.ReadForUser.All","application":{"id":"acfca4d5-f49f-40ed-9648-84068b474c73","name":"Read all resource specific permissions granted on user accounts","description":"Allows the app to read all resource specific permissions granted on user accounts, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/resourcespecificpermissiongrant-readforuser-all/"},{"permission":"RiskPreventionProviders.Read.All","application":{"id":"2a6baefd-edea-4ff6-b24e-bebcaa27a50d","name":"Read all identity risk prevention providers","description":"Allows the app to read your organization's risk prevention providers, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"e197c06f-ae7b-4398-b0a2-89f76ebca159","name":"Read all identity risk prevention providers","description":"Allows the app to read your organization's risk prevention providers, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/riskpreventionproviders-read-all/"},{"permission":"RiskPreventionProviders.ReadWrite.All","application":{"id":"7fc7225d-eb37-4c39-90f3-a33a57cf1081","name":"Read and write all identity risk prevention providers","description":"Allows the app to read and write your organization's risk prevention providers, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"2a7babba-9623-4109-bc9c-79728cf3bb4f","name":"Read and write all identity risk prevention providers","description":"Allows the app to read and write your organization's risk prevention providers, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/riskpreventionproviders-readwrite-all/"},{"permission":"RoleAssignmentSchedule.Read.Directory","application":{"id":"d5fe8ce8-684c-4c83-a52c-46e882ce4be1","name":"Read all active role assignments and role schedules for your company's directory","description":"Allows the app to read the active role-based access control (RBAC) assignments and schedules for your company's directory, without a signed-in user. This includes reading directory role templates, and directory roles.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"344a729c-0285-42c6-9014-f12b9b8d6129","name":"Read all active role assignments for your company's directory","description":"Allows the app to read the active role-based access control (RBAC) assignments for your company's directory, on behalf of the signed-in user. This includes reading directory role templates, and directory roles.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/roleassignmentschedule-read-directory/"},{"permission":"RoleAssignmentSchedule.ReadWrite.Directory","application":{"id":"dd199f4a-f148-40a4-a2ec-f0069cc799ec","name":"Read, update, and delete all policies for privileged role assignments of your company's directory","description":"Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company's directory, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"8c026be3-8e26-4774-9372-8d5d6f21daff","name":"Read, update, and delete all active role assignments for your company's directory","description":"Allows the app to read and manage the active role-based access control (RBAC) assignments for your company's directory, on behalf of the signed-in user. This includes managing active directory role membership, and reading directory role templates, directory roles and active memberships.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/roleassignmentschedule-readwrite-directory/"},{"permission":"RoleAssignmentSchedule.Remove.Directory","application":{"id":"d3495511-98b7-4df3-b317-4e35c19f6129","name":"Delete all active role assignments of your company's directory","description":"Delete all active privileged role-based access control (RBAC) assignments of your company's directory, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"f71cd05c-3fdb-4568-aef2-e1cf62ee20d4","name":"Delete all active role assignments for your company's directory","description":"Allows the app to delete the active role-based access control (RBAC) assignments for your company's directory, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/roleassignmentschedule-remove-directory/"},{"permission":"RoleEligibilitySchedule.Read.Directory","application":{"id":"ff278e11-4a33-4d0c-83d2-d01dc58929a5","name":"Read all eligible role assignments and role schedules for your company's directory","description":"Allows the app to read the eligible role-based access control (RBAC) assignments and schedules for your company's directory, without a signed-in user. This includes reading directory role templates, and directory roles.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"eb0788c2-6d4e-4658-8c9e-c0fb8053f03d","name":"Read all eligible role assignments for your company's directory","description":"Allows the app to read the eligible role-based access control (RBAC) assignments for your company's directory, on behalf of the signed-in user. This includes reading directory role templates, and directory roles.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/roleeligibilityschedule-read-directory/"},{"permission":"RoleEligibilitySchedule.ReadWrite.Directory","application":{"id":"fee28b28-e1f3-4841-818e-2704dc62245f","name":"Read, update, and delete all eligible role assignments and schedules for your company's directory","description":"Allows the app to read and manage the eligible role-based access control (RBAC) assignments and schedules for your company's directory, without a signed-in user. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"62ade113-f8e0-4bf9-a6ba-5acb31db32fd","name":"Read, update, and delete  all eligible role assignments for your company's directory","description":"Allows the app to read and manage the eligible role-based access control (RBAC) assignments for your company's directory, on behalf of the signed-in user. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/roleeligibilityschedule-readwrite-directory/"},{"permission":"RoleEligibilitySchedule.Remove.Directory","application":{"id":"79c7e69c-0d9f-4eff-97a8-49170a5a08ba","name":"Delete all eligible role assignments of your company's directory","description":"Delete all eligible privileged role-based access control (RBAC) assignments of your company's directory, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"58ac4fa2-b484-4d6e-ba97-beee2a574220","name":"Delete all eligible role assignments for your company's directory","description":"Allows the app to delete the eligible role-based access control (RBAC) assignments for your company's directory, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/roleeligibilityschedule-remove-directory/"},{"permission":"RoleManagement.Read.All","application":{"id":"c7fbd983-d9aa-4fa7-84b8-17382c103bc4","name":"Read role management data for all RBAC providers","description":"Allows the app to read role-based access control (RBAC) settings for all RBAC providers without a signed-in user. This includes reading role definitions and role assignments.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"48fec646-b2ba-4019-8681-8eb31435aded","name":"Read role management data for all RBAC providers","description":"Allows the app to read the role-based access control (RBAC) settings for all RBAC providers, on behalf of the signed-in user.  This includes reading role definitions and role assignments.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagement-read-all/"},{"permission":"RoleManagement.Read.CloudPC","application":{"id":"031a549a-bb80-49b6-8032-2068448c6a3c","name":"Read Cloud PC RBAC settings","description":"Allows the app to read the Cloud PC role-based access control (RBAC) settings, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"9619b88a-8a25-48a7-9571-d23be0337a79","name":"Read Cloud PC RBAC settings","description":"Allows the app to read the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user.  This includes reading Cloud PC role definitions and role assignments.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagement-read-cloudpc/"},{"permission":"RoleManagement.Read.Defender","application":{"id":"4d6e30d1-e64e-4ae7-bf9d-c706cc928cef","name":"Read M365 Defender RBAC configuration","description":"Allows the app to read the role-based access control (RBAC) settings for your company's directory, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"dd689728-6eb8-4deb-bd38-2924a935f3de","name":"Read M365 Defender RBAC configuration","description":"Allows the app to read the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes reading M365 Defender role definitions and role assignments.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagement-read-defender/"},{"permission":"RoleManagement.Read.Directory","application":{"id":"483bed4a-2ad3-4361-a73b-c83ccdbdc53c","name":"Read all directory RBAC settings","description":"Allows the app to read the role-based access control (RBAC) settings for your company's directory, without a signed-in user.  This includes reading directory role templates, directory roles and memberships.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"741c54c3-0c1e-44a1-818b-3f97ab4e8c83","name":"Read directory RBAC settings","description":"Allows the app to read the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user.  This includes reading directory role templates, directory roles and memberships.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagement-read-directory/"},{"permission":"RoleManagement.Read.Exchange","application":{"id":"c769435f-f061-4d0b-8ff1-3d39870e5f85","name":"Read Exchange Online RBAC configuration","description":"Allows the app to read the role-based access control (RBAC) configuration for your organization's Exchange Online service, without a signed-in user. This includes reading Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"3bc15058-7858-4141-b24f-ae43b4e80b52","name":"Read Exchange Online RBAC configuration","description":"Allows the app to read the role-based access control (RBAC) settings for your organization's Exchange Online service, on behalf of the signed-in user. This includes reading Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagement-read-exchange/"},{"permission":"RoleManagement.ReadWrite.CloudPC","application":{"id":"274d0592-d1b6-44bd-af1d-26d259bcb43a","name":"Read and write all Cloud PC RBAC settings","description":"Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, without a signed-in user. This includes reading and managing Cloud PC role definitions and memberships.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"501d06f8-07b8-4f18-b5c6-c191a4af7a82","name":"Read and write Cloud PC RBAC settings","description":"Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user. This includes reading and managing Cloud PC role definitions and role assignments.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagement-readwrite-cloudpc/"},{"permission":"RoleManagement.ReadWrite.Defender","application":{"id":"8b7e8c0a-7e9d-4049-97ec-04b5e1bcaf05","name":"Read M365 Defender RBAC configuration","description":"Allows the app to read the role-based access control (RBAC) settings for your company's directory, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"d8914f8f-9f64-4bd1-b4d3-f5a701ed8457","name":"Read M365 Defender RBAC configuration","description":"Allows the app to read the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes reading M365 Defender role definitions and role assignments.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagement-readwrite-defender/"},{"permission":"RoleManagement.ReadWrite.Directory","application":{"id":"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8","name":"Read and write all directory RBAC settings","description":"Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, without a signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"delegated":{"id":"d01b97e9-cbc0-49fe-810a-750afd5527a3","name":"Read and write directory RBAC settings","description":"Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"leastPrivilege":"If the app only reads role assignments, use RoleManagement.Read.Directory.","url":"https://azureblog.co.uk/graph-permissions/rolemanagement-readwrite-directory/"},{"permission":"RoleManagement.ReadWrite.Exchange","application":{"id":"025d3225-3f02-4882-b4c0-cd5b541a4e80","name":"Read and write Exchange Online RBAC configuration","description":"Allows the app to read and manage the role-based access control (RBAC) settings for your organization's Exchange Online service, without a signed-in user. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"c1499fe0-52b1-4b22-bed2-7a244e0e879f","name":"Read and write Exchange Online RBAC configuration","description":"Allows the app to read and manage the role-based access control (RBAC) settings for your organization's Exchange Online service, on behalf of the signed-in user. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagement-readwrite-exchange/"},{"permission":"RoleManagementAlert.Read.Directory","application":{"id":"ef31918f-2d50-4755-8943-b8638c0a077e","name":"Read all alert data for your company's directory","description":"Allows the app to read all role-based access control (RBAC) alerts for your company's directory, without a signed-in user. This includes reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"cce71173-f76d-446e-97ff-efb2d82e11b1","name":"Read all alert data for your company's directory","description":"Allows the app to read the role-based access control (RBAC) alerts for your company's directory, on behalf of the signed-in user. This includes reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagementalert-read-directory/"},{"permission":"RoleManagementAlert.ReadWrite.Directory","application":{"id":"11059518-d6a6-4851-98ed-509268489c4a","name":"Read all alert data, configure alerts, and take actions on all alerts for your company's directory","description":"Allows the app to read and manage all role-based access control (RBAC) alerts for your company's directory, without a signed-in user. This includes managing alert settings, initiating alert scans, dismissing alerts, remediating alert incidents, and reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"435644c6-a5b1-40bf-8f52-fe8e5b53e19c","name":"Read all alert data, configure alerts, and take actions on all alerts for your company's directory","description":"Allows the app to read and manage the role-based access control (RBAC) alerts for your company's directory, on behalf of the signed-in user. This includes managing alert settings, initiating alert scans, dismissing alerts, remediating alert incidents, and reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagementalert-readwrite-directory/"},{"permission":"RoleManagementPolicy.Read.AzureADGroup","application":{"id":"69e67828-780e-47fd-b28c-7b27d14864e6","name":"Read all policies in PIM for Groups","description":"Allows the app to read policies in Privileged Identity Management for Groups, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"7e26fdff-9cb1-4e56-bede-211fe0e420e8","name":"Read all policies in PIM for Groups","description":"Allows the app to read policies in Privileged Identity Management for Groups, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagementpolicy-read-azureadgroup/"},{"permission":"RoleManagementPolicy.Read.Directory","application":{"id":"fdc4c997-9942-4479-bfcb-75a36d1138df","name":"Read all policies for privileged role assignments of your company's directory","description":"Allows the app to read policies for privileged role-based access control (RBAC) assignments of your company's directory, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"3de2cdbe-0ff5-47d5-bdee-7f45b4749ead","name":"Read all policies for privileged role assignments of your company's directory","description":"Allows the app to read policies for privileged role-based access control (RBAC) assignments of your company's directory, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagementpolicy-read-directory/"},{"permission":"RoleManagementPolicy.Read.EntraAppRole","application":{"id":"3d201a4e-90f1-420d-bd4f-3beec28a46b9","name":"Read all policies in PIM for App Roles","description":"Allows the app to read policies in Privileged Identity Management for App Roles, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"8b3ffd3b-178e-4aae-be39-ba87585eddb2","name":"Read all policies in PIM for App Roles","description":"Allows the app to read policies in Privileged Identity Management for App Roles, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagementpolicy-read-entraapprole/"},{"permission":"RoleManagementPolicy.ReadWrite.AzureADGroup","application":{"id":"b38dcc4d-a239-4ed6-aa84-6c65b284f97c","name":"Read, update, and delete all policies in PIM for Groups","description":"Allows the app to read, update, and delete policies in Privileged Identity Management for Groups, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"0da165c7-3f15-4236-b733-c0b0f6abe41d","name":"Read, update, and delete all policies in PIM for Groups","description":"Allows the app to read, update, and delete policies in Privileged Identity Management for Groups, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagementpolicy-readwrite-azureadgroup/"},{"permission":"RoleManagementPolicy.ReadWrite.Directory","application":{"id":"31e08e0a-d3f7-4ca2-ac39-7343fb83e8ad","name":"Read, update, and delete all policies for privileged role assignments of your company's directory","description":"Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company's directory, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"1ff1be21-34eb-448c-9ac9-ce1f506b2a68","name":"Read, update, and delete all policies for privileged role assignments of your company's directory","description":"Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company's directory, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagementpolicy-readwrite-directory/"},{"permission":"RoleManagementPolicy.ReadWrite.EntraAppRole","application":{"id":"ec563bdb-80dc-47c0-81d3-bff47cc6ac06","name":"Manage all policies in PIM for App Roles","description":"Allows the app to manage policies in Privileged Identity Management for App Roles, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"652ec839-e4ac-4eb5-b545-ecc90eeceb2d","name":"Manage all policies in PIM for App Roles","description":"Allows the app to manage policies in Privileged Identity Management for App Roles, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/rolemanagementpolicy-readwrite-entraapprole/"},{"permission":"Schedule-WorkingTime.ReadWrite.All","application":{"id":"0b21c159-dbf4-4dbb-a6f6-490e412c716e","name":"Trigger working time policies and read the working time status","description":"Allows the app to trigger the working time policies and read the working time status for other users in your organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/schedule-workingtime-readwrite-all/"},{"permission":"Schedule.Read.All","application":{"id":"7b2ebf90-d836-437f-b90d-7b62722c4456","name":"Read all schedule items","description":"Allows the app to read all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"fccf6dd8-5706-49fa-811f-69e2e1b585d0","name":"Read user schedule items","description":"Allows the app to read schedule, schedule groups, shifts and associated entities in the Teams or Shifts application on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/schedule-read-all/"},{"permission":"Schedule.ReadWrite.All","application":{"id":"b7760610-0545-4e8a-9ec3-cce9e63db01c","name":"Read and write all schedule items","description":"Allows the app to manage all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"63f27281-c9d9-4f29-94dd-6942f7f1feb0","name":"Read and write user schedule items","description":"Allows the app to manage schedule, schedule groups, shifts and associated entities in the Teams or Shifts application on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/schedule-readwrite-all/"},{"permission":"SchedulePermissions.ReadWrite.All","application":{"id":"7239b71d-b402-4150-b13d-78ecfe8df441","name":"Read/Write schedule permissions for a role","description":"Allows the app to read/write schedule permissions for a specific role in Shifts application without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"07919803-6073-4cd8-bc55-28077db0ee10","name":"Read/Write schedule permissions for a role.","description":"Allows the app to read/write schedule permissions for a specific role in Shifts application on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/schedulepermissions-readwrite-all/"},{"permission":"SearchConfiguration.Read.All","application":{"id":"ada977a5-b8b1-493b-9a91-66c206d76ecf","name":"Read your organization's search configuration","description":"Allows the app to read search configurations, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"7d307522-aa38-4cd0-bd60-90c6f0ac50bd","name":"Read your organization's search configuration","description":"Allows the app to read search configuration, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/searchconfiguration-read-all/"},{"permission":"SearchConfiguration.ReadWrite.All","application":{"id":"0e778b85-fefa-466d-9eec-750569d92122","name":"Read and write your organization's search configuration","description":"Allows the app to read and write search configurations, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"b1a7d408-cab0-47d2-a2a5-a74a3733600d","name":"Read and write your organization's search configuration","description":"Allows the app to read and write search configuration, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/searchconfiguration-readwrite-all/"},{"permission":"SecurityActions.Read.All","application":{"id":"5e0edab9-c148-49d0-b423-ac253e121825","name":"Read your organization's security actions","description":"Allows the app to read security actions, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"1638cddf-07a4-4de2-8645-69c96cacad73","name":"Read your organization's security actions","description":"Allows the app to read security actions, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityactions-read-all/"},{"permission":"SecurityActions.ReadWrite.All","application":{"id":"f2bf083f-0179-402a-bedb-b2784de8a49b","name":"Read and update your organization's security actions","description":"Allows the app to read or update security actions, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"dc38509c-b87d-4da0-bd92-6bec988bac4a","name":"Read and update your organization's security actions","description":"Allows the app to read or update security actions, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityactions-readwrite-all/"},{"permission":"SecurityAlert.Create.All","application":{"id":"06870c4c-7370-4a2a-ad10-239a337af816","name":"Create security alerts","description":"Allows the app to create security alerts, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"7417b8c6-a088-4c4c-99c7-bca9ab3eb9ba","name":"Create security alerts","description":"Allows the app to create security alerts, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityalert-create-all/"},{"permission":"SecurityAlert.Read.All","application":{"id":"472e4a4d-bb4a-4026-98d1-0b0d74cb74a5","name":"Read all security alerts","description":"Allows the app to read all security alerts, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"bc257fb8-46b4-4b15-8713-01e91bfbe4ea","name":"Read all security alerts","description":"Allows the app to read all security alerts, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityalert-read-all/"},{"permission":"SecurityAlert.ReadWrite.All","application":{"id":"ed4fca05-be46-441f-9803-1873825f8fdb","name":"Read and write to all security alerts","description":"Allows the app to read and write to all security alerts, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"471f2a7f-2a42-4d45-a2bf-594d0838070d","name":"Read and write to all security alerts","description":"Allows the app to read and write to all security alerts, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityalert-readwrite-all/"},{"permission":"SecurityAnalyzedMessage.Read.All","application":{"id":"b48f7ac2-044d-4281-b02f-75db744d6f5f","name":"Read metadata and detection details for all emails in your organization","description":"Read email metadata and security detection details, without a signed-in user.  ","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"53e6783e-b127-4a35-ab3a-6a52d80a9077","name":"Read metadata and detection details for emails in your organization","description":"Read email metadata and security detection details on behalf of the signed in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityanalyzedmessage-read-all/"},{"permission":"SecurityAnalyzedMessage.ReadWrite.All","application":{"id":"04c55753-2244-4c25-87fc-704ab82a4f69","name":"Read metadata, detection details, and execute remediation actions on all emails in your organization","description":"Read email metadata and security detection details, and execute remediation actions like deleting an email, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"48eb8c83-6e58-46e7-a6d3-8805822f5940","name":"Read metadata, detection details, and execute remediation actions on emails in your organization","description":"Read email metadata, security detection details, and execute remediation actions like deleting an email, on behalf of the signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityanalyzedmessage-readwrite-all/"},{"permission":"SecurityCopilotWorkspaces.Read.All","application":null,"delegated":{"id":"84499c31-ac2e-44d3-a0cf-a6c386d4dfe8","name":"Read all Security Copilot resources for the signed-in user","description":"Allows the app to read all Security Copilot signed-in user's resources on behalf of the signed-in user","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securitycopilotworkspaces-read-all/"},{"permission":"SecurityCopilotWorkspaces.ReadWrite.All","application":null,"delegated":{"id":"206291b0-2167-47a7-a640-6cdc1df710ba","name":"Read and write individually owned Security Copilot resources of the signed-in user","description":"Allows the app to read and write Security Copilot resources owned by the signed-in user on their behalf.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securitycopilotworkspaces-readwrite-all/"},{"permission":"SecurityEvents.Read.All","application":{"id":"bf394140-e372-4bf9-a898-299cfc7564e5","name":"Read your organization’s security events","description":"Allows the app to read your organization’s security events without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"64733abd-851e-478a-bffb-e47a14b18235","name":"Read your organization’s security events","description":"Allows the app to read your organization’s security events on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityevents-read-all/"},{"permission":"SecurityEvents.ReadWrite.All","application":{"id":"d903a879-88e0-4c09-b0c9-82f6a1333f84","name":"Read and update your organization’s security events","description":"Allows the app to read your organization’s security events without a signed-in user. Also allows the app to update editable properties in security events.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"6aedf524-7e1c-45a7-bd76-ded8cab8d0fc","name":"Read and update your organization’s security events","description":"Allows the app to read your organization’s security events on behalf of the signed-in user. Also allows the app to update editable properties in security events on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityevents-readwrite-all/"},{"permission":"SecurityIdentitiesAccount.Read.All","application":{"id":"c5bc96f5-b4a1-4cfc-8189-d5f0d772278f","name":"Read all identity security available identity accounts","description":"Allows the app to read all the identity security available identity accounts without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"3e9ed69a-a48e-473c-8b97-413016703a37","name":"Read identity security available identity accounts","description":"Allows the app to read all the identity security available identity accounts","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityidentitiesaccount-read-all/"},{"permission":"SecurityIdentitiesActions.ReadWrite.All","application":{"id":"af2bf46f-7bf1-4be3-8bad-e17e279e8462","name":"Read and perform all identity security available actions","description":"Allows the app to read and write identity security available actions without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"818229ce-20e4-47bd-92f4-bc94dbb37a56","name":"Read and perform identity security available actions","description":"Allows the app to read and write identity security available actions on behalf of the signed-in identity.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityidentitiesactions-readwrite-all/"},{"permission":"SecurityIdentitiesAutoConfig.Read.All","application":{"id":"58971758-9844-4fe4-9fba-7e4ce7a659bf","name":"Read sensors window auditing configuration","description":"Allows the app to read sensors window auditing configuration without a signed-in user","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"8ff90903-1ecb-4f3a-b8b2-42120374ecd6","name":"Read sensors window auditing configuration","description":"Allows the app to read the sensors window auditing configuration of the signed in user","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityidentitiesautoconfig-read-all/"},{"permission":"SecurityIdentitiesAutoConfig.ReadWrite.All","application":{"id":"4f1f0deb-08d1-4ffb-8cca-21dfc362b7c0","name":"Read and write sensors window auditing configuration","description":"Allows the app to read and write sensors window auditing configuration without a signed-in user","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"b810fdb4-8733-43bd-9b37-fddb7215c69f","name":"Read and write sensors window auditing configuration","description":"Allows the app to read and write the sensors window auditing configuration of the signed in user","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityidentitiesautoconfig-readwrite-all/"},{"permission":"SecurityIdentitiesHealth.Read.All","application":{"id":"f8dcd971-5d83-4e1e-aa95-ef44611ad351","name":"Read all identity security health issues","description":"Allows the app to read all the identity security health issues without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"a0d0da43-a6df-4416-b63d-99c79991aae8","name":"Read identity security health issues","description":"Allows the app to read all the identity security health issues of signed user","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityidentitieshealth-read-all/"},{"permission":"SecurityIdentitiesHealth.ReadWrite.All","application":{"id":"ab03ddd5-7ae4-4f2e-8af8-86654f7e0a27","name":"Read and write all identity security health issues","description":"Allows the app to read and write identity security health issues without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"53e51eec-2d9b-4990-97f3-c9aa5d5652c3","name":"Read and write identity security health issues","description":"Allows the app to read and write identity security health issues on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityidentitieshealth-readwrite-all/"},{"permission":"SecurityIdentitiesMigration.Read.All","application":{"id":"b018cc1c-c680-4e91-bb6e-462ee243fdb5","name":"Read all identity security sensor migration","description":"Allows the app to read all the identity security sensor migration information without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"63595162-fcc0-4127-8b1e-bfe90b23a10e","name":"Read identity security sensor migration","description":"Allows the app to read all the identity security sensor migration information of signed user","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityidentitiesmigration-read-all/"},{"permission":"SecurityIdentitiesMigration.ReadWrite.All","application":{"id":"afd28a5a-707f-4edf-85c2-c446291e63da","name":"Read and write all identity security sensor migration","description":"Allows the app to read and write identity security sensor migration without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"741a6ef0-37e6-4b0a-9178-133d94fbc46e","name":"Read and write identity security sensor migration","description":"Allows the app to read and write identity security sensor migration on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityidentitiesmigration-readwrite-all/"},{"permission":"SecurityIdentitiesSensors.Read.All","application":{"id":"5f0ffea2-f474-4cf2-9834-61cda2bcea5c","name":"Read all identity security sensors","description":"Allows the app to read all the identity security sensors without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2c221239-7c5c-4b30-9355-d84663bfcd96","name":"Read identity security sensors","description":"Allows the app to read all the identity security sensors of signed user","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityidentitiessensors-read-all/"},{"permission":"SecurityIdentitiesSensors.ReadWrite.All","application":{"id":"d4dcee6d-0774-412a-b06c-aeabbd99e816","name":"Read and write all identity security sensors","description":"Allows the app to read and write identity security sensors without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"087c3ad9-c2ca-4b82-9885-d5e25ce9e183","name":"Read and write identity security sensors","description":"Allows the app to read and write identity security sensors on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityidentitiessensors-readwrite-all/"},{"permission":"SecurityIdentitiesUserActions.Read.All","application":{"id":"3e5d0bee-973f-4736-a123-4e1ab146f3a8","name":"Read all identity security available user actions","description":"Allows the app to read all the identity security available user actions without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"c7d0a939-da1c-4aca-80fa-d0a6cd924801","name":"Read identity security available user actions","description":"Allows the app to read all the identity security available user actions of signed user","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityidentitiesuseractions-read-all/"},{"permission":"SecurityIdentitiesUserActions.ReadWrite.All","application":{"id":"b4146a3a-dd4f-4af4-8d91-7cc0eef3d041","name":"Read and perform all identity security available user actions","description":"Allows the app to read and write identity security available user actions without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"bf230e97-1957-4df6-b3f6-57f9029eacdf","name":"Read and perform identity security available user actions","description":"Allows the app to read and write identity security available user actions on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityidentitiesuseractions-readwrite-all/"},{"permission":"SecurityIncident.Read.All","application":{"id":"45cc0394-e837-488b-a098-1918f48d186c","name":"Read all security incidents","description":"Allows the app to read all security incidents, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"b9abcc4f-94fc-4457-9141-d20ce80ec952","name":"Read incidents","description":"Allows the app to read security incidents, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityincident-read-all/"},{"permission":"SecurityIncident.ReadWrite.All","application":{"id":"34bf0e97-1971-4929-b999-9e2442d941d7","name":"Read and write to all security incidents","description":"Allows the app to read and write to all security incidents, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"128ca929-1a19-45e6-a3b8-435ec44a36ba","name":"Read and write to incidents","description":"Allows the app to read and write security incidents, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/securityincident-readwrite-all/"},{"permission":"SensitivityLabel.Evaluate","application":{"id":"57f0b71b-a759-45a0-9a0f-cc099fbd9a44","name":"Evaluate sensitivity labels","description":"Allow the app to determine if there is any sensitivity label to be applied automatically to the content or recommended to the user for manual application, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"a4633e44-d355-4474-99df-8c2de6b0e39e","name":"Evaluate sensitivity labels","description":"Allow the app to determine if there is any sensitivity label to be applied automatically to the content or recommended to the user for manual application, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sensitivitylabel-evaluate/"},{"permission":"SensitivityLabel.Evaluate.All","application":{"id":"986fa56a-6680-4aac-af09-4d1765376739","name":"Evaluate labels tenant scope.","description":"Allows the app to evaluate all sensitivity label.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"a42e3c42-b31e-4919-b699-696dca5dc9e7","name":"Evaluate labels tenant scope.","description":"Allows the app to evaluate all sensitivity label.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sensitivitylabel-evaluate-all/"},{"permission":"SensitivityLabel.Read","application":{"id":"3b8e7aad-f6e3-4299-83f8-6fc6a5777f0b","name":"Get labels application scope.","description":"Allows the app to get sensitivity labels.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"1aeb73ce-68d7-49b7-913a-eedc80844551","name":"Get labels user scope.","description":"Allows the app to get sensitivity labels.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sensitivitylabel-read/"},{"permission":"SensitivityLabels.Read.All","application":{"id":"e46a01e9-b2cf-4d89-8424-bcdc6dd445ab","name":"Get labels tenant scope.","description":"Allows the app to get sensitivity labels.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"8b377c27-ea19-4863-a948-8a8588c8f2c3","name":"Get labels app scope.","description":"Allows the app to get sensitivity labels.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sensitivitylabels-read-all/"},{"permission":"SentimentSurvey.Export.All","application":{"id":"84fa35c1-f997-4c1c-894c-bb52108cfbbf","name":"Export all Sentiment Survey","description":"Allows the app to read all Sentiment Survey, without a signed-in user. ","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"df9fd94d-51ff-443d-8f31-ae4dc1b5b8d8","name":"Export all Sentiment Survey","description":"Allows the app to export all Sentiment Survey, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sentimentsurvey-export-all/"},{"permission":"ServiceActivity-Exchange.Read.All","application":{"id":"2b655018-450a-4845-81e7-d603b1ebffdb","name":"Read all Exchange service activity","description":"Allows the app to read all Exchange service activity, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"1fe7aa48-9373-4a47-8df3-168335e0f4c9","name":"Read all Exchange service activity","description":"Allows the app to read all Exchange service activity, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/serviceactivity-exchange-read-all/"},{"permission":"ServiceActivity-Microsoft365Web.Read.All","application":{"id":"c766cb16-acc4-4663-ba09-6eedef5876c5","name":"Read all Microsoft 365 Web service activity","description":"Allows the app to read all Microsoft 365 Web service activity, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"d74c75b1-d5a9-479d-902d-92f8f99182c1","name":"Read all Microsoft 365 Web service activity","description":"Allows the app to read all Microsoft 365 Web service activity, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/serviceactivity-microsoft365web-read-all/"},{"permission":"ServiceActivity-OneDrive.Read.All","application":{"id":"57b4f899-b8c5-47c7-bdd3-c410c55602b7","name":"Read all One Drive service activity","description":"Allows the app to read all One Drive service activity, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"347e3c16-30f3-4ac7-9b52-fc3c053de9c9","name":"Read all One Drive service activity","description":"Allows the app to read all One Drive service activity, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/serviceactivity-onedrive-read-all/"},{"permission":"ServiceActivity-Teams.Read.All","application":{"id":"4dfee10b-fa4a-41b5-b34d-ccf54cc0c394","name":"Read all Teams service activity","description":"Allows the app to read all Teams service activity, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"404d76f0-e10e-460a-92be-ef19600c54d1","name":"Read all Teams service activity","description":"Allows the app to read all Teams service activity, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/serviceactivity-teams-read-all/"},{"permission":"ServiceHealth.Read.All","application":{"id":"79c261e0-fe76-4144-aad5-bdc68fbe4037","name":"Read service health","description":"Allows the app to read your tenant's service health information, without a signed-in user. Health information may include service issues or service health overviews.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"55896846-df78-47a7-aa94-8d3d4442ca7f","name":"Read service health","description":"Allows the app to read your tenant's service health information on behalf of the signed-in user. Health information may include service issues or service health overviews.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/servicehealth-read-all/"},{"permission":"ServiceMessage.Read.All","application":{"id":"1b620472-6534-4fe6-9df2-4680e8aa28ec","name":"Read service messages","description":"Allows the app to read your tenant's service announcement messages, without a signed-in user. Messages may include information about new or changed features.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"eda39fa6-f8cf-4c3c-a909-432c683e4c9b","name":"Read service announcement messages","description":"Allows the app to read your tenant's service announcement messages on behalf of the signed-in user. Messages may include information about new or changed features.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/servicemessage-read-all/"},{"permission":"ServiceMessageViewpoint.Write","application":null,"delegated":{"id":"636e1b0b-1cc2-4b1c-9aa9-4eeed9b9761b","name":"Update user status on service announcement messages","description":"Allows the app to update service announcement messages' user status on behalf of the signed-in user. The message status can be marked as read, archive, or favorite.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/servicemessageviewpoint-write/"},{"permission":"ServicePrincipalEndpoint.Read.All","application":{"id":"5256681e-b7f6-40c0-8447-2d9db68797a0","name":"Read service principal endpoints","description":"Allows the app to read service principal endpoints","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9f9ce928-e038-4e3b-8faf-7b59049a8ddc","name":"Read service principal endpoints","description":"Allows the app to read service principal endpoints","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/serviceprincipalendpoint-read-all/"},{"permission":"ServicePrincipalEndpoint.ReadWrite.All","application":{"id":"89c8469c-83ad-45f7-8ff2-6e3d4285709e","name":"Read and update service principal endpoints","description":"Allows the app to update service principal endpoints","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"delegated":{"id":"7297d82c-9546-4aed-91df-3d4f0a9b3ff0","name":"Read and update service principal endpoints","description":"Allows the app to update service principal endpoints","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/serviceprincipalendpoint-readwrite-all/"},{"permission":"SharePointCrossTenantMigration.Manage.All","application":{"id":"a0521574-fcd8-4742-b29c-f796df57ea70","name":"Read, write and manage SharePoint Cross-Tenant migration settings and tasks","description":"Allows the app to read, write and manage your tenant's SharePoint Cross-Tenant migration settings and tasks, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"c608c170-08b5-466b-a8fe-0b4074b01613","name":"Read, write and manage SharePoint Cross-Tenant migration settings and tasks","description":"Allows the app to read, write and manage your tenant's SharePoint Cross-Tenant migration settings and tasks, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sharepointcrosstenantmigration-manage-all/"},{"permission":"SharePointCrossTenantMigration.Read.All","application":{"id":"f5fa52a5-b9ab-4dc3-885e-9e5b4a67068e","name":"Read SharePoint Cross-Tenant migration settings and tasks","description":"Allows the app to read your tenant's SharePoint Cross-Tenant migration settings and tasks, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"00dcb678-f9af-4e73-acb1-4f1657364629","name":"Read SharePoint Cross-Tenant migration settings and tasks","description":"Allows the app to read your tenant's SharePoint Cross-Tenant migration settings and tasks, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sharepointcrosstenantmigration-read-all/"},{"permission":"SharePointTenantSettings.Read.All","application":{"id":"83d4163d-a2d8-4d3b-9695-4ae3ca98f888","name":"Read SharePoint and OneDrive tenant settings","description":"Allows the application to read the tenant-level settings of SharePoint and OneDrive, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2ef70e10-5bfd-4ede-a5f6-67720500b258","name":"Read SharePoint and OneDrive tenant settings","description":"Allows the application to read the tenant-level settings in SharePoint and OneDrive on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sharepointtenantsettings-read-all/"},{"permission":"SharePointTenantSettings.ReadWrite.All","application":{"id":"19b94e34-907c-4f43-bde9-38b1909ed408","name":"Read and change SharePoint and OneDrive tenant settings","description":"Allows the application to read and change the tenant-level settings of SharePoint and OneDrive, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"aa07f155-3612-49b8-a147-6c590df35536","name":"Read and change SharePoint and OneDrive tenant settings","description":"Allows the application to read and change the tenant-level settings of SharePoint and OneDrive on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sharepointtenantsettings-readwrite-all/"},{"permission":"ShortNotes.Read","application":null,"delegated":{"id":"50f66e47-eb56-45b7-aaa2-75057d9afe08","name":"Read short notes of the signed-in user","description":"Allows the app to read all the short notes a sign-in user has access to.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/shortnotes-read/"},{"permission":"ShortNotes.Read.All","application":{"id":"0c7d31ec-31ca-4f58-b6ec-9950b6b0de69","name":"Read all users' short notes","description":"Allows the app to read all the short notes without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/shortnotes-read-all/"},{"permission":"ShortNotes.ReadWrite","application":null,"delegated":{"id":"328438b7-4c01-4c07-a840-e625a749bb89","name":"Read, create, edit, and delete short notes of the signed-in user","description":"Allows the app to read, create, edit, and delete short notes of a signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/shortnotes-readwrite/"},{"permission":"ShortNotes.ReadWrite.All","application":{"id":"842c284c-763d-4a97-838d-79787d129bab","name":"Read, create, edit, and delete all users' short notes","description":"Allows the app to read, create, edit, and delete all the short notes without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/shortnotes-readwrite-all/"},{"permission":"SignInIdentifier.Read.All","application":{"id":"28e1fe78-598f-4df4-b55e-18bf34218925","name":"Read all sign-in identifiers","description":"Allows the app to read your organization's sign-in identifiers, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"458e1edc-1e75-438c-8c7b-c32115c9d373","name":"Read SignInIdentifiers","description":"Allows the app to read your organization's sign-in identifiers, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/signinidentifier-read-all/"},{"permission":"SignInIdentifier.ReadWrite.All","application":{"id":"7fc588a2-ea2d-4d1f-bcf7-33c324b149b8","name":"Read and write all sign-in identifiers","description":"Allows the app to read and write your organization's sign-in identifiers, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"b4673c3c-7b5a-4012-9826-7c7e3c8db6af","name":"Read and write all sign-in identifiers","description":"Allows the app to read and write your organization's sign-in identifiers, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/signinidentifier-readwrite-all/"},{"permission":"Sites.Archive.All","application":{"id":"e3530185-4080-478c-a4ab-39322704df58","name":"Archive/reactivate Site Collections without a signed in user.","description":"Allow the application to archive/reactivate site collections without a signed in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sites-archive-all/"},{"permission":"Sites.Create.All","application":{"id":"80819dd8-2b3b-4551-a1ad-2700fc44f533","name":"Create Site Collections without a signed in user.","description":"Allow the application to create site collections without a signed in user. Upon creation the application will be granted Sites.Selected(application) + FullControl to the newly created site.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"0e2e68e1-3f32-4e10-9281-f749e097fcbe","name":"Create Site Collections, on behalf of the signed-in user","description":"Allow the application to create site collections on behalf of the signed in user. Upon creation the application will be granted Sites.Selected(delegated) + FullControl to the newly created site.","adminConsent":true,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sites-create-all/"},{"permission":"Sites.FullControl.All","application":{"id":"a82116e5-55eb-4c41-a434-62fe8a61c773","name":"Have full control of all site collections","description":"Allows the app to have full control of all site collections without a signed in user.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"delegated":{"id":"5a54b8b3-347c-476d-8f8e-42d5c7424d29","name":"Have full control of all site collections","description":"Allows the application to have full control of all site collections on behalf of the signed-in user.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"leastPrivilege":"Use Sites.Selected with the narrowest role on specific sites.","url":"https://azureblog.co.uk/graph-permissions/sites-fullcontrol-all/"},{"permission":"Sites.Manage.All","application":{"id":"0c0bf378-bf22-4481-8f81-9e89a9b4960a","name":"Create, edit, and delete items and lists in all site collections","description":"Allows the app to create or delete document libraries and lists in all site collections without a signed in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"65e50fdc-43b7-4915-933e-e8138f11f40a","name":"Create, edit, and delete items and lists in all site collections","description":"Allows the application to create or delete document libraries and lists in all site collections on behalf of the signed-in user.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sites-manage-all/"},{"permission":"Sites.Read.All","application":{"id":"332a536c-c7ef-4017-ab91-336970924f0d","name":"Read items in all site collections ","description":"Allows the app to read documents and list items in all site collections without a signed in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"205e70e5-aba6-4c52-a976-6d2d46c48043","name":"Read items in all site collections","description":"Allows the application to read documents and list  items in all site collections on behalf of the signed-in user","adminConsent":false,"risk":"Medium","riskReason":"Reads or changes the signed-in user's content, limited to what that user can access."},"leastPrivilege":"Use Sites.Selected and grant access to only the sites the app needs.","url":"https://azureblog.co.uk/graph-permissions/sites-read-all/"},{"permission":"Sites.ReadWrite.All","application":{"id":"9492366f-7969-46a4-8d15-ed1a20078fff","name":"Read and write items in all site collections","description":"Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user.","adminConsent":true,"risk":"High","riskReason":"As an application permission this reaches every user's data in the tenant, without anyone signed in."},"delegated":{"id":"89fe6a52-be36-487e-b7d8-d061c450a026","name":"Edit or delete items in all site collections","description":"Allows the application to edit or delete documents and list items in all site collections on behalf of the signed-in user.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":"Use Sites.Selected and grant access to only the sites the app needs.","url":"https://azureblog.co.uk/graph-permissions/sites-readwrite-all/"},{"permission":"Sites.Selected","application":{"id":"883ea226-0bf2-4a8f-9f9d-92c9162a727d","name":"Access selected site collections","description":"Allow the application to access a subset of site collections without a signed in user.  The specific site collections and the permissions granted will be configured in SharePoint Online.","adminConsent":true,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"delegated":{"id":"f89c84ef-20d0-4b54-87e9-02e856d66d53","name":"Access selected Sites, on behalf of the signed-in user","description":"Allow the application to access a subset of site collections on behalf of the signed-in user.  The specific site collections and the permissions granted will be configured in SharePoint Online.","adminConsent":false,"risk":"Low","riskReason":"Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/sites-selected/"},{"permission":"SMTP.Send","application":null,"delegated":{"id":"258f6531-6087-4cc4-bb90-092c5fb3ed3f","name":"Send emails from mailboxes using SMTP AUTH.","description":"Allows the app to be able to send emails from the user’s mailbox using the SMTP AUTH client submission protocol.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/smtp-send/"},{"permission":"SpiffeTrustDomain.Read.All","application":{"id":"dcdfc277-41fd-4d68-ad0c-c3057235bd8e","name":"Read SPIFFE trust domains and child resources","description":"Allows the app to read your organization's SPIFFE trust domains and child resources without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9b4aa4b1-aaf3-41b7-b743-698b27e77ff6","name":"Read SPIFFE trust domains and child resources","description":"Allows the app to read your organization's SPIFFE trust domains and child resources on behalf of the user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/spiffetrustdomain-read-all/"},{"permission":"SpiffeTrustDomain.ReadWrite.All","application":{"id":"17b78cfd-eeff-447d-8bab-2795af00055a","name":"Read and write SPIFFE trust domains and child resources","description":"Allows the app to read and write your organization's SPIFFE trust domains and child resources without a signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"8ba47079-8c47-4bfe-b2ce-13f28ef37247","name":"Read and write SPIFFE trust domains and child resources","description":"Allows the app to read and write your organization's SPIFFE trust domains and child resources on behalf of the user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/spiffetrustdomain-readwrite-all/"},{"permission":"Storyline.ReadWrite.All","application":{"id":"6eff534b-699e-44d9-af61-a4182f0ec37e","name":"Read and write all Viva Engage storylines","description":"Allows the app to modify Viva Engage storylines, read all storylines properties, update storyline properties, and delete storyline properties without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"fd1d61cb-4e4b-4d15-a6d2-161348681d84","name":"Read and write all Viva Engage storylines","description":"Allows the app to modify the Viva Engage storyline and read all storyline properties on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/storyline-readwrite-all/"},{"permission":"SubjectNameRegistration.ReadWrite","application":null,"delegated":{"id":"fb0d7592-1943-4141-a7bc-b7ae45b84ecf","name":"Read and write a subject name registration.","description":"Allows the app to read and write all the subject name registration properties on behalf of the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/subjectnameregistration-readwrite/"},{"permission":"SubjectRightsRequest.Read.All","application":{"id":"ee1460f0-368b-4153-870a-4e1ca7e72c42","name":"Read all subject rights requests","description":"Allows the app to read subject rights requests without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9c3af74c-fd0f-4db4-b17a-71939e2a9d77","name":"Read subject rights requests","description":"Allows the app to read subject rights requests on behalf of the signed-in user","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/subjectrightsrequest-read-all/"},{"permission":"SubjectRightsRequest.ReadWrite.All","application":{"id":"8387eaa4-1a3c-41f5-b261-f888138e6041","name":"Read and write all subject rights requests","description":"Allows the app to read and write subject rights requests without a signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"2b8fcc74-bce1-4ae3-a0e8-60c53739299d","name":"Read and write subject rights requests","description":"Allows the app to read and write subject rights requests on behalf of the signed-in user","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/subjectrightsrequest-readwrite-all/"},{"permission":"Subscription.Read.All","application":null,"delegated":{"id":"5f88184c-80bb-4d52-9ff2-757288b2e9b7","name":"Read all webhook subscriptions ","description":"Allows the app to read all webhook subscriptions on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/subscription-read-all/"},{"permission":"Synchronization.Read.All","application":{"id":"5ba43d2f-fa88-4db2-bd1c-a67c5f0fb1ce","name":"Read all Azure AD synchronization data.","description":"Allows the application to read Azure AD synchronization information, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"7aa02aeb-824f-4fbe-a3f7-611f751f5b55","name":"Read all Azure AD synchronization data","description":"Allows the app to read Azure AD synchronization information, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/synchronization-read-all/"},{"permission":"Synchronization.ReadWrite.All","application":{"id":"9b50c33d-700f-43b1-b2eb-87e89b703581","name":"Read and write all Azure AD synchronization data.","description":"Allows the application to configure the Azure AD synchronization service, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"7bb27fa3-ea8f-4d67-a916-87715b6188bd","name":"Read and write all Azure AD synchronization data","description":"Allows the app to configure the Azure AD synchronization service, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/synchronization-readwrite-all/"},{"permission":"SynchronizationData-User.Upload","application":{"id":"db31e92a-b9ea-4d87-bf6a-75a37a9ca35a","name":"Upload user data to the identity synchronization service","description":"Allows the application to upload bulk user data to the identity synchronization service, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"1a2e7420-4e92-4d2b-94cb-fb2952e9ddf7","name":"Upload user data to the identity synchronization service","description":"Allows the app to upload bulk user data to the identity synchronization service, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/synchronizationdata-user-upload/"},{"permission":"SynchronizationData-User.Upload.OwnedBy","application":{"id":"25c32ff3-849a-494b-b94f-20a8ac4e6774","name":"Upload user data to the identity sync service for apps that this application creates or owns","description":"Allows the application to upload bulk user data to the identity synchronization service for apps that this application creates or owns, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/synchronizationdata-user-upload-ownedby/"},{"permission":"SynchronizationMetadata.Read.All","application":{"id":"9c668bfa-7e4d-4ea4-9f0b-ba2d67cac55c","name":"Read synchronization metadata for all provisioning jobs","description":"Allows the app to read synchronization job metadata and object connection linkage information across all service principal provisioning jobs in the organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"711dc0a5-feb5-4e98-958c-cce64a7f5c99","name":"Read synchronization metadata that you can access","description":"Allows the app to read synchronization job metadata and object connection linkage information across all service principal provisioning jobs in the organization.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/synchronizationmetadata-read-all/"},{"permission":"SynchronizationMetadata.Read.OwnedBy","application":{"id":"7090aa1b-99c0-444b-b40b-528bd2f35087","name":"Read synchronization metadata for owned provisioning jobs","description":"Allows the app to read synchronization job metadata and object connection linkage information only for provisioning jobs associated with (owned by) its service principals.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/synchronizationmetadata-read-ownedby/"},{"permission":"SynchronizationMetadata.ReadWrite.All","application":{"id":"71a8afcf-c9ac-4704-a49c-a2520ddfc6d8","name":"Read and manage synchronization metadata for all provisioning jobs","description":"Allows the app to read, delete object connections, and manage synchronization job metadata and linkage information across all service principal provisioning jobs in the organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"024b13ed-0f01-4565-8f66-a79471c51cf4","name":"Read and manage synchronization metadata that you can access","description":"Allows the app to read, delete object connections, and manage synchronization job metadata and linkage information across all service principal provisioning jobs the signed-in user can access.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/synchronizationmetadata-readwrite-all/"},{"permission":"SynchronizationMetadata.ReadWrite.OwnedBy","application":{"id":"dc64b9ee-d7b6-4de6-97d3-189051d1c773","name":"Read and manage synchronization metadata for owned provisioning jobs","description":"Allows the app to read, delete object connections, and manage synchronization job metadata and linkage information only for provisioning jobs associated with (owned by) its service principals.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/synchronizationmetadata-readwrite-ownedby/"},{"permission":"Tasks.Read","application":null,"delegated":{"id":"f45671fb-e0fe-4b4b-be20-3d3ce43f1bcb","name":"Read user's tasks and task lists","description":"Allows the app to read the signed-in user’s tasks and task lists, including any shared with the user. Doesn't include permission to create, delete, or update anything.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tasks-read/"},{"permission":"Tasks.Read.All","application":{"id":"f10e1f91-74ed-437f-a6fd-d6ae88e26c1f","name":"Read all users’ tasks and tasklist","description":"Allows the app to read all users’ tasks and task lists in your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tasks-read-all/"},{"permission":"Tasks.Read.Shared","application":null,"delegated":{"id":"88d21fd4-8e5a-4c32-b5e2-4a1c95f34f72","name":"Read user and shared tasks","description":"Allows the app to read tasks a user has permissions to access, including their own and shared tasks.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tasks-read-shared/"},{"permission":"Tasks.ReadWrite","application":null,"delegated":{"id":"2219042f-cab5-40cc-b0d2-16b1540b4c5f","name":"Create, read, update, and delete user’s tasks and task lists","description":"Allows the app to create, read, update, and delete the signed-in user's tasks and task lists, including any shared with the user.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tasks-readwrite/"},{"permission":"Tasks.ReadWrite.All","application":{"id":"44e666d1-d276-445b-a5fc-8815eeb81d55","name":"Read and write all users’ tasks and tasklists","description":"Allows the app to create, read, update and delete all users’ tasks and task lists in your organization, without a signed-in user","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tasks-readwrite-all/"},{"permission":"Tasks.ReadWrite.Shared","application":null,"delegated":{"id":"c5ddf11b-c114-4886-8558-8a4e557cd52b","name":"Read and write user and shared tasks","description":"Allows the app to create, read, update, and delete tasks a user has permissions to, including their own and shared tasks.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tasks-readwrite-shared/"},{"permission":"Team.Create","application":{"id":"23fc2474-f741-46ce-8465-674744c5c361","name":"Create teams","description":"Allows the app to create teams without a signed-in user. ","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"7825d5d6-6049-4ce7-bdf6-3b8d53f4bcd0","name":"Create teams","description":"Allows the app to create teams on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/team-create/"},{"permission":"Team.ReadBasic.All","application":{"id":"2280dda6-0bfd-44ee-a2f4-cb867cfc4c1e","name":"Get a list of all teams","description":"Get a list of all teams, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"485be79e-c497-4b35-9400-0e3fa7f2a5d4","name":"Read the names and descriptions of teams","description":"Read the names and  descriptions of teams, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/team-readbasic-all/"},{"permission":"TeamMember.Read.All","application":{"id":"660b7406-55f1-41ca-a0ed-0b035e182f3e","name":"Read the members of all teams","description":"Read the members of all teams, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"2497278c-d82d-46a2-b1ce-39d4cdde5570","name":"Read the members of teams","description":"Read the members of teams, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teammember-read-all/"},{"permission":"TeamMember.ReadWrite.All","application":{"id":"0121dc95-1b9f-4aed-8bac-58c5ac466691","name":"Add and remove members from all teams","description":"Add and remove members from all teams, without a signed-in user. Also allows changing a team member's role, for example from owner to non-owner.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"4a06efd2-f825-4e34-813e-82a57b03d1ee","name":"Add and remove members from teams","description":"Add and remove members from teams, on behalf of the signed-in user. Also allows changing a member's role, for example from owner to non-owner.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teammember-readwrite-all/"},{"permission":"TeamMember.ReadWriteNonOwnerRole.All","application":{"id":"4437522e-9a86-4a41-a7da-e380edd4a97d","name":"Add and remove members with non-owner role for all teams","description":"Add and remove members from all teams, without a signed-in user. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"2104a4db-3a2f-4ea0-9dba-143d457dc666","name":"Add and remove members with non-owner role for all teams","description":"Add and remove members from all teams, on behalf of the signed-in user. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teammember-readwritenonownerrole-all/"},{"permission":"TeamsActivity.Read","application":null,"delegated":{"id":"0e755559-83fb-4b44-91d0-4cc721b9323e","name":"Read user's teamwork activity feed","description":"Allows the app to read the signed-in user's teamwork activity feed.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsactivity-read/"},{"permission":"TeamsActivity.Read.All","application":{"id":"70dec828-f620-4914-aa83-a29117306807","name":"Read all users' teamwork activity feed","description":"Allows the app to read all users' teamwork activity feed, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsactivity-read-all/"},{"permission":"TeamsActivity.Send","application":{"id":"a267235f-af13-44dc-8385-c1dc93023186","name":"Send a teamwork activity to any user","description":"Allows the app to create new notifications in users' teamwork activity feeds without a signed in user. These notifications may not be discoverable or be held or governed by compliance policies.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"7ab1d787-bae7-4d5d-8db6-37ea32df9186","name":"Send a teamwork activity as the user","description":"Allows the app to create new notifications in users' teamwork activity feeds on behalf of the signed in user. These notifications may not be discoverable or be held or governed by compliance policies.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsactivity-send/"},{"permission":"TeamsAppInstallation.ManageSelectedForChat","application":null,"delegated":{"id":"d1ba22c6-3f02-4c91-addb-bc3399bcca88","name":"Manage installation and permission grants of selected Teams apps in chats","description":"Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Gives the ability to manage permission grants for accessing those specific chats' data.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-manageselectedforchat/"},{"permission":"TeamsAppInstallation.ManageSelectedForChat.All","application":{"id":"22b74aab-d9e4-46f7-9424-f24b42307227","name":"Manage installation and permission grants of selected Teams apps in all chats","description":"Allows the app to read, install, upgrade, and uninstall selected Teams apps in any chat, without a signed-in user. Gives the ability to manage permission grants for accessing those specific chats' data.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-manageselectedforchat-all/"},{"permission":"TeamsAppInstallation.ManageSelectedForTeam","application":null,"delegated":{"id":"c67b2d7e-6b80-4218-938a-05e73058e42d","name":"Manage installation and permission grants of selected Teams apps in teams","description":"Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Gives the ability to manage permission grants for accessing those specific teams' data.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-manageselectedforteam/"},{"permission":"TeamsAppInstallation.ManageSelectedForTeam.All","application":{"id":"b448d252-1f26-4227-b6ff-21ab510975a2","name":"Manage installation and permission grants of selected Teams apps in all teams","description":"Allows the app to read, install, upgrade, and uninstall selected Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams' data.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-manageselectedforteam-all/"},{"permission":"TeamsAppInstallation.ManageSelectedForUser","application":null,"delegated":{"id":"830c2bd9-c335-4caf-bf83-c07fa8a23ef1","name":"Manage installation and permission grants of selected Teams apps in users' personal scope","description":"Allows the app to read, install, upgrade, and uninstall seleected Teams apps in user accounts, on behalf of the signed-in user. Gives the ability to manage permission grants for accessing those specific users' data.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-manageselectedforuser/"},{"permission":"TeamsAppInstallation.ManageSelectedForUser.All","application":{"id":"e97a9235-5b3c-43c4-b37d-6786a173fae4","name":"Manage installation and permission grants of selected Teams apps for all user accounts","description":"Allows the app to read, install, upgrade, and uninstall selected Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users' data.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-manageselectedforuser-all/"},{"permission":"TeamsAppInstallation.Read.All","application":{"id":"0fdf35a5-82f8-41ff-9ded-0b761cc73512","name":"Read installed Teams apps for all installation scopes","description":"Allows the app to read the Teams apps that are installed in any scope, without a signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-read-all/"},{"permission":"TeamsAppInstallation.ReadForChat","application":null,"delegated":{"id":"bf3fbf03-f35f-4e93-963e-47e4d874c37a","name":"Read installed Teams apps in chats","description":"Allows the app to read the Teams apps that are installed in chats the signed-in user can access. Does not give the ability to read application-specific settings.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readforchat/"},{"permission":"TeamsAppInstallation.ReadForChat.All","application":{"id":"cc7e7635-2586-41d6-adaa-a8d3bcad5ee5","name":"Read installed Teams apps for all chats","description":"Allows the app to read the Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readforchat-all/"},{"permission":"TeamsAppInstallation.ReadForTeam","application":null,"delegated":{"id":"5248dcb1-f83b-4ec3-9f4d-a4428a961a72","name":"Read installed Teams apps in teams","description":"Allows the app to read the Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readforteam/"},{"permission":"TeamsAppInstallation.ReadForTeam.All","application":{"id":"1f615aea-6bf9-4b05-84bd-46388e138537","name":"Read installed Teams apps for all teams","description":"Allows the app to read the Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readforteam-all/"},{"permission":"TeamsAppInstallation.ReadForUser","application":null,"delegated":{"id":"c395395c-ff9a-4dba-bc1f-8372ba9dca84","name":"Read user's installed Teams apps","description":"Allows the app to read the Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readforuser/"},{"permission":"TeamsAppInstallation.ReadForUser.All","application":{"id":"9ce09611-f4f7-4abd-a629-a05450422a97","name":"Read installed Teams apps for all users","description":"Allows the app to read the Teams apps that are installed for any user, without a signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readforuser-all/"},{"permission":"TeamsAppInstallation.ReadSelectedForChat","application":null,"delegated":{"id":"0f3420c2-c6ec-46de-ab72-fd51267087d5","name":"Read selected installed Teams apps in chats","description":"Allows the app to read the selected Teams apps that are installed in chats the signed-in user can access. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readselectedforchat/"},{"permission":"TeamsAppInstallation.ReadSelectedForChat.All","application":{"id":"53d40ddb-9b27-4c97-b800-985be6041990","name":"Read selected installed Teams apps in all chats","description":"Allows the app to read the selected Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readselectedforchat-all/"},{"permission":"TeamsAppInstallation.ReadSelectedForTeam","application":null,"delegated":{"id":"b55df1c0-db20-435b-aef2-afe6ed487e16","name":"Read selected installed Teams apps in teams","description":"Allows the app to read the selected Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readselectedforteam/"},{"permission":"TeamsAppInstallation.ReadSelectedForTeam.All","application":{"id":"93c6a289-70fd-489e-a053-6cf8f7d772f6","name":"Read selected installed Teams apps in all teams","description":"Allows the app to read the selected Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readselectedforteam-all/"},{"permission":"TeamsAppInstallation.ReadSelectedForUser","application":null,"delegated":{"id":"fe2e4e1d-101f-4fb2-9cb1-9d6659db45d4","name":"Read user's selected installed Teams apps","description":"Allows the app to read the selected Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readselectedforuser/"},{"permission":"TeamsAppInstallation.ReadSelectedForUser.All","application":{"id":"44fb0e7c-1f9a-47f1-bb9e-7f92d48ed288","name":"Read selected installed Teams apps for all users","description":"Allows an app to read, install, upgrade, and uninstall selected apps to any user, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readselectedforuser-all/"},{"permission":"TeamsAppInstallation.ReadWriteAndConsentForChat","application":null,"delegated":{"id":"e1408a66-8f82-451b-a2f3-3c3e38f7413f","name":"Manage installed Teams apps in chats","description":"Allows the app to read, install, upgrade, and uninstall Teams apps in chats the signed-in user can access. Gives the ability to manage permission grants for accessing those specific chats' data.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteandconsentforchat/"},{"permission":"TeamsAppInstallation.ReadWriteAndConsentForChat.All","application":{"id":"6e74eff9-4a21-45d6-bc03-3a20f61f8281","name":"Manage installation and permission grants of Teams apps for all chats","description":"Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Gives the ability to manage permission grants for accessing those specific chats' data.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteandconsentforchat-all/"},{"permission":"TeamsAppInstallation.ReadWriteAndConsentForTeam","application":null,"delegated":{"id":"946349d5-2a9d-4535-abc0-7beeacaedd1d","name":"Manage installed Teams apps in teams","description":"Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Gives the ability to manage permission grants for accessing those specific teams' data.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteandconsentforteam/"},{"permission":"TeamsAppInstallation.ReadWriteAndConsentForTeam.All","application":{"id":"b0c13be0-8e20-4bc5-8c55-963c23a39ce9","name":"Manage installation and permission grants of Teams apps for all teams","description":"Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams' data.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteandconsentforteam-all/"},{"permission":"TeamsAppInstallation.ReadWriteAndConsentForUser","application":null,"delegated":{"id":"2da62c49-dfbd-40df-ba16-fef3529d391c","name":"Manage installation and permission grants of Teams apps in users' personal scope","description":"Allows the app to read, install, upgrade, and uninstall Teams apps in user accounts, on behalf of the signed-in user. Gives the ability to manage permission grants for accessing those specific users' data.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteandconsentforuser/"},{"permission":"TeamsAppInstallation.ReadWriteAndConsentForUser.All","application":{"id":"32ca478f-f89e-41d0-aaf8-101deb7da510","name":"Manage installation and permission grants of Teams apps in a user account","description":"Allows the app to read, install, upgrade, and uninstall Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users' data.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteandconsentforuser-all/"},{"permission":"TeamsAppInstallation.ReadWriteAndConsentSelfForChat","application":null,"delegated":{"id":"a0e0e18b-8fb2-458f-8130-da2d7cab9c75","name":"Allow the Teams app to manage itself and its permission grants in chats","description":"Allows a Teams app to read, install, upgrade, and uninstall itself in chats the signed-in user can access, and manage its permission grants for accessing those specific chats' data.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteandconsentselfforchat/"},{"permission":"TeamsAppInstallation.ReadWriteAndConsentSelfForChat.All","application":{"id":"ba1ba90b-2d8f-487e-9f16-80728d85bb5c","name":"Allow the Teams app to manage itself and its permission grants for all chats","description":"Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user, and manage its permission grants for accessing those specific chats' data.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteandconsentselfforchat-all/"},{"permission":"TeamsAppInstallation.ReadWriteAndConsentSelfForTeam","application":null,"delegated":{"id":"4a6bbf29-a0e1-4a4d-a7d1-cef17f772975","name":"Allow the Teams app to manage itself and its permission grants in teams","description":"Allows a Teams app to read, install, upgrade, and uninstall itself in teams the signed-in user can access, and manage its permission grants for accessing those specific teams' data.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteandconsentselfforteam/"},{"permission":"TeamsAppInstallation.ReadWriteAndConsentSelfForTeam.All","application":{"id":"1e4be56c-312e-42b8-a2c9-009600d732c0","name":"Allow the Teams app to manage itself and its permission grants for all teams","description":"Allows a Teams app to read, install, upgrade, and uninstall itself for any team, without a signed-in user, and manage its permission grants for accessing those specific teams' data.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteandconsentselfforteam-all/"},{"permission":"TeamsAppInstallation.ReadWriteAndConsentSelfForUser","application":null,"delegated":{"id":"7a349935-c54d-44ab-ab66-1b460d315be7","name":"Allow the Teams app to manage itself and its permission grants in user accounts","description":"Allows a Teams app to read, install, upgrade, and uninstall itself in user accounts, and manage its permission grants for accessing those specific users' data, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteandconsentselfforuser/"},{"permission":"TeamsAppInstallation.ReadWriteAndConsentSelfForUser.All","application":{"id":"a87076cf-6abd-4e56-8559-4dbdf41bef96","name":"Allow the Teams app to manage itself and its permission grants in all user accounts","description":"Allows a Teams app to read, install, upgrade, and uninstall itself for any user account, without a signed-in user, and manage its permission grants for accessing those specific users' data.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteandconsentselfforuser-all/"},{"permission":"TeamsAppInstallation.ReadWriteForChat","application":null,"delegated":{"id":"aa85bf13-d771-4d5d-a9e6-bca04ce44edf","name":"Manage installed Teams apps in chats","description":"Allows the app to read, install, upgrade, and uninstall Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteforchat/"},{"permission":"TeamsAppInstallation.ReadWriteForChat.All","application":{"id":"9e19bae1-2623-4c4f-ab6e-2664615ff9a0","name":"Manage Teams apps for all chats","description":"Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteforchat-all/"},{"permission":"TeamsAppInstallation.ReadWriteForTeam","application":null,"delegated":{"id":"2e25a044-2580-450d-8859-42eeb6e996c0","name":"Manage installed Teams apps in teams","description":"Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteforteam/"},{"permission":"TeamsAppInstallation.ReadWriteForTeam.All","application":{"id":"5dad17ba-f6cc-4954-a5a2-a0dcc95154f0","name":"Manage Teams apps for all teams","description":"Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteforteam-all/"},{"permission":"TeamsAppInstallation.ReadWriteForUser","application":null,"delegated":{"id":"093f8818-d05f-49b8-95bc-9d2a73e9a43c","name":"Manage user's installed Teams apps","description":"Allows the app to read, install, upgrade, and uninstall Teams apps installed for the signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteforuser/"},{"permission":"TeamsAppInstallation.ReadWriteForUser.All","application":{"id":"74ef0291-ca83-4d02-8c7e-d2391e6a444f","name":"Manage Teams apps for all users","description":"Allows the app to read, install, upgrade, and uninstall Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteforuser-all/"},{"permission":"TeamsAppInstallation.ReadWriteSelectedForChat","application":null,"delegated":{"id":"690aa3b6-4b71-41c2-a990-77a8c4768d2b","name":"Manage selected Teams apps installed in chats","description":"Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteselectedforchat/"},{"permission":"TeamsAppInstallation.ReadWriteSelectedForChat.All","application":{"id":"25bbeaad-04be-4207-83ed-a263aae76ddf","name":"Manage selected installed Teams apps in all chats","description":"Allows the app to read, install, upgrade, and uninstall selected Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteselectedforchat-all/"},{"permission":"TeamsAppInstallation.ReadWriteSelectedForTeam","application":null,"delegated":{"id":"9131c833-9a49-4c54-b38f-615ecfc4fc69","name":"Manage selected Teams apps installed in teams","description":"Allows the app to read, install, upgrade, and uninstall selected Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteselectedforteam/"},{"permission":"TeamsAppInstallation.ReadWriteSelectedForTeam.All","application":{"id":"7b5823ae-d0f2-424d-b90c-d843ffada7d9","name":"Manage selected installed Teams apps in all teams","description":"Allows the app to read, install, upgrade, and uninstall selected Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteselectedforteam-all/"},{"permission":"TeamsAppInstallation.ReadWriteSelectedForUser","application":null,"delegated":{"id":"ea819e27-c92a-4118-b83b-4540b125d744","name":"Manage selected Teams apps installed for a user","description":"Allows the app to read, install, upgrade, and uninstall selected Teams apps installed for the signed in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteselectedforuser/"},{"permission":"TeamsAppInstallation.ReadWriteSelectedForUser.All","application":{"id":"650a76ec-4118-4b25-9d3a-1f98048a5ee0","name":"Manage selected Teams apps installed for all users","description":"Allows the app to read, install, upgrade, and uninstall selected Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteselectedforuser-all/"},{"permission":"TeamsAppInstallation.ReadWriteSelfForChat","application":null,"delegated":{"id":"0ce33576-30e8-43b7-99e5-62f8569a4002","name":"Allow the Teams app to manage itself in chats","description":"Allows a Teams app to read, install, upgrade, and uninstall itself in chats the signed-in user can access.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteselfforchat/"},{"permission":"TeamsAppInstallation.ReadWriteSelfForChat.All","application":{"id":"73a45059-f39c-4baf-9182-4954ac0e55cf","name":"Allow the Teams app to manage itself for all chats","description":"Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteselfforchat-all/"},{"permission":"TeamsAppInstallation.ReadWriteSelfForTeam","application":null,"delegated":{"id":"0f4595f7-64b1-4e13-81bc-11a249df07a9","name":"Allow the app to manage itself in teams","description":"Allows a Teams app to read, install, upgrade, and uninstall itself to teams the signed-in user can access.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteselfforteam/"},{"permission":"TeamsAppInstallation.ReadWriteSelfForTeam.All","application":{"id":"9f67436c-5415-4e7f-8ac1-3014a7132630","name":"Allow the Teams app to manage itself for all teams","description":"Allows a Teams app to read, install, upgrade, and uninstall itself in any team, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteselfforteam-all/"},{"permission":"TeamsAppInstallation.ReadWriteSelfForUser","application":null,"delegated":{"id":"207e0cb1-3ce7-4922-b991-5a760c346ebc","name":"Allow the Teams app to manage itself for a user","description":"Allows a Teams app to read, install, upgrade, and uninstall itself for the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteselfforuser/"},{"permission":"TeamsAppInstallation.ReadWriteSelfForUser.All","application":{"id":"908de74d-f8b2-4d6b-a9ed-2a17b3b78179","name":"Allow the app to manage itself for all users","description":"Allows a Teams app to read, install, upgrade, and uninstall itself to any user, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsappinstallation-readwriteselfforuser-all/"},{"permission":"TeamSettings.Read.All","application":{"id":"242607bd-1d2c-432c-82eb-bdb27baa23ab","name":"Read all teams' settings","description":"Read all team's settings, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"48638b3c-ad68-4383-8ac4-e6880ee6ca57","name":"Read teams' settings","description":"Read all teams' settings, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsettings-read-all/"},{"permission":"TeamSettings.ReadWrite.All","application":{"id":"bdd80a03-d9bc-451d-b7c4-ce7c63fe3c8f","name":"Read and change all teams' settings","description":"Read and change all teams' settings, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"39d65650-9d3e-4223-80db-a335590d027e","name":"Read and change teams' settings","description":"Read and change all teams' settings, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsettings-readwrite-all/"},{"permission":"TeamsPolicyUserAssign.ReadWrite.All","application":{"id":"1801e8f4-cf09-4c4e-a1b5-036dfcca6c90","name":"Read and Write Teams policy user assignment and unassigment for all policy types.","description":"Allow the app to read or write/update the policy assignment and unassigment for Teams users for all policy type categories.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"6997c35c-a586-440c-8a0b-4ffe5d118dc0","name":"Read and Write Teams policy user assignment and unassigment for all policy types.","description":"Allow the app to read or write/update the policy assignment and unassigment for Teams users for all policy type categories.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamspolicyuserassign-readwrite-all/"},{"permission":"TeamsResourceAccount.Read.All","application":{"id":"b55aa226-33a1-4396-bcf4-edce5e7a31c1","name":"Read Teams resource accounts","description":"Allows the app to read your tenant's resource accounts without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ea2cbd09-253c-4f69-a0e6-07383c5f07cc","name":"Read Teams resource accounts","description":"Allows the app to read your tenant's resource accounts on behalf of the signed-in admin user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsresourceaccount-read-all/"},{"permission":"TeamsTab.Create","application":{"id":"49981c42-fd7b-4530-be03-e77b21aed25e","name":"Create tabs in Microsoft Teams.","description":"Allows the app to create tabs in any team in Microsoft Teams, without a signed-in user. This does not grant the ability to read, modify or delete tabs after they are created, or give access to the content inside the tabs.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"a9ff19c2-f369-4a95-9a25-ba9d460efc8e","name":"Create tabs in Microsoft Teams.","description":"Allows the app to create tabs in any team in Microsoft Teams, on behalf of the signed-in user. This does not grant the ability to read, modify or delete tabs after they are created, or give access to the content inside the tabs.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-create/"},{"permission":"TeamsTab.Read.All","application":{"id":"46890524-499a-4bb2-ad64-1476b4f3e1cf","name":"Read tabs in Microsoft Teams.","description":"Read the names and settings of tabs inside any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"59dacb05-e88d-4c13-a684-59f1afc8cc98","name":"Read tabs in Microsoft Teams.","description":"Read the names and settings of tabs inside any team in Microsoft Teams, on behalf of the signed-in user. This does not give access to the content inside the tabs.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-read-all/"},{"permission":"TeamsTab.ReadWrite.All","application":{"id":"a96d855f-016b-47d7-b51c-1218a98d791c","name":"Read and write tabs in Microsoft Teams.","description":"Read and write tabs in any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"b98bfd41-87c6-45cc-b104-e2de4f0dafb9","name":"Read and write tabs in Microsoft Teams.","description":"Read and write tabs in any team in Microsoft Teams, on behalf of the signed-in user. This does not give access to the content inside the tabs.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwrite-all/"},{"permission":"TeamsTab.ReadWriteForChat","application":null,"delegated":{"id":"ee928332-e9c2-4747-b4a0-f8c164b68de6","name":"Allow the Teams app to manage all tabs in chats","description":"Allows a Teams app to read, install, upgrade, and uninstall all tabs in chats the signed-in user can access.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwriteforchat/"},{"permission":"TeamsTab.ReadWriteForChat.All","application":{"id":"fd9ce730-a250-40dc-bd44-8dc8d20f39ea","name":"Allow the Teams app to manage all tabs for all chats","description":"Allows a Teams app to read, install, upgrade, and uninstall all tabs for any chat, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwriteforchat-all/"},{"permission":"TeamsTab.ReadWriteForTeam","application":null,"delegated":{"id":"c975dd04-a06e-4fbb-9704-62daad77bb49","name":"Allow the Teams app to manage all tabs in teams","description":"Allows a Teams app to read, install, upgrade, and uninstall all tabs to teams the signed-in user can access.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwriteforteam/"},{"permission":"TeamsTab.ReadWriteForTeam.All","application":{"id":"6163d4f4-fbf8-43da-a7b4-060fe85ed148","name":"Allow the Teams app to manage all tabs for all teams","description":"Allows a Teams app to read, install, upgrade, and uninstall all tabs in any team, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwriteforteam-all/"},{"permission":"TeamsTab.ReadWriteForUser","application":null,"delegated":{"id":"c37c9b61-7762-4bff-a156-afc0005847a0","name":"Allow the Teams app to manage all tabs for a user","description":"Allows a Teams app to read, install, upgrade, and uninstall all tabs for the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwriteforuser/"},{"permission":"TeamsTab.ReadWriteForUser.All","application":{"id":"425b4b59-d5af-45c8-832f-bb0b7402348a","name":"Allow the app to manage all tabs for all users","description":"Allows a Teams app to read, install, upgrade, and uninstall all tabs for any user, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwriteforuser-all/"},{"permission":"TeamsTab.ReadWriteSelfForChat","application":null,"delegated":{"id":"0c219d04-3abf-47f7-912d-5cca239e90e6","name":"Allow the Teams app to manage only its own tabs in chats","description":"Allows a Teams app to read, install, upgrade, and uninstall its own tabs in chats the signed-in user can access.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwriteselfforchat/"},{"permission":"TeamsTab.ReadWriteSelfForChat.All","application":{"id":"9f62e4a2-a2d6-4350-b28b-d244728c4f86","name":"Allow the Teams app to manage only its own tabs for all chats","description":"Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any chat, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwriteselfforchat-all/"},{"permission":"TeamsTab.ReadWriteSelfForTeam","application":null,"delegated":{"id":"f266662f-120a-4314-b26a-99b08617c7ef","name":"Allow the Teams app to manage only its own tabs in teams","description":"Allows a Teams app to read, install, upgrade, and uninstall its own tabs to teams the signed-in user can access.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwriteselfforteam/"},{"permission":"TeamsTab.ReadWriteSelfForTeam.All","application":{"id":"91c32b81-0ef0-453f-a5c7-4ce2e562f449","name":"Allow the Teams app to manage only its own tabs for all teams","description":"Allows a Teams app to read, install, upgrade, and uninstall its own tabs in any team, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwriteselfforteam-all/"},{"permission":"TeamsTab.ReadWriteSelfForUser","application":null,"delegated":{"id":"395dfec1-a0b9-465f-a783-8250a430cb8c","name":"Allow the Teams app to manage only its own tabs for a user","description":"Allows a Teams app to read, install, upgrade, and uninstall its own tabs for the signed-in user.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwriteselfforuser/"},{"permission":"TeamsTab.ReadWriteSelfForUser.All","application":{"id":"3c42dec6-49e8-4a0a-b469-36cff0d9da93","name":"Allow the Teams app to manage only its own tabs for all users","description":"Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any user, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstab-readwriteselfforuser-all/"},{"permission":"TeamsTelephoneNumber.Read.All","application":{"id":"39b17d18-680c-41f4-b9c2-5f30629e7cb6","name":"Read Tenant-Acquired Telephone Number Details","description":"Allows the app to read your tenant's acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"1bc6eab1-058d-4557-b011-d4c41cec88b7","name":"Read Tenant-Acquired Telephone Number Details","description":"Allows the app to read your tenant's acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstelephonenumber-read-all/"},{"permission":"TeamsTelephoneNumber.ReadWrite.All","application":{"id":"0a42382f-155c-4eb1-9bdc-21548ccaa387","name":"Read and Modify Tenant-Acquired Telephone Number Details","description":"Allows the app to read your tenant's acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"424b07a8-1209-4d17-9fe4-9018a93a1024","name":"Read and Modify Tenant-Acquired Telephone Number Details","description":"Allows the app to read and modify your tenant's acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamstelephonenumber-readwrite-all/"},{"permission":"TeamsUserConfiguration.Read.All","application":{"id":"a91eadaf-2c3c-4362-908b-fb172d208fc6","name":"Read Teams user configurations","description":"Allows the app to read your tenant's user configurations, without a signed-in user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"5c469ce4-dab5-4afd-b9de-14f1ba4004a7","name":"Read Teams user configurations","description":"Allows the app to read your tenant's user configurations on behalf of the signed-in admin user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamsuserconfiguration-read-all/"},{"permission":"TeamTemplates.Read","application":null,"delegated":{"id":"cd87405c-5792-4f15-92f7-debc0db6d1d6","name":"Read available Teams templates","description":"Allows the app to read the available Teams templates, on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamtemplates-read/"},{"permission":"TeamTemplates.Read.All","application":{"id":"6323133e-1f6e-46d4-9372-ac33a0870636","name":"Read all available Teams Templates","description":"Allows the app to read all available Teams Templates, without a signed-user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamtemplates-read-all/"},{"permission":"Teamwork.Migrate.All","application":{"id":"dfb0dd15-61de-45b2-be36-d6a69fba3c79","name":"Create chat and channel messages with anyone's identity and with any timestamp","description":"Allows the app to create chat and channel messages, without a signed in user. The app specifies which user appears as the sender, and can backdate the message to appear as if it was sent long ago. The messages can be sent to any chat or channel in the organization.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamwork-migrate-all/"},{"permission":"Teamwork.Read.All","application":{"id":"75bcfbce-a647-4fba-ad51-b63d73b210f4","name":"Read organizational teamwork settings","description":"Allows the app to read all teamwork settings of the organization without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"594f4bb6-c083-4cf9-8aa8-213823bdf351","name":"Read organizational teamwork settings","description":"Allows the app to read the teamwork settings of the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamwork-read-all/"},{"permission":"TeamworkAppSettings.Read.All","application":{"id":"475ebe88-f071-4bd7-af2b-642952bd4986","name":"Read Teams app settings","description":"Allows the app to read the Teams app settings without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"44e060c4-bbdc-4256-a0b9-dcc0396db368","name":"Read Teams app settings","description":"Allows the app to read the Teams app settings on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworkappsettings-read-all/"},{"permission":"TeamworkAppSettings.ReadWrite.All","application":{"id":"ab5b445e-8f10-45f4-9c79-dd3f8062cc4e","name":"Read and write Teams app settings","description":"Allows the app to read and write the Teams app settings without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"87c556f0-2bd9-4eed-bd74-5dd8af6eaf7e","name":"Read and write Teams app settings","description":"Allows the app to read and write the Teams app settings on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworkappsettings-readwrite-all/"},{"permission":"TeamworkCustomEmoji.Create","application":null,"delegated":{"id":"72464cd4-58fd-4116-8a9e-b74757574757","name":"Create custom emoji","description":"Create custom emoji on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworkcustomemoji-create/"},{"permission":"TeamworkCustomEmoji.Create.All","application":{"id":"85643b08-0e25-4d99-9d68-04ba0fef9740","name":"Create custom emoji","description":"Create custom emoji without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworkcustomemoji-create-all/"},{"permission":"TeamworkCustomEmoji.Read","application":null,"delegated":{"id":"89b231b1-414e-4dd4-bb87-d59906da4e05","name":"Read custom emoji","description":"Read custom emoji on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworkcustomemoji-read/"},{"permission":"TeamworkCustomEmoji.Read.All","application":{"id":"1efa3d37-1703-4685-9a59-baf6296fb956","name":"Read custom emoji","description":"Read custom emoji without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworkcustomemoji-read-all/"},{"permission":"TeamworkDevice.Read.All","application":{"id":"0591bafd-7c1c-4c30-a2a5-2b9aacb1dfe8","name":"Read Teams devices","description":"Allow the app to read the management data for Teams devices, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"b659488b-9d28-4208-b2be-1c6652b3c970","name":"Read Teams devices","description":"Allow the app to read the management data for Teams devices on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworkdevice-read-all/"},{"permission":"TeamworkDevice.ReadWrite.All","application":{"id":"79c02f5b-bd4f-4713-bc2c-a8a4a66e127b","name":"Read and write Teams devices","description":"Allow the app to read and write the management data for Teams devices, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"ddd97ecb-5c31-43db-a235-0ee20e635c40","name":"Read and write Teams devices","description":"Allow the app to read and write the management data for Teams devices on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworkdevice-readwrite-all/"},{"permission":"TeamworkSection.Read","application":null,"delegated":{"id":"87a3258d-8c34-49e2-ab91-9b8bdbd79177","name":"Read your sections","description":"Allows the app to read the signed-in user's sections (folders) for organizing chats and channels in Teams.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworksection-read/"},{"permission":"TeamworkSection.Read.All","application":{"id":"e9e1b87a-726e-4628-8fab-d1fc58d4d9ad","name":"Read all users' sections","description":"Allows the app to read all users' sections (folders) for organizing chats and channels in Teams, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworksection-read-all/"},{"permission":"TeamworkSection.ReadWrite","application":null,"delegated":{"id":"70dbe5e8-39b9-40f3-8c65-3ec7b00ad804","name":"Read and write your sections","description":"Allows the app to read and write the signed-in user's sections (folders) for organizing chats and channels in Teams.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworksection-readwrite/"},{"permission":"TeamworkSection.ReadWrite.All","application":{"id":"fd99f9da-42d6-4d00-8a41-4161bea42309","name":"Read and write all users' sections","description":"Allows the app to read and write all users' sections (folders) for organizing chats and channels in Teams, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworksection-readwrite-all/"},{"permission":"TeamworkTag.Read","application":null,"delegated":{"id":"57587d0b-8399-45be-b207-8050cec54575","name":"Read tags in Teams","description":"Allows the app to read tags in Teams, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworktag-read/"},{"permission":"TeamworkTag.Read.All","application":{"id":"b74fd6c4-4bde-488e-9695-eeb100e4907f","name":"Read tags in Teams","description":"Allows the app to read tags in Teams without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworktag-read-all/"},{"permission":"TeamworkTag.ReadWrite","application":null,"delegated":{"id":"539dabd7-b5b6-4117-b164-d60cd15a8671","name":"Read and write tags in Teams","description":"Allows the app to read and write tags in Teams, on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworktag-readwrite/"},{"permission":"TeamworkTag.ReadWrite.All","application":{"id":"a3371ca5-911d-46d6-901c-42c8c7a937d8","name":"Read and write tags in Teams","description":"Allows the app to read and write tags in Teams without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworktag-readwrite-all/"},{"permission":"TeamworkTargetedMessage.Read.All","application":{"id":"b0cfd829-be18-4b31-bb0e-ec1df8197ba3","name":"Read all targeted messages of group chat or channel","description":"Allows the app to read all group chat or channel targeted messages in Microsoft Teams.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworktargetedmessage-read-all/"},{"permission":"TeamworkTargetedMessage.ReadWrite","application":null,"delegated":{"id":"162354de-2885-4e5a-94fb-2f03019a65a8","name":"Update targeted messages belonging to the user","description":"Allows the user to update group chat or channel targeted messages in Microsoft Teams.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworktargetedmessage-readwrite/"},{"permission":"TeamworkUserInteraction.Read.All","application":null,"delegated":{"id":"b4d26916-07e0-4daf-9096-9f6d9174aa96","name":"Read all of the possible Teams interactions between the user and other users","description":"Allows the app to read all of the possible Teams interactions between the signed-in user and other users","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/teamworkuserinteraction-read-all/"},{"permission":"TenantGovernance-Invitation.Read.All","application":{"id":"3f4f98e9-6faf-4e5f-814b-ed2ed8a4ec9e","name":"Read Tenant Governance invitations","description":"Allows the application to list and read all Tenant Governance invitations without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"fda068e8-0524-485e-8d7f-b5bc29b0dae9","name":"Read Tenant Governance invitations","description":"Allows the application to list and read all Tenant Governance invitations on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tenantgovernance-invitation-read-all/"},{"permission":"TenantGovernance-Invitation.ReadWrite.All","application":null,"delegated":{"id":"42b91635-3803-4af2-a2d5-e91127f9c488","name":"Read and write Tenant Governance invitations","description":"Allows the application to list, read, create, and delete Tenant Governance invitations on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tenantgovernance-invitation-readwrite-all/"},{"permission":"TenantGovernance-PolicyTemplate.Read.All","application":{"id":"eb9465d8-e7c0-4301-8e51-927f34ee3134","name":"Read Tenant Governance policy templates","description":"Allows the application to list and read all Tenant Governance policy templates without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ad222a15-813d-46b8-8f8d-1976a69a74f3","name":"Read Tenant Governance policy templates","description":"Allows the application to list and read all Tenant Governance policy templates on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tenantgovernance-policytemplate-read-all/"},{"permission":"TenantGovernance-PolicyTemplate.ReadWrite.All","application":null,"delegated":{"id":"7cd0bd21-45fe-4c8e-a549-3c95bd27d185","name":"Read and write Tenant Governance policy templates","description":"Allows the application to list, read, create, update, and delete Tenant Governance policy templates on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tenantgovernance-policytemplate-readwrite-all/"},{"permission":"TenantGovernance-RelatedTenant.Read.All","application":{"id":"7ced9a83-8e7c-46df-b3e0-6b45a6ecedcd","name":"Read related tenants","description":"Allows the application to list and read related tenants information without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9caaca93-f090-4b9a-b4bb-17de251354d4","name":"Read related tenants","description":"Allows the application to list and read related tenants information on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tenantgovernance-relatedtenant-read-all/"},{"permission":"TenantGovernance-RelatedTenant.ReadWrite.All","application":null,"delegated":{"id":"e61db2de-de55-461e-942d-52a028ed1076","name":"Read and write related tenants","description":"Allows the application to list, read, and refresh related tenants information on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tenantgovernance-relatedtenant-readwrite-all/"},{"permission":"TenantGovernance-Relationship.Read.All","application":{"id":"41c250d0-8793-44e1-a130-5fdbd5bccd0a","name":"Read Tenant Governance relationships","description":"Allows the application to list and read all Tenant Governance relationships without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"0b1c2458-4845-477b-a704-3cce8b06bf28","name":"Read Tenant Governance relationships","description":"Allows the application to list and read all Tenant Governance relationships on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tenantgovernance-relationship-read-all/"},{"permission":"TenantGovernance-Relationship.ReadWrite.All","application":null,"delegated":{"id":"3fbcd6a3-a9a5-4d69-8a78-acc7d7195180","name":"Read and write Tenant Governance relationships","description":"Allows the application to list, read, and update Tenant Governance relationships on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tenantgovernance-relationship-readwrite-all/"},{"permission":"TenantGovernance-Request.Read.All","application":{"id":"294294d5-2b81-4cf1-837c-28fc22bc3290","name":"Read Tenant Governance requests","description":"Allows the application to list and read all Tenant Governance requests without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"a924b9f1-7af0-4982-aecf-b6e0e10b2830","name":"Read Tenant Governance requests","description":"Allows the application to list and read all Tenant Governance requests on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tenantgovernance-request-read-all/"},{"permission":"TenantGovernance-Request.ReadWrite.All","application":null,"delegated":{"id":"3c7a434e-4e5d-413f-be82-b77ea4ba5a4d","name":"Read and write Tenant Governance requests","description":"Allows the application to list, read, create, and update Tenant Governance requests on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tenantgovernance-request-readwrite-all/"},{"permission":"TenantGovernance-Setting.Read.All","application":{"id":"e2d1cac5-0317-4ae3-aca9-59737eb75317","name":"Read Tenant Governance settings","description":"Allows the application to read Tenant Governance settings without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"4ad3e05f-2467-49d9-baa2-8e4de7bcee9b","name":"Read Tenant Governance settings","description":"Allows the application to read Tenant Governance settings on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tenantgovernance-setting-read-all/"},{"permission":"TenantGovernance-Setting.ReadWrite.All","application":null,"delegated":{"id":"135f3533-12fc-4608-97ac-5c5cea64baf0","name":"Read and write Tenant Governance settings","description":"Allows the application to read Tenant Governance settings and update them on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/tenantgovernance-setting-readwrite-all/"},{"permission":"TermStore.Read.All","application":{"id":"ea047cc2-df29-4f3e-83a3-205de61501ca","name":"Read all term store data","description":"Allows the app to read all term store data, without a signed-in user. This includes all sets, groups and terms in the term store.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"297f747b-0005-475b-8fef-c890f5152b38","name":"Read term store data","description":"Allows the app to read the term store data that the signed-in user has access to. This includes all sets, groups and terms in the term store.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/termstore-read-all/"},{"permission":"TermStore.ReadWrite.All","application":{"id":"f12eb8d6-28e3-46e6-b2c0-b7e4dc69fc95","name":"Read and write all term store data","description":"Allows the app to read, edit or write all term store data, without a signed-in user. This includes all sets, groups and terms in the term store.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"6c37c71d-f50f-4bff-8fd3-8a41da390140","name":"Read and write term store data","description":"Allows the app to read or modify data that the signed-in user has access to. This includes all sets, groups and terms in the term store.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/termstore-readwrite-all/"},{"permission":"ThreatAssessment.Read.All","application":{"id":"f8f035bb-2cce-47fb-8bf5-7baf3ecbee48","name":"Read threat assessment requests","description":"Allows an app to read your organization's threat assessment requests, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/threatassessment-read-all/"},{"permission":"ThreatAssessment.ReadWrite.All","application":null,"delegated":{"id":"cac97e40-6730-457d-ad8d-4852fddab7ad","name":"Read and write threat assessment requests","description":"Allows an app to read your organization's threat assessment requests on behalf of the signed-in user. Also allows the app to create new requests to assess threats received by your organization on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/threatassessment-readwrite-all/"},{"permission":"ThreatHunting.Read.All","application":{"id":"dd98c7f5-2d42-42d3-a0e4-633161547251","name":"Run hunting queries and read shared saved hunting queries","description":"Allows the app to run hunting queries and read shared saved hunting queries, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"b152eca8-ea73-4a48-8c98-1a6742673d99","name":"Run hunting queries and read saved hunting queries","description":"Allows the app to run hunting queries and read saved hunting queries, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/threathunting-read-all/"},{"permission":"ThreatHunting.ReadWrite.All","application":{"id":"6e251752-0d87-4158-b87b-b60e768fa657","name":"Run hunting queries and manage all hunting functions","description":"Allows the app to run hunting queries and to read and write hunting functions, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"a2e55068-32fd-4091-a37c-120338337abd","name":"Run hunting queries and manage hunting functions","description":"Allows the app to run hunting queries and to read and write hunting functions, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/threathunting-readwrite-all/"},{"permission":"ThreatIndicators.Read.All","application":{"id":"197ee4e9-b993-4066-898f-d6aecc55125b","name":"Read all threat indicators","description":"Allows the app to read all the indicators for your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"9cc427b4-2004-41c5-aa22-757b755e9796","name":"Read all threat indicators","description":"Allows the app to read all the indicators for your organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/threatindicators-read-all/"},{"permission":"ThreatIndicators.ReadWrite.OwnedBy","application":{"id":"21792b6c-c986-4ffc-85de-df9da54b52fa","name":"Manage threat indicators this app creates or owns","description":"Allows the app to create threat indicators, and fully manage those threat indicators (read, update and delete), without a signed-in user.  It cannot update any threat indicators it does not own.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"91e7d36d-022a-490f-a748-f8e011357b42","name":"Manage threat indicators this app creates or owns","description":"Allows the app to create threat indicators, and fully manage those threat indicators (read, update and delete), on behalf of the signed-in user.  It cannot update any threat indicators it does not own.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/threatindicators-readwrite-ownedby/"},{"permission":"ThreatIntelligence.Read.All","application":{"id":"e0b77adb-e790-44a3-b0a0-257d06303687","name":"Read all Threat Intelligence Information","description":"Allows the app to read threat intelligence information, such as indicators, observations, and and articles, without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"f266d9c0-ccb9-4fb8-a228-01ac0d8d6627","name":"Read all threat intelligence information","description":"Allows the app to read threat intelligence information, such as indicators, observations, and articles, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/threatintelligence-read-all/"},{"permission":"ThreatSubmission.Read","application":null,"delegated":{"id":"fd5353c6-26dd-449f-a565-c4e16b9fce78","name":"Read threat submissions","description":"Allows the app to read the threat submissions and threat submission policies owned by the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/threatsubmission-read/"},{"permission":"ThreatSubmission.Read.All","application":{"id":"86632667-cd15-4845-ad89-48a88e8412e1","name":"Read all of the organization's threat submissions","description":"Allows the app to read your organization's threat submissions and to view threat submission policies without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"7083913a-4966-44b6-9886-c5822a5fd910","name":"Read all threat submissions","description":"Allows the app to read your organization's threat submissions and threat submission policies on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/threatsubmission-read-all/"},{"permission":"ThreatSubmission.ReadWrite","application":null,"delegated":{"id":"68a3156e-46c9-443c-b85c-921397f082b5","name":"Read and write threat submissions","description":"Allows the app to read the threat submissions and threat submission policies owned by the signed-in user. Also allows the app to create new threat submissions on behalf of the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/threatsubmission-readwrite/"},{"permission":"ThreatSubmission.ReadWrite.All","application":{"id":"d72bdbf4-a59b-405c-8b04-5995895819ac","name":"Read and write all of the organization's threat submissions","description":"Allows the app to read your organization's threat submissions and threat submission policies without a signed-in user. Also allows the app to create new threat submissions without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"8458e264-4eb9-4922-abe9-768d58f13c7f","name":"Read and write all threat submissions","description":"Allows the app to read your organization's threat submissions and threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submissions on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/threatsubmission-readwrite-all/"},{"permission":"ThreatSubmissionPolicy.ReadWrite.All","application":{"id":"926a6798-b100-4a20-a22f-a4918f13951d","name":"Read and write all of the organization's threat submission policies","description":"Allows the app to read your organization's threat submission policies without a signed-in user. Also allows the app to create new threat submission policies without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"059e5840-5353-4c68-b1da-666a033fc5e8","name":"Read and write all threat submission policies","description":"Allows the app to read your organization's threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submission policies on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/threatsubmissionpolicy-readwrite-all/"},{"permission":"Topic.Read.All","application":null,"delegated":{"id":"79c4c76f-409a-4f98-884d-e2c09291ec26","name":"Read topic items","description":"Allows the app to read topics data on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/topic-read-all/"},{"permission":"TrustFrameworkKeySet.Read.All","application":{"id":"fff194f1-7dce-4428-8301-1badb5518201","name":"Read trust framework key sets","description":"Allows the app to read trust framework key set properties without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"7ad34336-f5b1-44ce-8682-31d7dfcd9ab9","name":"Read trust framework key sets","description":"Allows the app to read trust framework key set properties on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/trustframeworkkeyset-read-all/"},{"permission":"TrustFrameworkKeySet.ReadWrite.All","application":{"id":"4a771c9a-1cf2-4609-b88e-3d3e02d539cd","name":"Read and write trust framework key sets","description":"Allows the app to read and write trust framework key set properties without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"39244520-1e7d-4b4a-aee0-57c65826e427","name":"Read and write trust framework key sets","description":"Allows the app to read and write trust framework key set properties on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/trustframeworkkeyset-readwrite-all/"},{"permission":"UnifiedGroupMember.Read.AsGuest","application":null,"delegated":{"id":"73e75199-7c3e-41bb-9357-167164dbb415","name":"Read unified group memberships as guest","description":"Allows the app to read basic unified group properties, memberships and owners of the group the signed-in guest is a member of.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/unifiedgroupmember-read-asguest/"},{"permission":"User-ConvertToInternal.ReadWrite.All","application":{"id":"9d952b72-f741-4b40-9185-8c53076c2339","name":"Convert an external user to internal member user","description":"Allow the app to convert an external user to an internal member user, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"550e695c-7511-40f4-ac79-e8fb9c82552d","name":"Convert an external user to internal memeber user","description":"Allow the app to convert an external user to an internal member user, on behalf of signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-converttointernal-readwrite-all/"},{"permission":"User-LifeCycleInfo.Read.All","application":{"id":"8556a004-db57-4d7a-8b82-97a13428e96f","name":"Read all users' lifecycle information","description":"Allows the app to read the lifecycle information like employeeLeaveDateTime of users in your organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ed8d2a04-0374-41f1-aefe-da8ac87ccc87","name":"Read all users' lifecycle information","description":"Allows the app to read the lifecycle information like employeeLeaveDateTime of users in your organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-lifecycleinfo-read-all/"},{"permission":"User-LifeCycleInfo.ReadWrite.All","application":{"id":"925f1248-0f97-47b9-8ec8-538c54e01325","name":"Read and write all users' lifecycle information","description":"Allows the app to read and write the lifecycle information like employeeLeaveDateTime of users in your organization, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"7ee7473e-bd4b-4c9f-987c-bd58481f5fa2","name":"Read and write all users' lifecycle information","description":"Allows the app to read and write the lifecycle information like employeeLeaveDateTime of users in your organization, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-lifecycleinfo-readwrite-all/"},{"permission":"User-Mail.ReadWrite.All","application":{"id":"280d0935-0796-47d1-8d26-273470a3f17a","name":"Read and write all secondary mail addresses for users","description":"Allows the app to read and write secondary mail addresses for all users, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"6166886a-9576-433b-8544-658177bdef1d","name":"Read and write secondary mail addresses for users","description":"Allows the app to read and write secondary mail addresses for all users, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-mail-readwrite-all/"},{"permission":"User-OnPremisesSyncBehavior.ReadWrite.All","application":{"id":"a94a502d-0281-4d15-8cd2-682ac9362c4c","name":"Read and update the on-premises sync behavior of users","description":"Allows the app to update the on-premises sync behavior of all users without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"7ff9afdd-0cdb-439d-a61c-fea3e9339e89","name":"Read and update the on-premises sync behavior of users","description":"Allows the app to read and update the on-premises sync behavior of users on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-onpremisessyncbehavior-readwrite-all/"},{"permission":"User-PasswordProfile.ReadWrite.All","application":{"id":"cc117bb9-00cf-4eb8-b580-ea2a878fe8f7","name":"Read and write all password profiles and reset user passwords","description":"Allows the app to read and write password profiles and reset passwords for all users, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"56760768-b641-451f-8906-e1b8ab31bca7","name":"Read and write password profiles and reset user passwords","description":"Allows the app to read and write password profiles and reset passwords for all users, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-passwordprofile-readwrite-all/"},{"permission":"User-Phone.ReadWrite.All","application":{"id":"86ceff06-c822-49ff-989a-d912845ffe69","name":"Read and write all user mobile phone and business phones","description":"Allows the app to read and write the mobile phone and business phones for all users, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"e29d5979-5b06-4a7f-ae24-6a9348d2e1ff","name":"Read and write user mobile phone and business phones","description":"Allows the app to read and write the mobile phone and business phones for all users, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-phone-readwrite-all/"},{"permission":"User.Create","application":{"id":"4240f680-4f73-4082-a766-aa916a2dc9b3","name":"Create users","description":"Allows the app to create users, without a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"delegated":{"id":"d8ce6a2a-46ff-438e-96bc-020f23870a55","name":"Create users","description":"Allows the app to create users, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-create/"},{"permission":"User.DeleteRestore.All","application":{"id":"eccc023d-eccf-4e7b-9683-8813ab36cecc","name":"Delete and restore all users","description":"Allows the app to delete and restore all users, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"4bb440cd-2cf2-4f90-8004-aa2acd2537c5","name":"Delete and restore users","description":"Allows the app to delete and restore all users, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-deleterestore-all/"},{"permission":"User.EnableDisableAccount.All","application":{"id":"3011c876-62b7-4ada-afa2-506cbbecc68c","name":"Enable and disable user accounts","description":"Allows the app to enable and disable users' accounts, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"f92e74e7-2563-467f-9dd0-902688cb5863","name":"Enable and disable user accounts","description":"Allows the app to enable and disable users' accounts, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-enabledisableaccount-all/"},{"permission":"User.Export.All","application":{"id":"405a51b5-8d8d-430b-9842-8be4b0e9f324","name":"Export user's data","description":"Allows the app to export data (e.g. customer content or system-generated logs), associated with any user in your company, when the app is used by a privileged user (e.g. a Company Administrator).","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"405a51b5-8d8d-430b-9842-8be4b0e9f324","name":"Export user's data","description":"Allows the app to export data (e.g. customer content or system-generated logs), associated with any user in your company, when the app is used by a privileged user (e.g. a Company Administrator).","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-export-all/"},{"permission":"User.Invite.All","application":{"id":"09850681-111b-4a89-9bed-3f2cae46d706","name":"Invite guest users to the organization","description":"Allows the app to invite guest users to the organization, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"63dd7cd9-b489-4adf-a28c-ac38b9a0f962","name":"Invite guest users to the organization","description":"Allows the app to invite guest users to the organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-invite-all/"},{"permission":"User.ManageIdentities.All","application":{"id":"c529cfca-c91b-489c-af2b-d92990b66ce6","name":"Manage all users' identities","description":"Allows the app to read, update and delete identities that are associated with a user's account, without a signed in user. This controls the identities users can sign-in with.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"637d7bec-b31e-4deb-acc9-24275642a2c9","name":"Manage  user identities","description":"Allows the app to read, update and delete identities that are associated with a user's account that the signed-in user has access to. This controls the identities users can sign-in with.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-manageidentities-all/"},{"permission":"User.Read","application":null,"delegated":{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4683d","name":"Sign in and read user profile","description":"Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users.","adminConsent":false,"risk":"Low","riskReason":"Basic sign-in and profile information."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-read/"},{"permission":"User.Read.All","application":{"id":"df021288-bdef-4463-88db-98f22de89214","name":"Read all users' full profiles","description":"Allows the app to read user profiles without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"a154be20-db9c-4678-8ab7-66f6cc099a59","name":"Read all users' full profiles","description":"Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":"If you only need names and emails, User.ReadBasic.All is enough.","url":"https://azureblog.co.uk/graph-permissions/user-read-all/"},{"permission":"User.ReadBasic.All","application":{"id":"97235f07-e226-4f63-ace3-39588e11d3a1","name":"Read all users' basic profiles","description":"Allows the app to read a basic set of profile properties of other users in your organization without a signed-in user. Includes display name, first and last name, email address, open extensions, and photo.","adminConsent":true,"risk":"Low","riskReason":"Basic sign-in and profile information."},"delegated":{"id":"b340eb25-3456-403f-be2f-af7a0d370277","name":"Read all users' basic profiles","description":"Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo.","adminConsent":false,"risk":"Low","riskReason":"Basic sign-in and profile information."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-readbasic-all/"},{"permission":"User.ReadUpdate.All","application":{"id":"5639c449-cfd9-4088-bc48-3e16da108bf8","name":"Read and update users","description":"Allows the app to read and update users, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"f8b099f1-a6ce-4e00-8fff-5f783ff4faeb","name":"Read and update users","description":"Allows the app to read and update users, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-readupdate-all/"},{"permission":"User.ReadWrite","application":null,"delegated":{"id":"b4e74841-8e56-480b-be8b-910348b18b4c","name":"Read and write access to user profile","description":"Allows the app to read your profile. It also allows the app to update your profile information on your behalf.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-readwrite/"},{"permission":"User.ReadWrite.All","application":{"id":"741f803b-c850-494e-b5df-cde7c675a1ca","name":"Read and write all users' full profiles","description":"Allows the app to read and update user profiles without a signed in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"204e0828-b5ca-4ad8-b9f3-f32a958e7cc4","name":"Read and write all users' full profiles","description":"Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-readwrite-all/"},{"permission":"User.ReadWrite.CrossCloud","application":{"id":"5652f862-b626-407b-a3e6-248aeb95763c","name":"Read and write profiles of users that originate from an external cloud.","description":"Allows the app to read and update external cloud user profiles without a signed in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-readwrite-crosscloud/"},{"permission":"User.RevokeSessions.All","application":{"id":"77f3a031-c388-4f99-b373-dc68676a979e","name":"Revoke all sign in sessions for a user","description":"Allow the app to revoke all sign in sessions for a user, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"fc30e98b-8810-4501-81f5-c20a3196387b","name":"Revoke all sign in sessions for a user","description":"Allow the app to revoke all sign in sessions for a user, on behalf of a signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/user-revokesessions-all/"},{"permission":"UserActivity.ReadWrite.CreatedByApp","application":null,"delegated":{"id":"47607519-5fb1-47d9-99c7-da4b48f369b1","name":"Read and write app activity to users' activity feed","description":"Allows the app to read and report the signed-in user's activity in the app.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/useractivity-readwrite-createdbyapp/"},{"permission":"UserAuthenticationMethod.Delete.All","application":{"id":"712f5e0d-bc8d-4ae5-8242-cfb9a4921ed3","name":"Delete all users' authentication methods","description":"Allows the app to delete authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user's phone numbers and Authenticator app settings. This does not allow the app to read, create, or modify authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthenticationmethod-delete-all/"},{"permission":"UserAuthenticationMethod.Read","application":null,"delegated":{"id":"1f6b61c5-2f65-4135-9c9f-31c0f8d32b52","name":"Read user authentication methods.","description":"Allows the app to read the signed-in user's authentication methods, including phone numbers and Authenticator app settings. This does not allow the app to see secret information like the signed-in user's passwords, or to sign-in  or otherwise use the signed-in user's authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthenticationmethod-read/"},{"permission":"UserAuthenticationMethod.Read.All","application":{"id":"38d9df27-64da-44fd-b7c5-a6fbac20248f","name":"Read all users' authentication methods","description":"Allows the app to read authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"aec28ec7-4d02-4e8c-b864-50163aea77eb","name":"Read all users' authentication methods","description":"Allows the app to read authentication methods of all users in your organization that the signed-in user has access to. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthenticationmethod-read-all/"},{"permission":"UserAuthenticationMethod.ReadWrite","application":null,"delegated":{"id":"48971fc1-70d7-4245-af77-0beb29b53ee2","name":"Read and write user authentication methods","description":"Allows the app to read and write the signed-in user's authentication methods, including phone numbers and Authenticator app settings.                       This does not allow the app to see secret information like the signed-in user's passwords, or                      to sign-in or otherwise use the signed-in user's authentication methods.  ","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthenticationmethod-readwrite/"},{"permission":"UserAuthenticationMethod.ReadWrite.All","application":{"id":"50483e42-d915-4231-9639-7fdb7fd190e5","name":"Read and write all users' authentication methods ","description":"Allows the application to read and write authentication methods of all users in your organization, without a signed-in user.                       Authentication methods include things like a user's phone numbers and Authenticator app settings. This                      does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"delegated":{"id":"b7887744-6746-4312-813d-72daeaee7e2d","name":"Read and write all users' authentication methods","description":" Allows the app to read and write authentication methods of all users in your organization that the signed-in user has access to.                       Authentication methods include things like a user's phone numbers and Authenticator app settings. This                      does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Critical","riskReason":"Can be used to take over the tenant or grant itself more access. Grant only to tightly controlled, well-known apps."},"leastPrivilege":"If the app only reads methods, use UserAuthenticationMethod.Read.All.","url":"https://azureblog.co.uk/graph-permissions/userauthenticationmethod-readwrite-all/"},{"permission":"UserAuthMethod-Email.Delete.All","application":{"id":"f0e9adfd-ed6b-45f5-b969-324a75286a39","name":"Delete all users' email methods","description":"Allows the application to delete email methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify email methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-email-delete-all/"},{"permission":"UserAuthMethod-Email.Read","application":null,"delegated":{"id":"12b23cea-90c1-4873-9094-f45c5f290f86","name":"Read the signed-in user's email authentication methods","description":"Allows the app to read the signed-in user's email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-email-read/"},{"permission":"UserAuthMethod-Email.Read.All","application":{"id":"a1e58be0-1095-422b-b067-73434bd7d40f","name":"Read all users' email methods","description":"Allows the app to read email methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"76caaf3a-ebdb-40a3-9299-4196e636f290","name":"Read all users' email methods","description":"Allows the app to read email methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-email-read-all/"},{"permission":"UserAuthMethod-Email.ReadWrite","application":null,"delegated":{"id":"696aa421-62dc-4c99-be16-015b23444089","name":"Read and write the signed-in user's email authentication methods","description":"Allows the app to read and write the signed-in user's email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-email-readwrite/"},{"permission":"UserAuthMethod-Email.ReadWrite.All","application":{"id":"e8ecb853-1435-4a49-95ba-ec5b31b11672","name":"Read and write all users' email methods","description":"Allows the application to read and write email methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"074f680f-c89e-45be-880e-5d0642860a1c","name":"Read and write all users' email methods.","description":"Allows the app to read and write email methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-email-readwrite-all/"},{"permission":"UserAuthMethod-External.Delete.All","application":{"id":"7fa6d39e-1e4e-44be-bf9c-e8260b12e1f5","name":"Delete all users' external authentication methods","description":"Allows the application to delete external authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify external authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-external-delete-all/"},{"permission":"UserAuthMethod-External.Read","application":null,"delegated":{"id":"d1739827-146b-4f7f-b52c-1c509253aa57","name":"Read the signed-in user's external authentication methods","description":"Allows the app to read the signed-in user's external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-external-read/"},{"permission":"UserAuthMethod-External.Read.All","application":{"id":"d2c4289f-9f95-40da-ad43-eeb1506f0db7","name":"Read all users' external authentication methods","description":"Allows the app to read external authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"cbca9646-4c34-4cea-8e54-9a7088018820","name":"Read all users' external authentication methods","description":"Allows the app to read external authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-external-read-all/"},{"permission":"UserAuthMethod-External.ReadWrite","application":null,"delegated":{"id":"28c2e8f9-828a-4691-a090-f2f0b7fc07b3","name":"Read and write the signed-in user's external authentication methods","description":"Allows the app to read and write the signed-in user's external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-external-readwrite/"},{"permission":"UserAuthMethod-External.ReadWrite.All","application":{"id":"c7a22c2e-5b01-4129-8159-6c8be2c78f16","name":"Read and write all users' external authentication methods","description":"Allows the application to read and write external authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"9d91805d-0f53-43e3-a0f3-303ad4f3056f","name":"Read and write all users' external methods.","description":"Allows the app to read and write external authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-external-readwrite-all/"},{"permission":"UserAuthMethod-HardwareOATH.Delete.All","application":{"id":"9d8eb432-7ea3-491a-9ed7-e6361b308f08","name":"Delete all users' HardwareOATH authentication methods","description":"Allows the application to delete HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify HardwareOATH authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-hardwareoath-delete-all/"},{"permission":"UserAuthMethod-HardwareOATH.Read","application":null,"delegated":{"id":"ccd2eb40-8874-44e6-8f96-335908b3cfdb","name":"Read the signed-in user's HardwareOATH authentication methods","description":"Allows the app to read the signed-in user's HardwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-hardwareoath-read/"},{"permission":"UserAuthMethod-HardwareOATH.Read.All","application":{"id":"7b544555-7811-49ff-8223-a56be870e33a","name":"Read all users' HardwareOATH authentication methods","description":"Allows the app to read HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"acd68c26-c283-4bf4-8b5c-200fc179bdd5","name":"Read all users' HardwareOATH authentication methods","description":"Allows the app to read HardwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-hardwareoath-read-all/"},{"permission":"UserAuthMethod-HardwareOATH.ReadWrite","application":null,"delegated":{"id":"147ca97b-6686-4849-b37e-09d9b5ad45fc","name":"Read and write the signed-in user's HardwareOATH authentication methods","description":"Allows the app to read and write the signed-in user's HardwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-hardwareoath-readwrite/"},{"permission":"UserAuthMethod-HardwareOATH.ReadWrite.All","application":{"id":"7e9ebcc1-90aa-4471-8051-e68d6b4e9c89","name":"Read and write all users' HardwareOATH authentication methods","description":"Allows the application to read and write HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"480643f2-a162-43c5-a670-dc1494fc911b","name":"Read and write all users' HardwareOATH methods.","description":"Allows the app to read and write HardwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-hardwareoath-readwrite-all/"},{"permission":"UserAuthMethod-MicrosoftAuthApp.Delete.All","application":{"id":"ae494ca6-9612-417a-972a-ef52efaf2de3","name":"Delete all users' Microsoft Authentication methods","description":"Allows the application to delete Microsoft Authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify Microsoft Authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-microsoftauthapp-delete-all/"},{"permission":"UserAuthMethod-MicrosoftAuthApp.Read","application":null,"delegated":{"id":"f14a567b-3280-4124-95a0-eca86006967e","name":"Read the signed-in user's Microsoft Authenticator authentication methods","description":"Allows the app to read the signed-in user's Microsoft Authenticator authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-microsoftauthapp-read/"},{"permission":"UserAuthMethod-MicrosoftAuthApp.Read.All","application":{"id":"a9c5f16e-e5ca-4e33-89ad-903fcfc01c23","name":"Read all users' Microsoft authentication methods","description":"Allows the app to read Microsoft authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"7b627679-e2fd-4bfd-990e-989e2914d4e6","name":"Read all users' Microsoft authentication methods","description":"Allows the app to read Microsoft authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-microsoftauthapp-read-all/"},{"permission":"UserAuthMethod-MicrosoftAuthApp.ReadWrite","application":null,"delegated":{"id":"9f7dfa0c-eb40-42be-8d45-8af4a9219c6f","name":"Read and write the signed-in user's Microsoft Authenticator authentication methods","description":"Allows the app to read and write the signed-in user's Microsoft Authenticator authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-microsoftauthapp-readwrite/"},{"permission":"UserAuthMethod-MicrosoftAuthApp.ReadWrite.All","application":{"id":"c833c349-a1ab-4b6d-94a2-fa9a8674420c","name":"Read and write all users' Microsoft Authentication methods","description":"Allows the application to read and write Microsoft Authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"1b7322b2-5cb3-4f13-928f-d7ca97c5fba9","name":"Read and write all users' Microsoft Authentication methods.","description":"Allows the app to read and write Microsoft Authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-microsoftauthapp-readwrite-all/"},{"permission":"UserAuthMethod-Passkey.Delete.All","application":{"id":"9563fbd0-03a7-466e-8042-63d668b7d1a3","name":"Delete all users' passkey authentication methods","description":"Allows the application to delete passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify passkey authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-passkey-delete-all/"},{"permission":"UserAuthMethod-Passkey.Read","application":null,"delegated":{"id":"828fcbda-0d26-431d-8bfb-83f217224621","name":"Read the signed-in user's passkey authentication methods","description":"Allows the app to read the signed-in user's passkey authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-passkey-read/"},{"permission":"UserAuthMethod-Passkey.Read.All","application":{"id":"72e00c1d-3e3d-43bb-a0b9-c435611bb1d2","name":"Read all users' passkey authentication methods","description":"Allows the app to read passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"14195339-1fe4-48a7-a0d3-a39eb9fd8958","name":"Read all users' passkey authentication methods","description":"Allows the app to read passkey authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-passkey-read-all/"},{"permission":"UserAuthMethod-Passkey.ReadWrite","application":null,"delegated":{"id":"b2de7db9-10f7-4800-b04c-b5b91e4891d6","name":"Read and write the signed-in user's passkey authentication methods","description":"Allows the app to read and write the signed-in user's passkey authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-passkey-readwrite/"},{"permission":"UserAuthMethod-Passkey.ReadWrite.All","application":{"id":"0400e371-7db1-4338-a269-96069eb65227","name":"Read and write all users' passkey authentication methods","description":"Allows the application to read and write passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"64930478-d0ea-4671-ad72-fe0d9821df09","name":"Read and write all users' passkey methods.","description":"Allows the app to read and write passkey authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-passkey-readwrite-all/"},{"permission":"UserAuthMethod-Password.Read","application":null,"delegated":{"id":"7f0f82c3-de19-4ddc-810d-a2206d7637fd","name":"Read the signed-in user's password authentication methods","description":"Allows the app to read the signed-in user's password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-password-read/"},{"permission":"UserAuthMethod-Password.Read.All","application":{"id":"8d2c17ff-b93d-40d5-9def-d843680509cb","name":"Read all users' password authentication methods","description":"Allows the app to read password authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"4f69a4e2-2aa0-43a7-ad6b-98b4cda1f23f","name":"Read all users' password authentication methods","description":"Allows the app to read password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-password-read-all/"},{"permission":"UserAuthMethod-Password.ReadWrite","application":null,"delegated":{"id":"60cce20d-d41e-4594-b391-84bbf8cc31f3","name":"Read and write the signed-in user's password authentication methods","description":"Allows the app to read and write the signed-in user's password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-password-readwrite/"},{"permission":"UserAuthMethod-Password.ReadWrite.All","application":{"id":"f6d38dfd-ec08-4995-8f07-23e929df0936","name":"Read and write all users' password authentication methods","description":"Allows the application to read and write password authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"7f5b683d-df96-4690-a88d-6e336ed6dc7c","name":"Read and write all users' password methods.","description":"Allows the app to read and write password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-password-readwrite-all/"},{"permission":"UserAuthMethod-Phone.Delete.All","application":{"id":"59f17651-8b6c-494e-a269-4ac582fbbca0","name":"Delete all users' phone methods","description":"Allows the application to delete phone methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify phone methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-phone-delete-all/"},{"permission":"UserAuthMethod-Phone.Read","application":null,"delegated":{"id":"43dab3b9-e8b4-424d-8e13-6a2ad2a625fa","name":"Read the signed-in user's phone authentication methods","description":"Allows the app to read the signed-in user's phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-phone-read/"},{"permission":"UserAuthMethod-Phone.Read.All","application":{"id":"f529a223-ea70-43ec-b268-5012de2fbaa2","name":"Read all users' phone authentication methods","description":"Allows the app to read phone authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"20cf4ae1-09b9-4d29-a6f8-43e1820ce60c","name":"Read all users' phone authentication methods","description":"Allows the app to read phone authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-phone-read-all/"},{"permission":"UserAuthMethod-Phone.ReadWrite","application":null,"delegated":{"id":"6c4aad61-f76b-46ad-a22c-57d4d3d962af","name":"Read and write the signed-in user's phone authentication methods","description":"Allows the app to read and write the signed-in user's phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-phone-readwrite/"},{"permission":"UserAuthMethod-Phone.ReadWrite.All","application":{"id":"6e85d483-7092-4375-babe-0a94a8213a58","name":"Read and write all users' phone methods","description":"Allows the application to read and write phone methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"48c99302-9a24-4f27-a8a7-acef4debba14","name":"Read and write all users' phone methods.","description":"Allows the app to read and write Phone methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":false,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-phone-readwrite-all/"},{"permission":"UserAuthMethod-PlatformCred.Delete.All","application":{"id":"bd760918-651f-4e67-b66f-8f614384dec2","name":"Delete all users' platform credentials methods","description":"Allows the application to delete platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify platform credentials methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-platformcred-delete-all/"},{"permission":"UserAuthMethod-PlatformCred.Read","application":null,"delegated":{"id":"9c694582-e8f2-40e2-8353-fb43e2e0f12a","name":"Read the signed-in user's platform credential authentication methods","description":"Allows the app to read the signed-in user's platform credential authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-platformcred-read/"},{"permission":"UserAuthMethod-PlatformCred.Read.All","application":{"id":"07c0b1e4-15bd-442f-834b-30f8291388d1","name":"Read all users' platform credentials methods","description":"Allows the app to read platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"5936156c-f89b-4850-997d-026c4e6ce529","name":"Read all users' platform credentials methods","description":"Allows the app to read platform credentials methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-platformcred-read-all/"},{"permission":"UserAuthMethod-PlatformCred.ReadWrite","application":null,"delegated":{"id":"70327f81-b953-43c9-92d3-131c74e4beb8","name":"Read and write the signed-in user's platform credential authentication methods","description":"Allows the app to read and write the signed-in user's platform credential authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-platformcred-readwrite/"},{"permission":"UserAuthMethod-PlatformCred.ReadWrite.All","application":{"id":"1a87acf4-a9ca-4576-a974-452ea265d5f6","name":"Read and write all users' platform credentials methods","description":"Allows the application to read and write platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"cb11bf8c-dde1-4504-b6a5-31e1562b0749","name":"Read and write all users' platform credentials methods.","description":"Allows the app to read and write platform credentials methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-platformcred-readwrite-all/"},{"permission":"UserAuthMethod-QR.Delete.All","application":{"id":"e1c34213-26ac-400b-9548-a749f1b1a4e0","name":"Delete all users' QR authentication methods","description":"Allows the application to delete QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify QR authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-qr-delete-all/"},{"permission":"UserAuthMethod-QR.Read","application":null,"delegated":{"id":"d6893c31-9187-405c-8dfc-f700c8fc161a","name":"Read the signed-in user's QR authentication methods","description":"Allows the app to read the signed-in user's QR authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-qr-read/"},{"permission":"UserAuthMethod-QR.Read.All","application":{"id":"9a45bc50-cddd-4ebe-bd9c-4f2eacf646ae","name":"Read all users' QR methods","description":"Allows the app to read QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"e4900dfb-ad17-410d-8ddb-7aebd8a6af1a","name":"Read all users' QR methods","description":"Allows the app to read QR authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-qr-read-all/"},{"permission":"UserAuthMethod-QR.ReadWrite","application":null,"delegated":{"id":"651210da-18ce-4e42-b7db-302ff88e9326","name":"Read and write the signed-in user's QR authentication methods","description":"Allows the app to read and write the signed-in user's QR authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-qr-readwrite/"},{"permission":"UserAuthMethod-QR.ReadWrite.All","application":{"id":"4869299f-18c3-40c8-98f2-222657e67db1","name":"Read and write all users' QR methods","description":"Allows the application to read and write QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"db39086a-da7d-4cbd-9ac0-6816f9a80c95","name":"Read and write all users' QR methods.","description":"Allows the app to read and write QR authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-qr-readwrite-all/"},{"permission":"UserAuthMethod-ResourceKey.Delete.All","application":{"id":"a71aecaf-82f1-47c5-ad0a-5e63503b928f","name":"Delete all users' resource key authentication methods","description":"Allows the application to delete resource key authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify resource key authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-resourcekey-delete-all/"},{"permission":"UserAuthMethod-ResourceKey.Read.All","application":{"id":"94ed018c-a499-47e0-beef-803b93873ece","name":"Read and write all users' external authentication methods","description":"Allows the app to read the keys associated with the user representing a resource account.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"c86e40fc-66fd-4d68-802e-b90e3038f5e8","name":"Read the keys associated with the user representing a resource account.","description":"Allows the app to read the keys associated with the user representing a resource account.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-resourcekey-read-all/"},{"permission":"UserAuthMethod-ResourceKey.ReadWrite.All","application":{"id":"1bf7461f-222a-4525-9760-f7739228d0f4","name":"Read and delete all users' external authentication methods","description":"Allows the app to read and delete the keys associated with the user representing a resource account.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"e71dec0d-02b4-429d-a49a-030950d45faa","name":"Read and delete the keys associated with the user representing a resource account.","description":"Allows the app to read and delete the keys associated with the user representing a resource account.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-resourcekey-readwrite-all/"},{"permission":"UserAuthMethod-SoftwareOATH.Delete.All","application":{"id":"e5676e10-1a16-452b-ad10-71f54b755852","name":"Delete all users' SoftwareOATH authentication methods","description":"Allows the application to delete SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify SoftwareOATH authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-softwareoath-delete-all/"},{"permission":"UserAuthMethod-SoftwareOATH.Read","application":null,"delegated":{"id":"247f2733-6e3d-46ff-a904-f5fd58eb0d97","name":"Read the signed-in user's SoftwareOATH authentication methods","description":"Allows the app to read the signed-in user's SoftwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-softwareoath-read/"},{"permission":"UserAuthMethod-SoftwareOATH.Read.All","application":{"id":"a6b423df-a0c8-411d-a809-a4a5985d2939","name":"Read all users' SoftwareOATH methods","description":"Allows the app to read SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"3e366fa0-3097-4eb6-8294-3028f77eea6f","name":"Read all users' SoftwareOATH methods","description":"Allows the app to read SoftwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-softwareoath-read-all/"},{"permission":"UserAuthMethod-SoftwareOATH.ReadWrite","application":null,"delegated":{"id":"16721eb3-4493-4ae1-9542-264d9ffe3ce9","name":"Read and write the signed-in user's SoftwareOATH authentication methods","description":"Allows the app to read and write the signed-in user's SoftwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-softwareoath-readwrite/"},{"permission":"UserAuthMethod-SoftwareOATH.ReadWrite.All","application":{"id":"787442d4-3c6e-4e99-aa95-8ccca20a48ff","name":"Read and write all users' SoftwareOATH methods","description":"Allows the application to read and write SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"5b34c8b5-2396-4b35-b284-83fb6a3e73ce","name":"Read and write all users' SoftwareOATH methods.","description":"Allows the app to read and write SoftwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-softwareoath-readwrite-all/"},{"permission":"UserAuthMethod-TAP.Delete.All","application":{"id":"4f872e9d-d232-4ecd-ab9c-337cbdb184e5","name":"Delete all users' Temporary Access Pass authentication methods","description":"Allows the application to delete Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify Temporary Access Pass authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-tap-delete-all/"},{"permission":"UserAuthMethod-TAP.Read","application":null,"delegated":{"id":"84ded88f-26ba-49d6-b776-efec398de692","name":"Read the signed-in user's Temporary Access Pass authentication methods","description":"Allows the app to read the signed-in user's Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-tap-read/"},{"permission":"UserAuthMethod-TAP.Read.All","application":{"id":"bf82209c-b22b-4747-ac88-a68be99032cf","name":"Read all users' Temporary Access Pass methods","description":"Allows the app to read Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"6976c635-c9c2-41e6-a21d-e6913a155273","name":"Read all users' Temporary Access Pass methods","description":"Allows the app to read Temporary Access Pass authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-tap-read-all/"},{"permission":"UserAuthMethod-TAP.ReadWrite","application":null,"delegated":{"id":"2424436d-902f-4651-a1c7-b3b93147c960","name":"Read and write the signed-in user's Temporary Access Pass authentication methods","description":"Allows the app to read and write the signed-in user's Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-tap-readwrite/"},{"permission":"UserAuthMethod-TAP.ReadWrite.All","application":{"id":"627169a8-8c15-451c-861a-5b80e383de5c","name":"Read and write all users' Temporary Access Pass methods","description":"Allows the application to read and write Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"05de4a66-e51a-4312-842a-30c8094698d2","name":"Read and write all users' Temporary Access Pass methods.","description":"Allows the app to read and write Temporary Access Pass authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-tap-readwrite-all/"},{"permission":"UserAuthMethod-WindowsHello.Delete.All","application":{"id":"f3197110-aa7f-4acd-a0fd-71981ad68d42","name":"Delete all users' Windows Hello authentication methods","description":"Allows the application to delete Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify Windows Hello authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-windowshello-delete-all/"},{"permission":"UserAuthMethod-WindowsHello.Read","application":null,"delegated":{"id":"efe2b5aa-3a8e-486c-b0be-cc4d185c1b40","name":"Read the signed-in user's Windows Hello methods","description":"Allows the app to read the signed-in user's Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-windowshello-read/"},{"permission":"UserAuthMethod-WindowsHello.Read.All","application":{"id":"9b8dd4c7-8cca-4ef5-a34a-9c2c75fcc934","name":"Read all users' Windows Hello methods","description":"Allows the app to read Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"ff37d46d-b88a-4e0c-85ee-7e26c37b18eb","name":"Read all users' Windows Hello methods","description":"Allows the app to read Windows Hello authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-windowshello-read-all/"},{"permission":"UserAuthMethod-WindowsHello.ReadWrite","application":null,"delegated":{"id":"f11e1db9-d419-4a24-b677-792723ffd727","name":"Read and write the signed-in user's Windows Hello authentication methods","description":"Allows the app to read and write the signed-in user's Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-windowshello-readwrite/"},{"permission":"UserAuthMethod-WindowsHello.ReadWrite.All","application":{"id":"f14eee8a-713e-45aa-8223-2ab74632db1a","name":"Read and write all users' Windows Hello authentication methods","description":"Allows the application to read and write Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"13eae17d-aaa4-47b8-aaee-0eb33c6e2450","name":"Read and write all users' Windows Hello methods.","description":"Allows the app to read and write Windows Hello authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userauthmethod-windowshello-readwrite-all/"},{"permission":"UserCloudClipboard.Read","application":null,"delegated":{"id":"61e8a09a-087f-4e36-8c8c-1c77c5228017","name":"Read cloud clipboard items","description":"Allows the app to read cloud clipboard data on behalf of the signed-in user.","adminConsent":false,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/usercloudclipboard-read/"},{"permission":"UserNotification.ReadWrite.CreatedByApp","application":{"id":"4e774092-a092-48d1-90bd-baad67c7eb47","name":"Deliver and manage all user's notifications","description":"Allows the app to send, read, update and delete user’s notifications, without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"26e2f3e8-b2a1-47fc-9620-89bb5b042024","name":"Deliver and manage user's notifications","description":"Allows the app to send, read, update and delete user’s notifications.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/usernotification-readwrite-createdbyapp/"},{"permission":"UserShiftPreferences.Read.All","application":{"id":"de023814-96df-4f53-9376-1e2891ef5a18","name":"Read all user shift preferences","description":"Allows the app to read all users' shift schedule preferences without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/usershiftpreferences-read-all/"},{"permission":"UserShiftPreferences.ReadWrite.All","application":{"id":"d1eec298-80f3-49b0-9efb-d90e224798ac","name":"Read and write all user shift preferences","description":"Allows the app to manage all users' shift schedule preferences without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/usershiftpreferences-readwrite-all/"},{"permission":"UserTeamwork.Read","application":null,"delegated":{"id":"834bcc1c-762f-41b0-bb91-1cdc323ee4bf","name":"Read user teamwork settings","description":"Allows the app to read the teamwork settings of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userteamwork-read/"},{"permission":"UserTeamwork.Read.All","application":{"id":"fbcd7ef1-df0d-4e05-bb28-93424a89c6df","name":"Read all user teamwork settings","description":"Allows the app to read all user teamwork settings without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userteamwork-read-all/"},{"permission":"UserTimelineActivity.Write.CreatedByApp","application":null,"delegated":{"id":"367492fc-594d-4972-a9b5-0d58c622c91c","name":"Write app activity to users' timeline","description":"Allows the app to report the signed-in user's app activity information to Microsoft Timeline.","adminConsent":false,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/usertimelineactivity-write-createdbyapp/"},{"permission":"UserWindowsSettings.Read.All","application":null,"delegated":{"id":"77e07bab-1b34-40a5-bb6c-4b197b3f6027","name":"Read windows settings for all devices","description":"Allows the app to read a user's windows settings which are stored in cloud and their values on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userwindowssettings-read-all/"},{"permission":"UserWindowsSettings.ReadWrite.All","application":null,"delegated":{"id":"dcb1026d-b7e1-4d31-9f61-6724d5140bf9","name":"Read and write windows settings for all devices","description":"Allows the app to read and write a user's windows settings which are stored in cloud and their values on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/userwindowssettings-readwrite-all/"},{"permission":"VerifiedId-Profile.Read.All","application":{"id":"e227c591-dd64-4a8a-a033-816167f7c938","name":"Read Verified Id profiles","description":"This role can read Verified Id profiles in a tenant.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"604b2056-41ed-4c56-aad5-1241d4ef7333","name":"Read Verified Id profiles","description":"This role can read Verified Id profiles in a tenant.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/verifiedid-profile-read-all/"},{"permission":"VerifiedId-Profile.ReadWrite.All","application":null,"delegated":{"id":"e4a9cb5e-4767-48f8-9029-decf26a54456","name":"Read and write Verified Id profiles","description":"This role can read and write Verified Id profiles in a tenant.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/verifiedid-profile-readwrite-all/"},{"permission":"VirtualAppointment.Read","application":null,"delegated":{"id":"27470298-d3b8-4b9c-aad4-6334312a3eac","name":"Read a user's virtual appointments","description":"Allows an application to read virtual appointments for the signed-in user. Only an organizer or participant user can read their virtual appointments.  ","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/virtualappointment-read/"},{"permission":"VirtualAppointment.Read.All","application":{"id":"d4f67ec2-59b5-4bdc-b4af-d78f6f9c1954","name":"Read all virtual appointments for users, as authorized by online meetings application access policy","description":"Allows the application to read virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user’s data by the online meetings application access policy.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/virtualappointment-read-all/"},{"permission":"VirtualAppointment.ReadWrite","application":null,"delegated":{"id":"2ccc2926-a528-4b17-b8bb-860eed29d64c","name":"Read and write a user's virtual appointments  ","description":"Allows an application to read and write virtual appointments for the signed-in user. Only an organizer or participant user can read and write their virtual appointments. ","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/virtualappointment-readwrite/"},{"permission":"VirtualAppointment.ReadWrite.All","application":{"id":"bf46a256-f47d-448f-ab78-f226fff08d40","name":"Read-write all virtual appointments for users, as authorized by online meetings app access policy","description":"Allows the application to read and write virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user’s data by the online meetings application access policy.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/virtualappointment-readwrite-all/"},{"permission":"VirtualAppointmentNotification.Send","application":{"id":"97e45b36-1250-48e4-bd70-2df6dab7e94a","name":"Send notification regarding virtual appointments as any user","description":"Allows the application to send notification regarding virtual appointments as any user, without a signed-in user. The app must also be authorized to access an individual user's data by the online meetings application access policy.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"delegated":{"id":"20d02fff-a0ef-49e7-a46e-019d4a6523b7","name":"Send notification regarding virtual appointments for the signed-in user","description":"Allows an application to send notifications for virtual appointments for the signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/virtualappointmentnotification-send/"},{"permission":"VirtualEvent.Read","application":null,"delegated":{"id":"6b616635-ae58-433a-a918-8c45e4f304dc","name":"Read your virtual events","description":"Allows the app to read virtual events created by you","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/virtualevent-read/"},{"permission":"VirtualEvent.Read.All","application":{"id":"1dccb351-c4e4-4e09-a8d1-7a9ecbf027cc","name":"Read all users' virtual events","description":"Allows the app to read all virtual events without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/virtualevent-read-all/"},{"permission":"VirtualEvent.ReadWrite","application":null,"delegated":{"id":"d38d189c-e29b-4344-8b3b-829bfa81380b","name":"Read and write your virtual events","description":"Allows the app to read and write virtual events for you","adminConsent":true,"risk":"Medium","riskReason":"Can make changes. Check the scope is as narrow as possible."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/virtualevent-readwrite/"},{"permission":"VirtualEventRegistration-Anon.ReadWrite.All","application":{"id":"23211fc1-f9d1-4e8e-8e9e-08a5d0a109bb","name":"Read and write anonymous users' virtual event registrations","description":"Allows the app to read and write anonymous users' virtual event registrations, without a signed-in user","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":null,"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/virtualeventregistration-anon-readwrite-all/"},{"permission":"WindowsUpdates.Read.All","application":{"id":"50a8bf5f-b06a-4ac7-881f-3ca0c4be7550","name":"Read all Windows update deployment settings","description":"Allows the app to read all Windows update deployment settings for the organization without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"e09fef2d-bf5e-4439-affa-7c48d23bb1c2","name":"Read all Windows update deployment settings","description":"Allows the app to read all Windows update deployment settings for the organization on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/windowsupdates-read-all/"},{"permission":"WindowsUpdates.ReadWrite.All","application":{"id":"7dd1be58-6e76-4401-bf8d-31d1e8180d5b","name":"Read and write all Windows update deployment settings","description":"Allows the app to read and write all Windows update deployment settings for the organization without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"11776c0c-6138-4db3-a668-ee621bea2555","name":"Read and write all Windows update deployment settings","description":"Allows the app to read and write all Windows update deployment settings for the organization on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/windowsupdates-readwrite-all/"},{"permission":"Workbooks.Read.All","application":{"id":"d6559210-2a3e-46f8-90b3-e69ef5507772","name":"Read all workbooks","description":"Allows the app to read all workbooks without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"e37141d2-4e2c-459d-8e5b-5214ae4af482","name":"Read all workbooks","description":"Allows the app to read all workbooks on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/workbooks-read-all/"},{"permission":"Workbooks.ReadWrite.All","application":{"id":"164a9e2c-8434-444a-a250-b8c70dded2af","name":"Read and write all workbooks","description":"Allows the app to read and write all workbooks without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"5cf5c2d4-f542-4e67-b524-51ab19ef7584","name":"Read and write all workbooks","description":"Allows the app to read and write all workbooks on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/workbooks-readwrite-all/"},{"permission":"WorkforceIntegration.Read.All","application":{"id":"f10b94b9-37d1-4c88-8b7e-bf75a1152d39","name":"Read workforce integrations","description":"Allows the app to read workforce integrations without a signed-in user.","adminConsent":true,"risk":"Medium","riskReason":"Reads data across the tenant without a signed-in user."},"delegated":{"id":"f1ccd5a7-6383-466a-8db8-1a656f7d06fa","name":"Read workforce integrations","description":"Allows the app to read workforce integrations, to synchronize data from Microsoft Teams Shifts, on behalf of the signed-in user.","adminConsent":true,"risk":"Low","riskReason":"Read access, limited to what the signed-in user can see."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/workforceintegration-read-all/"},{"permission":"WorkforceIntegration.ReadWrite.All","application":{"id":"202bf709-e8e6-478e-bcfd-5d63c50b68e3","name":"Read and write workforce integrations","description":"Allows the app to manage workforce integrations to synchronize data from Microsoft Teams Shifts, without a signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"delegated":{"id":"08c4b377-0d23-4a8b-be2a-23c1c1d88545","name":"Read and write workforce integrations","description":"Allows the app to manage workforce integrations, to synchronize data from Microsoft Teams Shifts, on behalf of the signed-in user.","adminConsent":true,"risk":"High","riskReason":"Can change data across the whole tenant."},"leastPrivilege":null,"url":"https://azureblog.co.uk/graph-permissions/workforceintegration-readwrite-all/"}]}