Skip to content

Commit a1c9d09

Browse files
LauragraLauragra
authored
Merge pull request #25075 from microsoftgraph/permissions-reference/2024-08-28
2024-08-28: Automated permissions reference update
2 parents 1933feb + c11ab69 commit a1c9d09

File tree

2 files changed

+262
-9
lines changed

2 files changed

+262
-9
lines changed

‎concepts/permissions-reference.md

Lines changed: 260 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.localizationpriority: high
77
ms.topic: reference
88
ms.subservice: entra-applications
99
ms.custom: graphiamtop20, scenarios:getting-started
10-
ms.date: 08/12/2024
10+
ms.date: 08/28/2024
1111
#Customer intent: As a developer, I want to learn more about the permissions available in Microsoft Graph, so that I understand the impact of granting specific permissions to my app.
1212
---
1313

@@ -137,6 +137,17 @@ GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000
137137

138138
---
139139

140+
### AiEnterpriseInteraction.Read.All
141+
142+
| Category | Application | Delegated |
143+
|--|--|--|
144+
| Identifier | 839c90ab-5771-41ee-aef8-a562e8487c1e | - |
145+
| DisplayText | Read all AI enterprise interactions. | - |
146+
| Description | Allows the app to read all AI enterprise interactions. | - |
147+
| AdminConsentRequired | Yes | - |
148+
149+
---
150+
140151
### Analytics.Read
141152

142153
| Category | Application | Delegated |
@@ -290,6 +301,61 @@ GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000
290301

291302
---
292303

304+
### ApprovalSolution.Read
305+
306+
| Category | Application | Delegated |
307+
|--|--|--|
308+
| Identifier | - | b0df437d-d341-4df0-aa3e-89ca81a1207f |
309+
| DisplayText | - | Read approvals |
310+
| Description | - | Allows the app to read approvals on behalf of the signed-in user. |
311+
| AdminConsentRequired | - | Yes |
312+
313+
---
314+
315+
### ApprovalSolution.Read.All
316+
317+
| Category | Application | Delegated |
318+
|--|--|--|
319+
| Identifier | 9f265de7-8d5e-4e9a-a805-5e8bbc49656f | - |
320+
| DisplayText | Read all approvals | - |
321+
| Description | Allows the app to read all approvals and approval item subscriptions, without a signed-in user. | - |
322+
| AdminConsentRequired | Yes | - |
323+
324+
---
325+
326+
### ApprovalSolution.ReadWrite
327+
328+
| Category | Application | Delegated |
329+
|--|--|--|
330+
| Identifier | - | 6768d3af-4562-48ff-82d2-c5e19eb21b9c |
331+
| DisplayText | - | Read, create, and respond to approvals |
332+
| Description | - | Allows the app to provision, read, create, and respond to approvals on behalf of the signed-in user. |
333+
| AdminConsentRequired | - | Yes |
334+
335+
---
336+
337+
### ApprovalSolution.ReadWrite.All
338+
339+
| Category | Application | Delegated |
340+
|--|--|--|
341+
| Identifier | 45583558-1113-4d06-8969-e79a28edc9ad | - |
342+
| DisplayText | Read all approvals and manage approval subscriptions | - |
343+
| Description | Allows the app to read all approvals and create, update, or remove approval item subscriptions, without a signed-in user. | - |
344+
| AdminConsentRequired | Yes | - |
345+
346+
---
347+
348+
### ApprovalSolutionResponse.ReadWrite
349+
350+
| Category | Application | Delegated |
351+
|--|--|--|
352+
| Identifier | - | 89d944f2-2011-44ad-830c-aa9bf5ef2319 |
353+
| DisplayText | - | Read and respond to approvals assigned to the current user |
354+
| Description | - | Allows the app to read and respond to approvals on behalf of the signed-in user. |
355+
| AdminConsentRequired | - | Yes |
356+
357+
---
358+
293359
### AttackSimulation.Read.All
294360

295361
| Category | Application | Delegated |
@@ -525,21 +591,21 @@ GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000
525591

526592
| Category | Application | Delegated |
527593
|--|--|--|
528-
| Identifier | - | b27a61ec-b99c-4d6a-b126-c4375d08ae30 |
529-
| DisplayText | - | Read BitLocker keys |
530-
| Description | - | Allows the app to read BitLocker keys on behalf of the signed-in user, for their owned devices. Allows read of the recovery key. |
531-
| AdminConsentRequired | - | Yes |
594+
| Identifier | 57f1cf28-c0c4-4ec3-9a30-19a2eaaf2f6e | b27a61ec-b99c-4d6a-b126-c4375d08ae30 |
595+
| DisplayText | Read all BitLocker keys | Read BitLocker keys |
596+
| Description | Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key. | Allows the app to read BitLocker keys on behalf of the signed-in user, for their owned devices. Allows read of the recovery key. |
597+
| AdminConsentRequired | Yes | Yes |
532598

533599
---
534600

535601
### BitlockerKey.ReadBasic.All
536602

537603
| Category | Application | Delegated |
538604
|--|--|--|
539-
| Identifier | - | 5a107bfc-4f00-4e1a-b67e-66451267bc68 |
540-
| DisplayText | - | Read BitLocker keys basic information |
541-
| Description | - | Allows the app to read basic BitLocker key properties on behalf of the signed-in user, for their owned devices. Does not allow read of the recovery key itself. |
542-
| AdminConsentRequired | - | Yes |
605+
| Identifier | f690d423-6b29-4d04-98c6-694c42282419 | 5a107bfc-4f00-4e1a-b67e-66451267bc68 |
606+
| DisplayText | Read all BitLocker keys basic information | Read BitLocker keys basic information |
607+
| Description | Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key. | Allows the app to read basic BitLocker key properties on behalf of the signed-in user, for their owned devices. Does not allow read of the recovery key itself. |
608+
| AdminConsentRequired | Yes | Yes |
543609

544610
---
545611

@@ -3361,6 +3427,94 @@ GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000
33613427

33623428
---
33633429

3430+
### MailboxFolder.Read
3431+
3432+
| Category | Application | Delegated |
3433+
|--|--|--|
3434+
| Identifier | - | 52dc2051-4958-4636-8f2a-281d39c6981c |
3435+
| DisplayText | - | Read a user's mailbox folders |
3436+
| Description | - | Allows the app to read the user's mailbox folders, on behalf of the signed-in user. |
3437+
| AdminConsentRequired | - | No |
3438+
3439+
---
3440+
3441+
### MailboxFolder.Read.All
3442+
3443+
| Category | Application | Delegated |
3444+
|--|--|--|
3445+
| Identifier | 99280d24-a782-4793-93cc-0888549957f6 | - |
3446+
| DisplayText | Read all the users' mailbox folders | - |
3447+
| Description | Allows the app to read all the users' mailbox folders, without signed-in user. | - |
3448+
| AdminConsentRequired | Yes | - |
3449+
3450+
---
3451+
3452+
### MailboxFolder.ReadWrite
3453+
3454+
| Category | Application | Delegated |
3455+
|--|--|--|
3456+
| Identifier | - | 077fde41-7e0b-4c5b-bcd1-e9d743a30c80 |
3457+
| DisplayText | - | Read and write a user's mailbox folders |
3458+
| Description | - | Allows the app to read and write the user's mailbox folders, on behalf of the signed-in user. |
3459+
| AdminConsentRequired | - | No |
3460+
3461+
---
3462+
3463+
### MailboxFolder.ReadWrite.All
3464+
3465+
| Category | Application | Delegated |
3466+
|--|--|--|
3467+
| Identifier | fef87b92-8391-4589-9da7-eb93dab7dc8a | - |
3468+
| DisplayText | Read and write all the users' mailbox folders | - |
3469+
| Description | Allows the app to read and write all the users' mailbox folders, without signed-in user. | - |
3470+
| AdminConsentRequired | Yes | - |
3471+
3472+
---
3473+
3474+
### MailboxItem.ImportExport
3475+
3476+
| Category | Application | Delegated |
3477+
|--|--|--|
3478+
| Identifier | - | df96e8a0-f4e1-4ecf-8d83-a429f822cbd6 |
3479+
| DisplayText | - | Allows the app to perform backup and restore of mailbox items |
3480+
| Description | - | Allows the app to backup, restore, and modify mailbox items on behalf of the signed-in user. |
3481+
| AdminConsentRequired | - | Yes |
3482+
3483+
---
3484+
3485+
### MailboxItem.ImportExport.All
3486+
3487+
| Category | Application | Delegated |
3488+
|--|--|--|
3489+
| Identifier | 76577085-e73d-4f1d-b26a-85fb33892327 | - |
3490+
| DisplayText | Allows the app to perform backup and restore for all mailbox items | - |
3491+
| Description | Allows the app to backup, restore, and modify all mailbox items without a signed-in user. | - |
3492+
| AdminConsentRequired | Yes | - |
3493+
3494+
---
3495+
3496+
### MailboxItem.Read
3497+
3498+
| Category | Application | Delegated |
3499+
|--|--|--|
3500+
| Identifier | - | 82305458-296d-4edd-8b0b-74dd74c34526 |
3501+
| DisplayText | - | Read a user's mailbox items |
3502+
| Description | - | Allows the app to read the user's mailbox items, on behalf of the signed-in user. |
3503+
| AdminConsentRequired | - | No |
3504+
3505+
---
3506+
3507+
### MailboxItem.Read.All
3508+
3509+
| Category | Application | Delegated |
3510+
|--|--|--|
3511+
| Identifier | 7d9f353d-a7bd-4fbb-822a-26d5dd39a3ce | - |
3512+
| DisplayText | Read all the users' mailbox items | - |
3513+
| Description | Allows the app to read all the users' mailbox items, without signed-in user. | - |
3514+
| AdminConsentRequired | Yes | - |
3515+
3516+
---
3517+
33643518
### MailboxSettings.Read
33653519

33663520
| Category | Application | Delegated |
@@ -4895,6 +5049,50 @@ GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000
48955049

48965050
---
48975051

5052+
### ResourceSpecificPermissionGrant.ReadForChat
5053+
5054+
| Category | Application | Delegated |
5055+
|--|--|--|
5056+
| Identifier | - | cb530fca-534b-4e72-aa74-bca7e8bbd06f |
5057+
| DisplayText | - | Read resource specific permissions granted on a chat |
5058+
| Description | - | Allows the app to read the resource specific permissions granted on the chat, on behalf of the signed-in user. |
5059+
| AdminConsentRequired | - | Yes |
5060+
5061+
---
5062+
5063+
### ResourceSpecificPermissionGrant.ReadForChat.All
5064+
5065+
| Category | Application | Delegated |
5066+
|--|--|--|
5067+
| Identifier | 2ff643d8-43e4-4a9b-88c1-86cb4a4b4c2f | - |
5068+
| DisplayText | Read resource specific permissions granted on a chat | - |
5069+
| Description | Allows the app to read the resource specific permissions granted on the chat without a signed-in user. | - |
5070+
| AdminConsentRequired | Yes | - |
5071+
5072+
---
5073+
5074+
### ResourceSpecificPermissionGrant.ReadForTeam
5075+
5076+
| Category | Application | Delegated |
5077+
|--|--|--|
5078+
| Identifier | - | eafad40c-bf7a-415a-b7f8-acdf5706b58f |
5079+
| DisplayText | - | Read resource specific permissions granted on a team |
5080+
| Description | - | Allows the app to read the resource specific permissions granted on the team, on behalf of the signed-in user. |
5081+
| AdminConsentRequired | - | Yes |
5082+
5083+
---
5084+
5085+
### ResourceSpecificPermissionGrant.ReadForTeam.All
5086+
5087+
| Category | Application | Delegated |
5088+
|--|--|--|
5089+
| Identifier | ad4600ae-d900-42cb-a9a2-2415d05593d0 | - |
5090+
| DisplayText | Read resource specific permissions granted on a team | - |
5091+
| Description | Allows the app to read the resource specific permissions granted on the team without a signed-in user. | - |
5092+
| AdminConsentRequired | Yes | - |
5093+
5094+
---
5095+
48985096
### ResourceSpecificPermissionGrant.ReadForUser
48995097

49005098
| Category | Application | Delegated |
@@ -6725,6 +6923,50 @@ GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000
67256923

67266924
---
67276925

6926+
### User-Mail.ReadWrite.All
6927+
6928+
| Category | Application | Delegated |
6929+
|--|--|--|
6930+
| Identifier | 280d0935-0796-47d1-8d26-273470a3f17a | 6166886a-9576-433b-8544-658177bdef1d |
6931+
| DisplayText | Read and write all secondary mail addresses for users | Read and write secondary mail addresses for users |
6932+
| Description | Allows the app to read and write secondary mail addresses for all users, without a signed-in user. | Allows the app to read and write secondary mail addresses for all users, on behalf of the signed-in user. |
6933+
| AdminConsentRequired | Yes | Yes |
6934+
6935+
---
6936+
6937+
### User-PasswordProfile.ReadWrite.All
6938+
6939+
| Category | Application | Delegated |
6940+
|--|--|--|
6941+
| Identifier | cc117bb9-00cf-4eb8-b580-ea2a878fe8f7 | 56760768-b641-451f-8906-e1b8ab31bca7 |
6942+
| DisplayText | Read and write all password profiles and reset user passwords | Read and write password profiles and reset user passwords |
6943+
| Description | Allows the app to read and write password profiles and reset passwords for all users, without a signed-in user. | Allows the app to read and write password profiles and reset passwords for all users, on behalf of the signed-in user. |
6944+
| AdminConsentRequired | Yes | Yes |
6945+
6946+
---
6947+
6948+
### User-Phone.ReadWrite.All
6949+
6950+
| Category | Application | Delegated |
6951+
|--|--|--|
6952+
| Identifier | 86ceff06-c822-49ff-989a-d912845ffe69 | e29d5979-5b06-4a7f-ae24-6a9348d2e1ff |
6953+
| DisplayText | Read and write all user mobile phone and business phones | Read and write user mobile phone and business phones |
6954+
| Description | Allows the app to read and write the mobile phone and business phones for all users, without a signed-in user. | Allows the app to read and write the mobile phone and business phones for all users, on behalf of the signed-in user. |
6955+
| AdminConsentRequired | Yes | Yes |
6956+
6957+
---
6958+
6959+
### User.DeleteRestore.All
6960+
6961+
| Category | Application | Delegated |
6962+
|--|--|--|
6963+
| Identifier | eccc023d-eccf-4e7b-9683-8813ab36cecc | 4bb440cd-2cf2-4f90-8004-aa2acd2537c5 |
6964+
| DisplayText | Delete and restore all users | Delete and restore users |
6965+
| Description | Allows the app to delete and restore all users, without a signed-in user. | Allows the app to delete and restore all users, on behalf of the signed-in user. |
6966+
| AdminConsentRequired | Yes | Yes |
6967+
6968+
---
6969+
67286970
### User.EnableDisableAccount.All
67296971

67306972
| Category | Application | Delegated |
@@ -6780,6 +7022,8 @@ GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000
67807022

67817023
![personal Microsoft accounts][MSA] The *User.Read* delegated permission is available for consent in personal Microsoft accounts.
67827024

7025+
[!INCLUDE [User.Read](../includes/permissions-notes/user.read.md)]
7026+
67837027
---
67847028

67857029
### User.Read.All
@@ -6806,6 +7050,8 @@ GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000
68067050

68077051
![personal Microsoft accounts][MSA] The *User.ReadBasic.All* delegated permission is available for consent in personal Microsoft accounts.
68087052

7053+
[!INCLUDE [User.ReadBasic.All](../includes/permissions-notes/user.readbasic.all.md)]
7054+
68097055
---
68107056

68117057
### User.ReadWrite
@@ -6819,6 +7065,8 @@ GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000
68197065

68207066
![personal Microsoft accounts][MSA] The *User.ReadWrite* delegated permission is available for consent in personal Microsoft accounts.
68217067

7068+
[!INCLUDE [User.ReadWrite](../includes/permissions-notes/user.readwrite.md)]
7069+
68227070
---
68237071

68247072
### User.ReadWrite.All
@@ -6832,6 +7080,8 @@ GET https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000
68327080

68337081
![personal Microsoft accounts][MSA] The *User.ReadWrite.All* delegated permission is available for consent in personal Microsoft accounts.
68347082

7083+
[!INCLUDE [User.ReadWrite.All](../includes/permissions-notes/user.readwrite.all.md)]
7084+
68357085
---
68367086

68377087
### User.RevokeSessions.All
@@ -7163,3 +7413,4 @@ Learn more about [RSC authorization framework and RSC permissions](/microsofttea
71637413
+ [Grant or revoke Microsoft Graph permissions programmatically](permissions-grant-via-msgraph.md)
71647414

71657415
[MSA]: images/permissions-reference/msa.svg "personal Microsoft accounts (MSA)"
7416+

‎correct-permissions-reference-errors.ps1

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ foreach ($typo in $corrections.Keys) {
3131
$content = $content -replace "\b$typo\b", $corrections[$typo]
3232
}
3333

34+
$content = $content -replace "’", "'"
35+
3436
# Write the corrected content back to the file
3537
Set-Content -Path $permissionsReferenceFilePath -Value $content
3638

0 commit comments

Comments
 (0)