Skip to content

Instantly share code, notes, and snippets.

@reprise99

reprise99/gist:64ff76ccdbbc6cecba8180bd1fe56597

Last active November 26, 2023 10:52
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save reprise99/64ff76ccdbbc6cecba8180bd1fe56597 to your computer and use it in GitHub Desktop.
Save reprise99/64ff76ccdbbc6cecba8180bd1fe56597 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.csv
RoleName ID DisplayName Description
APIConnectors.Read.All b86848a7-d5b1-41eb-a9b4-54a4e6306e97 Read API connectors for authentication flows Allows the app to read the API connectors used in user authentication flows, without a signed-in user.
APIConnectors.ReadWrite.All 1dfe531a-24a6-4f1b-80f4-7a0dc5a0a171 Read and write API connectors for authentication flows Allows the app to read, create and manage the API connectors used in user authentication flows, without a signed-in user.
AccessReview.Read.All d07a8cc0-3d51-4b77-b3b0-32704d1f69fa Read all access reviews Allows the app to read access reviews, reviewers, decisions and settings in the organization, without a signed-in user.
AccessReview.ReadWrite.All ef5f7d5c-338f-44b0-86c3-351f46c8bb5f Manage all access reviews Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization, without a signed-in user.
AccessReview.ReadWrite.Membership 18228521-a591-40f1-b215-5fad4488c117 Manage access reviews for group and app memberships Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization for group and app memberships, without a signed-in user.
AdministrativeUnit.Read.All 134fd756-38ce-4afd-ba33-e9623dbe66c2 Read all administrative units Allows the app to read administrative units and administrative unit membership without a signed-in user.
AdministrativeUnit.ReadWrite.All 5eb59dd3-1da2-4329-8733-9dabdc435916 Read and write all administrative units Allows the app to create, read, update, and delete administrative units and manage administrative unit membership without a signed-in user.
Agreement.Read.All 2f3e6f8c-093b-4c57-a58b-ba5ce494a169 Read all terms of use agreements Allows the app to read terms of use agreements, without a signed in user.
Agreement.ReadWrite.All c9090d00-6101-42f0-a729-c41074260d47 Read and write all terms of use agreements Allows the app to read and write terms of use agreements, without a signed in user.
AgreementAcceptance.Read.All d8e4ec18-f6c0-4620-8122-c8b1f2bf400e Read all terms of use acceptance statuses Allows the app to read terms of use acceptance statuses, without a signed in user.
AppRoleAssignment.ReadWrite.All 06b708a9-e830-4db3-a914-8e69da51d44f Manage app permission grants and app role assignments Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.
Application.Read.All 9a5d68dd-52b0-4cc2-bd40-abcf44ac3a30 Read all applications Allows the app to read all applications and service principals without a signed-in user.
Application.ReadWrite.All 1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9 Read and write all applications Allows the app to create, read, update and delete applications and service principals without a signed-in user. Does not allow management of consent grants.
Application.ReadWrite.OwnedBy 18a4783c-866b-4cc7-a460-3d5e5662c884 Manage apps that this app creates or owns Allows the app to create other applications, and fully manage those applications (read, update, update application secrets and delete), without a signed-in user. It cannot update any apps that it is not an owner of.
ApprovalRequest.Read.AdminConsentRequest 0d9d2e88-e2eb-4ac7-9b1d-9b68ed9f9f4f Read all admin consent approval requests Allows the app to read admin consent requests, business flows, and governance policy templates without a signed-in user.
ApprovalRequest.Read.CustomerLockbox 080ce695-a830-4d5c-a45a-375e3ab11b11 Read all customer lockbox approval requests Allows the app to read customer lockbox requests, business flows, and governance policy templates without a signed-in user.
ApprovalRequest.Read.EntitlementManagement b2a3adf0-5774-4846-986c-a91c705b0141 Read all entitlement management approval requests Allows the app to read entitlement management requests, business flows, and governance policy templates without a signed-in user.
ApprovalRequest.Read.PriviligedAccess 3f410ed8-2d83-4435-b2c4-c776f44e4ae1 Read all privileged access approval requests Allows the app to read privileged access requests, business flows, and governance policy templates without a signed-in user.
ApprovalRequest.ReadWrite.AdminConsentRequest afe5c674-a576-4b80-818c-e3d7f6afd299 Read and write all admin consent approval requests Allows the app to read and write admin consent requests, business flows, and governance policy templates without a signed-in user.
ApprovalRequest.ReadWrite.CustomerLockbox 5f411d27-abad-4dc3-83c6-b84a46ffa434 Read and write all customer lockbox approval requests Allows the app to read and write customer lockbox requests, business flows, and governance policy templates without a signed-in user.
ApprovalRequest.ReadWrite.EntitlementManagement fbfdecc9-4b78-4882-bb98-7decbddcbddf Read and write all entitlement management approval requests Allows the app to read and write entitlement management requests, business flows, and governance policy templates without a signed-in user.
ApprovalRequest.ReadWrite.PriviligedAccess 60182ac6-4565-4baa-8b04-9350fe8dbfca Read and write all privileged access approval requests Allows the app to read and write privileged access requests, business flows, and governance policy templates without a signed-in user.
AuditLog.Read.All b0afded3-3588-46d8-8b3d-9842eff778da Read all audit log data Allows the app to read and query your audit log activities, without a signed-in user.
BitlockerKey.Read.All 57f1cf28-c0c4-4ec3-9a30-19a2eaaf2f6e Read all BitLocker keys Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key.
BitlockerKey.ReadBasic.All f690d423-6b29-4d04-98c6-694c42282419 Read all BitLocker keys basic information Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key.
Calendars.Read 798ee544-9d2d-430c-a058-570e29e34338 Read calendars in all mailboxes Allows the app to read events of all calendars without a signed-in user.
Calendars.ReadWrite ef54d2bf-783f-4e0f-bca1-3210c0444d99 Read and write calendars in all mailboxes Allows the app to create, read, update, and delete events of all calendars without a signed-in user.
CallRecord-PstnCalls.Read.All a2611786-80b3-417e-adaa-707d4261a5f0 Read PSTN and direct routing call log data Allows the app to read all PSTN and direct routing call log data without a signed-in user.
CallRecords.Read.All 45bbb07e-7321-4fd7-a8f6-3ff27e6a81c8 Read all call records Allows the app to read call records for all calls and online meetings without a signed-in user.
Calls.AccessMedia.All a7a681dc-756e-4909-b988-f160edc6655f Access media streams in a call as an app Allows the app to get direct access to media streams in a call, without a signed-in user.
Calls.Initiate.All 284383ee-7f6e-4e40-a2a8-e85dcb029101 Initiate outgoing 1 to 1 calls from the app Allows the app to place outbound calls to a single user and transfer calls to users in your organization�s directory, without a signed-in user.
Calls.InitiateGroupCall.All 4c277553-8a09-487b-8023-29ee378d8324 Initiate outgoing group calls from the app Allows the app to place outbound calls to multiple users and add participants to meetings in your organization, without a signed-in user.
Calls.JoinGroupCall.All f6b49018-60ab-4f81-83bd-22caeabfed2d Join group calls and meetings as an app Allows the app to join group calls and scheduled meetings in your organization, without a signed-in user. The app will be joined with the privileges of a directory user to meetings in your organization.
Calls.JoinGroupCallAsGuest.All fd7ccf6b-3d28-418b-9701-cd10f5cd2fd4 Join group calls and meetings as a guest Allows the app to anonymously join group calls and scheduled meetings in your organization, without a signed-in user. The app will be joined as a guest to meetings in your organization.
Channel.Create f3a65bd4-b703-46df-8f7e-0174fea562aa Create channels Create channels in any team, without a signed-in user.
Channel.Delete.All 6a118a39-1227-45d4-af0c-ea7b40d210bc Delete channels Delete channels in any team, without a signed-in user.
Channel.ReadBasic.All 59a6b24b-4225-4393-8165-ebaec5f55d7a Read the names and descriptions of all channels Read all channel names and channel descriptions, without a signed-in user.
ChannelMember.Read.All 3b55498e-47ec-484f-8136-9013221c06a9 Read the members of all channels Read the members of all channels, without a signed-in user.
ChannelMember.ReadWrite.All 35930dcf-aceb-4bd1-b99a-8ffed403c974 Add and remove members from all channels Add and remove members from all channels, without a signed-in user. Also allows changing a member�s role, for example from owner to non-owner.
ChannelMessage.Read.All 7b2449af-6ccd-4f4d-9f78-e550c193f0d1 Read all channel messages Allows the app to read all channel messages in Microsoft Teams
ChannelMessage.UpdatePolicyViolation.All 4d02b0cc-d90b-441f-8d82-4fb55c34d6bb Flag channel messages for violating policy Allows the app to update Microsoft Teams channel messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing.
ChannelSettings.Read.All c97b873f-f59f-49aa-8a0e-52b32d762124 Read the names, descriptions, and settings of all channels Read all channel names, channel descriptions, and channel settings, without a signed-in user.
ChannelSettings.ReadWrite.All 243cded2-bd16-4fd6-a953-ff8177894c3d Read and write the names, descriptions, and settings of all channels Read and write the names, descriptions, and settings of all channels, without a signed-in user.
Chat.Create d9c48af6-9ad9-47ad-82c3-63757137b9af Create chats Allows the app to create chats without a signed-in user.
Chat.Read.All 6b7d71aa-70aa-4810-a8d9-5d9fb2830017 Read all chat messages Allows the app to read all 1-to-1 or group chat messages in Microsoft Teams.
Chat.ReadBasic.All b2e060da-3baf-4687-9611-f4ebc0f0cbde Read names and members of all chat threads Read names and members of all one-to-one and group chats in Microsoft Teams, without a signed-in user.
Chat.ReadWrite.All 294ce7c9-31ba-490a-ad7d-97a7d075e4ed Read and write all chat messages Allows an app to read and write all chat messages in Microsoft Teams, without a signed-in user.
Chat.UpdatePolicyViolation.All 7e847308-e030-4183-9899-5235d7270f58 Flag chat messages for violating policy Allows the app to update Microsoft Teams 1-to-1 or group chat messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing.
ChatMember.Read.All a3410be2-8e48-4f32-8454-c29a7465209d Read the members of all chats Read the members of all chats, without a signed-in user.
ChatMember.ReadWrite.All 57257249-34ce-4810-a8a2-a03adf0c5693 Add and remove members from all chats Add and remove members from all chats, without a signed-in user.
ChatMessage.Read.All b9bb2381-47a4-46cd-aafb-00cb12f68504 Read all chat messages Allows the app to read all one-to-one and group chats messages in Microsoft Teams, without a signed-in user.
CloudPC.Read.All a9e09520-8ed4-4cde-838e-4fdea192c227 Read Cloud PCs Allows the app to read the properties of Cloud PCs, without a signed-in user.
CloudPC.ReadWrite.All 3b4349e1-8cf5-45a3-95b7-69d1751d3e6a Read and write Cloud PCs Allows the app to read and write the properties of Cloud PCs, without a signed-in user.
ConsentRequest.Read.All 1260ad83-98fb-4785-abbb-d6cc1806fd41 Read all consent requests Allows the app to read consent requests and approvals without a signed-in user.
ConsentRequest.ReadWrite.All 9f1b81a7-0223-4428-bfa4-0bcb5535f27d Read and write all consent requests Allows the app to read app consent requests and approvals, and deny or approve those requests without a signed-in user.
Contacts.Read 089fe4d0-434a-44c5-8827-41ba8a0b17f5 Read contacts in all mailboxes Allows the app to read all contacts in all mailboxes without a signed-in user.
Contacts.ReadWrite 6918b873-d17a-4dc1-b314-35f528134491 Read and write contacts in all mailboxes Allows the app to create, read, update, and delete all contacts in all mailboxes without a signed-in user.
DelegatedPermissionGrant.ReadWrite.All 8e8e4742-1d95-4f68-9d56-6ee75648c72a Manage all delegated permission grants Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), without a signed-in user.
Device.Read.All 7438b122-aefc-4978-80ed-43db9fcc7715 Read all devices Allows the app to read your organization�s devices� configuration information without a signed-in user.
Device.ReadWrite.All 1138cb37-bd11-4084-a2b7-9f71582aeddb Read and write devices Allows the app to read and write all device properties without a signed in user. Does not allow device creation, device deletion or update of device alternative security identifiers.
DeviceManagementApps.Read.All 7a6ee1e7-141e-4cec-ae74-d9db155731ff Read Microsoft Intune apps Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user.
DeviceManagementApps.ReadWrite.All 78145de6-330d-4800-a6ce-494ff2d33d07 Read and write Microsoft Intune apps Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user.
DeviceManagementConfiguration.Read.All dc377aa6-52d8-4e23-b271-2a7ae04cedf3 Read Microsoft Intune device configuration and policies Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user.
DeviceManagementConfiguration.ReadWrite.All 9241abd9-d0e6-425a-bd4f-47ba86e767a4 Read and write Microsoft Intune device configuration and policies Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user.
DeviceManagementManagedDevices.PrivilegedOperations.All 5b07b0dd-2377-4e44-a38d-703f09a0dc3c Perform user-impacting remote actions on Microsoft Intune devices Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune, without a signed-in user.
DeviceManagementManagedDevices.Read.All 2f51be20-0bb4-4fed-bf7b-db946066c75e Read Microsoft Intune devices Allows the app to read the properties of devices managed by Microsoft Intune, without a signed-in user.
DeviceManagementManagedDevices.ReadWrite.All 243333ab-4d21-40cb-a475-36241daa0842 Read and write Microsoft Intune devices Allows the app to read and write the properties of devices managed by Microsoft Intune, without a signed-in user. Does not allow high impact operations such as remote wipe and password reset on the device�s owner
DeviceManagementRBAC.Read.All 58ca0d9a-1575-47e1-a3cb-007ef2e4583b Read Microsoft Intune RBAC settings Allows the app to read the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings, without a signed-in user.
DeviceManagementRBAC.ReadWrite.All e330c4f0-4170-414e-a55a-2f022ec2b57b Read and write Microsoft Intune RBAC settings Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings, without a signed-in user.
DeviceManagementServiceConfig.Read.All 06a5fe6d-c49d-46a7-b082-56b1b14103c7 Read Microsoft Intune configuration Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user.
DeviceManagementServiceConfig.ReadWrite.All 5ac13192-7ace-4fcf-b828-1a26f28068ee Read and write Microsoft Intune configuration Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user.
Directory.Read.All 7ab1d382-f21e-4acd-a863-ba3e13f7da61 Read directory data Allows the app to read data in your organization�s directory, such as users, groups and apps, without a signed-in user.
Directory.ReadWrite.All 19dbc75e-c2e2-444c-a770-ec69d8559fc7 Read and write directory data Allows the app to read and write data in your organization�s directory, such as users, and groups, without a signed-in user. Does not allow user or group deletion.
Domain.Read.All dbb9058a-0e50-45d7-ae91-66909b5d4664 Read domains Allows the app to read all domain properties without a signed-in user.
Domain.ReadWrite.All 7e05723c-0bb0-42da-be95-ae9f08a6e53c Read and write domains Allows the app to read and write all domain properties without a signed in user. Also allows the app to add, verify and remove domains.
EduAdministration.Read.All 7c9db06a-ec2d-4e7b-a592-5a1e30992566 Read Education app settings Read the state and settings of all Microsoft education apps.
EduAdministration.ReadWrite.All 9bc431c3-b8bc-4a8d-a219-40f10f92eff6 Manage education app settings Manage the state and settings of all Microsoft education apps.
EduAssignments.Read.All 4c37e1b6-35a1-43bf-926a-6f30f2cdf585 Read class assignments with grades Allows the app to read assignments and their grades for all users.
EduAssignments.ReadBasic.All 6e0a958b-b7fc-4348-b7c4-a6ab9fd3dd0e Read class assignments without grades Allows the app to read assignments without grades for all users.
EduAssignments.ReadWrite.All 0d22204b-6cad-4dd0-8362-3e3f2ae699d9 Read and write class assignments with grades Allows the app to read and write assignments and their grades for all users.
EduAssignments.ReadWriteBasic.All f431cc63-a2de-48c4-8054-a34bc093af84 Read and write class assignments without grades Allows the app to read and write assignments without grades for all users.
EduRoster.Read.All e0ac9e1b-cb65-4fc5-87c5-1a8bc181f648 Read the organization�s roster Allows the app to read the structure of schools and classes in the organization�s roster and education-specific information about all users to be read.
EduRoster.ReadBasic.All 0d412a8c-a06c-439f-b3ec-8abcf54d2f96 Read a limited subset of the organization�s roster Allows the app to read a limited subset of properties from both the structure of schools and classes in the organization�s roster and education-specific information about all users. Includes name, status, role, email address and photo.
EduRoster.ReadWrite.All d1808e82-ce13-47af-ae0d-f9b254e6d58a Read and write the organization�s roster Allows the app to read and write the structure of schools and classes in the organization�s roster and education-specific information about all users to be read and written.
EntitlementManagement.Read.All c74fd47d-ed3c-45c3-9a9e-b8676de685d2 Read all entitlement management resources Allows the app to read access packages and related entitlement management resources without a signed-in user.
EntitlementManagement.ReadWrite.All 9acd699f-1e81-4958-b001-93b1d2506e19 Read and write all entitlement management resources Allows the app to read and write access packages and related entitlement management resources without a signed-in user.
ExternalConnection.ReadWrite.OwnedBy f431331c-49a6-499f-be1c-62af19c34a9d Read and write external connections Allows the app to read and write external connections without a signed-in user. The app can only read and write external connections that it is authorized to, or it can create new external connections.
ExternalItem.ReadWrite.All 38c3d6ee-69ee-422f-b954-e17819665354 Read and write items in external datasets Allow the app to read or write items in all external datasets that the app is authorized to access
ExternalItem.ReadWrite.OwnedBy 8116ae0f-55c2-452d-9944-d18420f5b2c8 Read and write external items Allows the app to read and write external items without a signed-in user. The app can only read external items of the connection that it is authorized to.
Files.Read.All 01d4889c-1287-42c6-ac1f-5d1e02578ef6 Read files in all site collections Allows the app to read all files in all site collections without a signed in user.
Files.ReadWrite.All 75359482-378d-4052-8f01-80520e7db3cd Read and write files in all site collections Allows the app to read, create, update and delete all files in all site collections without a signed in user.
Group.Create bf7b1a76-6e77-406b-b258-bf5c7720e98f Create groups Allows the app to create groups without a signed-in user.
Group.Read.All 5b567255-7703-4780-807c-7be8301ae99b Read all groups Allows the app to read group properties and memberships, and read the calendar and conversations for all groups, without a signed-in user.
Group.ReadWrite.All 62a82d76-70ea-41e2-9197-370581804d09 Read and write all groups Allows the app to create groups, read all group properties and memberships, update group properties and memberships, and delete groups. Also allows the app to read and write group calendar and conversations. All of these operations can be performed by the app without a signed-in user.
GroupMember.Read.All 98830695-27a2-44f7-8c18-0c3ebc9698f6 Read all group memberships Allows the app to read memberships and basic group properties for all groups without a signed-in user.
GroupMember.ReadWrite.All dbaae8cf-10b5-4b86-a4a1-f871c94c6695 Read and write all group memberships Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted.
IdentityProvider.Read.All e321f0bb-e7f7-481e-bb28-e3b0b32d4bd0 Read identity providers Allows the app to read your organization�s identity (authentication) providers� properties without a signed in user.
IdentityProvider.ReadWrite.All 90db2b9a-d928-4d33-a4dd-8442ae3d41e4 Read and write identity providers Allows the app to read and write your organization�s identity (authentication) providers� properties without a signed in user.
IdentityRiskEvent.Read.All 6e472fd1-ad78-48da-a0f0-97ab2c6b769e Read all identity risk event information Allows the app to read the identity risk event information for your organization without a signed in user.
IdentityRiskEvent.ReadWrite.All db06fb33-1953-4b7b-a2ac-f1e2c854f7ae Read and write all risk detection information Allows the app to read and update identity risk detection information for your organization without a signed-in user. Update operations include confirming risk event detections.
IdentityRiskyUser.Read.All dc5007c0-2d7d-4c42-879c-2dab87571379 Read all identity risky user information Allows the app to read the identity risky user information for your organization without a signed in user.
IdentityRiskyUser.ReadWrite.All 656f6061-f9fe-4807-9708-6a2e0934df76 Read and write all risky user information Allows the app to read and update identity risky user information for your organization without a signed-in user. Update operations include dismissing risky users.
IdentityUserFlow.Read.All 1b0c317f-dd31-4305-9932-259a8b6e8099 Read all identity user flows Allows the app to read your organization�s user flows, without a signed-in user.
IdentityUserFlow.ReadWrite.All 65319a09-a2be-469d-8782-f6b07debf789 Read and write all identity user flows Allows the app to read or write your organization�s user flows, without a signed-in user.
InformationProtectionPolicy.Read.All 19da66cb-0fb0-4390-b071-ebc76a349482 Read all published labels and label policies for an organization. Allows an app to read published sensitivity labels and label policy settings for the entire organization or a specific user, without a signed in user.
Mail.Read 810c84a8-4a9e-49e6-bf7d-12d183f40d01 Read mail in all mailboxes Allows the app to read mail in all mailboxes without a signed-in user.
Mail.ReadBasic 6be147d2-ea4f-4b5a-a3fa-3eab6f3c140a Read basic mail in all mailboxes Allows the app to read basic mail properties in all mailboxes without a signed-in user. Includes all properties except body, previewBody, attachments and any extended properties.
Mail.ReadBasic.All 693c5e45-0940-467d-9b8a-1022fb9d42ef Read basic mail in all mailboxes Allows the app to read basic mail properties in all mailboxes without a signed-in user. Includes all properties except body, previewBody, attachments and any extended properties.
Mail.ReadWrite e2a3a72e-5f79-4c64-b1b1-878b674786c9 Read and write mail in all mailboxes Allows the app to create, read, update, and delete mail in all mailboxes without a signed-in user. Does not include permission to send mail.
Mail.Send b633e1c5-b582-4048-a93e-9f11b44c7e96 Send mail as any user Allows the app to send mail as any user without a signed-in user.
MailboxSettings.Read 40f97065-369a-49f4-947c-6a255697ae91 Read all user mailbox settings Allows the app to read user�s mailbox settings without a signed-in user. Does not include permission to send mail.
MailboxSettings.ReadWrite 6931bccd-447a-43d1-b442-00a195474933 Read and write all user mailbox settings Allows the app to create, read, update, and delete user�s mailbox settings without a signed-in user. Does not include permission to send mail.
Member.Read.Hidden 658aa5d8-239f-45c4-aa12-864f4fc7e490 Read all hidden memberships Allows the app to read the memberships of hidden groups and administrative units without a signed-in user.
Notes.Read.All 3aeca27b-ee3a-4c2b-8ded-80376e2134a4 Read all OneNote notebooks Allows the app to read all the OneNote notebooks in your organization, without a signed-in user.
Notes.ReadWrite.All 0c458cef-11f3-48c2-a568-c66751c238c0 Read and write all OneNote notebooks Allows the app to read all the OneNote notebooks in your organization, without a signed-in user.
OnPremisesPublishingProfiles.ReadWrite.All 0b57845e-aa49-4e6f-8109-ce654fffa618 Manage on-premises published resources Allows the app to create, view, update and delete on-premises published resources, on-premises agents and agent groups, as part of a hybrid identity configuration, without a signed in user.
OnlineMeetings.Read.All c1684f21-1984-47fa-9d61-2dc8c296bb70 Read online meeting details Allows the app to read online meeting details in your organization, without a signed-in user.
OnlineMeetings.ReadWrite.All b8bb2037-6e08-44ac-a4ea-4674e010e2a4 Read and create online meetings Allows the app to read and create online meetings as an application in your organization.
OrgContact.Read.All e1a88a34-94c4-4418-be12-c87b00e26bea Read organizational contacts Allows the app to read all organizational contacts without a signed-in user. These contacts are managed by the organization and are different from a user�s personal contacts.
Organization.Read.All 498476ce-e0fe-48b0-b801-37ba7e2685c6 Read organization information Allows the app to read the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information.
Organization.ReadWrite.All 292d869f-3427-49a8-9dab-8c70152b74e9 Read and write organization information Allows the app to read and write the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information.
People.Read.All b528084d-ad10-4598-8b93-929746b4d7d6 Read all users� relevant people lists Allows the app to read any user�s scored list of relevant people, without a signed-in user. The list can include local contacts, contacts from social networking, your organization�s directory, and people from recent communications (such as email and Skype).
Place.Read.All 913b9306-0ce1-42b8-9137-6a7df690a760 Read all company places Allows the app to read company places (conference rooms and room lists) for calendar events and other applications, without a signed-in user.
Policy.Read.All 246dd0d5-5bd0-4def-940b-0421030a5b68 Read your organization�s policies Allows the app to read all your organization�s policies without a signed in user.
Policy.Read.ConditionalAccess 37730810-e9ba-4e46-b07e-8ca78d182097 Read your organization�s conditional access policies Allows the app to read your organization�s conditional access policies, without a signed-in user.
Policy.Read.PermissionGrant 9e640839-a198-48fb-8b9a-013fd6f6cbcd Read consent and permission grant policies Allows the app to read policies related to consent and permission grants for applications, without a signed-in user.
Policy.ReadWrite.ApplicationConfiguration be74164b-cff1-491c-8741-e671cb536e13 Read and write your organization�s application configuration policies Allows the app to read and write your organization�s application configuration policies, without a signed-in user. This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy, tokenIssuancePolicy and tokenLifetimePolicy.
Policy.ReadWrite.AuthenticationFlows 25f85f3c-f66c-4205-8cd5-de92dd7f0cec Read and write authentication flow policies Allows the app to read and write all authentication flow policies for the tenant, without a signed-in user.
Policy.ReadWrite.AuthenticationMethod 29c18626-4985-4dcd-85c0-193eef327366 Read and write all authentication method policies Allows the app to read and write all authentication method policies for the tenant, without a signed-in user.
Policy.ReadWrite.Authorization fb221be6-99f2-473f-bd32-01c6a0e9ca3b Read and write your organization�s authorization policy Allows the app to read and write your organization�s authorization policy without a signed in user. For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default.
Policy.ReadWrite.ConditionalAccess 01c0a623-fc9b-48e9-b794-0756f8e8f067 Read and write your organization�s conditional access policies Allows the app to read and write your organization�s conditional access policies, without a signed-in user.
Policy.ReadWrite.ConsentRequest 999f8c63-0a38-4f1b-91fd-ed1947bdd1a9 Read and write your organization�s consent request policy Allows the app to read and write your organization�s consent requests policy without a signed-in user.
Policy.ReadWrite.FeatureRollout 2044e4f1-e56c-435b-925c-44cd8f6ba89a Read and write feature rollout policies Allows the app to read and write feature rollout policies without a signed-in user. Includes abilities to assign and remove users and groups to rollout of a specific feature.
Policy.ReadWrite.PermissionGrant a402ca1c-2696-4531-972d-6e5ee4aa11ea Manage consent and permission grant policies Allows the app to manage policies related to consent and permission grants for applications, without a signed-in user.
Policy.ReadWrite.TrustFramework 79a677f7-b79d-40d0-a36a-3e6f8688dd7a Read and write your organization�s trust framework policies Allows the app to read and write your organization�s trust framework policies without a signed in user.
Presence.ReadWrite.All 83cded22-8297-4ff6-a7fa-e97e9545a259 Read and write presence information for all users Allows the app to read all presence information and write activity and availability of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, time zone and location.
PrintJob.Manage.All 58a52f47-9e36-4b17-9ebe-ce4ef7f3e6c8 Perform advanced operations on print jobs Allows the application to perform advanced operations like redirecting a print job to another printer without a signed-in user. Also allows the application to read and update the metadata of print jobs.
PrintJob.Read.All ac6f956c-edea-44e4-bd06-64b1b4b9aec9 Read print jobs Allows the application to read the metadata and document content of print jobs without a signed-in user.
PrintJob.ReadBasic.All fbf67eee-e074-4ef7-b965-ab5ce1c1f689 Read basic information for print jobs Allows the application to read the metadata of print jobs without a signed-in user. Does not allow access to print job document content.
PrintJob.ReadWrite.All 5114b07b-2898-4de7-a541-53b0004e2e13 Read and write print jobs Allows the application to read and update the metadata and document content of print jobs without a signed-in user.
PrintJob.ReadWriteBasic.All 57878358-37f4-4d3a-8c20-4816e0d457b1 Read and write basic information for print jobs Allows the application to read and update the metadata of print jobs without a signed-in user. Does not allow access to print job document content.
PrintSettings.Read.All b5991872-94cf-4652-9765-29535087c6d8 Read tenant-wide print settings Allows the application to read tenant-wide print settings without a signed-in user.
PrintTaskDefinition.ReadWrite.All 456b71a7-0ee0-4588-9842-c123fcc8f664 Read, write and update print task definitions Allows the application to read and update print task definitions without a signed-in user.
Printer.Read.All 9709bb33-4549-49d4-8ed9-a8f65e45bb0f Read printers Allows the application to read printers without a signed-in user.
Printer.ReadWrite.All f5b3f73d-6247-44df-a74c-866173fddab0 Read and update printers Allows the application to read and update printers without a signed-in user. Does not allow creating (registering) or deleting (unregistering) printers.
PrivilegedAccess.Read.AzureAD 4cdc2547-9148-4295-8d11-be0db1391d6b Read privileged access to Azure AD roles Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles in your organization, without a signed-in user.
PrivilegedAccess.Read.AzureADGroup 01e37dc9-c035-40bd-b438-b2879c4870a6 Read privileged access to Azure AD groups Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user.
PrivilegedAccess.Read.AzureResources 5df6fe86-1be0-44eb-b916-7bd443a71236 Read privileged access to Azure resources Allows the app to read time-based assignment and just-in-time elevation of user privileges to audit Azure resources in your organization, without a signed-in user.
PrivilegedAccess.ReadWrite.AzureAD 854d9ab1-6657-4ec8-be45-823027bcd009 Read and write privileged access to Azure AD roles Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles in your organization, without a signed-in user.
PrivilegedAccess.ReadWrite.AzureADGroup 2f6817f8-7b12-4f0f-bc18-eeaf60705a9e Read and write privileged access to Azure AD groups Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user.
PrivilegedAccess.ReadWrite.AzureResources 6f9d5abc-2db6-400b-a267-7de22a40fb87 Read and write privileged access to Azure resources Allows the app to request and manage time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) in your organization, without a signed-in user.
ProgramControl.Read.All eedb7fdd-7539-4345-a38b-4839e4a84cbd Read all programs Allows the app to read programs and program controls in the organization, without a signed-in user.
ProgramControl.ReadWrite.All 60a901ed-09f7-4aa5-a16e-7dd3d6f9de36 Manage all programs Allows the app to read, update, delete and perform actions on programs and program controls in the organization, without a signed-in user.
Reports.Read.All 230c1aed-a721-4c5d-9cb4-a90514e508ef Read all usage reports Allows an app to read all service usage reports without a signed-in user. Services that provide usage reports include Office 365 and Azure Active Directory.
RoleManagement.Read.All c7fbd983-d9aa-4fa7-84b8-17382c103bc4 Read role management data for all RBAC providers Allows the app to read role-based access control (RBAC) settings for all RBAC providers without a signed-in user. This includes reading role definitions and role assignments.
RoleManagement.Read.Directory 483bed4a-2ad3-4361-a73b-c83ccdbdc53c Read all directory RBAC settings Allows the app to read the role-based access control (RBAC) settings for your company�s directory, without a signed-in user. This includes reading directory role templates, directory roles and memberships.
RoleManagement.ReadWrite.Directory 9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8 Read and write all directory RBAC settings Allows the app to read and manage the role-based access control (RBAC) settings for your company�s directory, without a signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.
Schedule.Read.All 7b2ebf90-d836-437f-b90d-7b62722c4456 Read all schedule items Allows the app to read all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.
Schedule.ReadWrite.All b7760610-0545-4e8a-9ec3-cce9e63db01c Read and write all schedule items Allows the app to manage all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.
SecurityActions.Read.All 5e0edab9-c148-49d0-b423-ac253e121825 Read your organization�s security actions Allows the app to read security actions, without a signed-in user.
SecurityActions.ReadWrite.All f2bf083f-0179-402a-bedb-b2784de8a49b Read and update your organization�s security actions Allows the app to read or update security actions, without a signed-in user.
SecurityEvents.Read.All bf394140-e372-4bf9-a898-299cfc7564e5 Read your organization�s security events Allows the app to read your organization�s security events without a signed-in user.
SecurityEvents.ReadWrite.All d903a879-88e0-4c09-b0c9-82f6a1333f84 Read and update your organization�s security events Allows the app to read your organization�s security events without a signed-in user. Also allows the app to update editable properties in security events.
ServiceHealth.Read.All 79c261e0-fe76-4144-aad5-bdc68fbe4037 Read service health Allows the app to read your tenant�s service health information, without a signed-in user. Health information may include service issues or service health overviews.
ServiceMessage.Read.All 1b620472-6534-4fe6-9df2-4680e8aa28ec Read service messages Allows the app to read your tenant�s service announcement messages, without a signed-in user. Messages may include information about new or changed features.
ServicePrincipalEndpoint.Read.All 5256681e-b7f6-40c0-8447-2d9db68797a0 Read service principal endpoints Allows the app to read service principal endpoints
ServicePrincipalEndpoint.ReadWrite.All 89c8469c-83ad-45f7-8ff2-6e3d4285709e Read and update service principal endpoints Allows the app to update service principal endpoints
ShortNotes.Read.All 0c7d31ec-31ca-4f58-b6ec-9950b6b0de69 Read all users� short notes Allows the app to read all the short notes without a signed-in user.
ShortNotes.ReadWrite.All 842c284c-763d-4a97-838d-79787d129bab Read, create, edit, and delete all users� short notes Allows the app to read, create, edit, and delete all the short notes without a signed-in user.
Sites.FullControl.All a82116e5-55eb-4c41-a434-62fe8a61c773 Have full control of all site collections Allows the app to have full control of all site collections without a signed in user.
Sites.Manage.All 0c0bf378-bf22-4481-8f81-9e89a9b4960a Create, edit, and delete items and lists in all site collections Allows the app to create or delete document libraries and lists in all site collections without a signed in user.
Sites.Read.All 332a536c-c7ef-4017-ab91-336970924f0d Read items in all site collections Allows the app to read documents and list items in all site collections without a signed in user.
Sites.ReadWrite.All 9492366f-7969-46a4-8d15-ed1a20078fff Read and write items in all site collections Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user.
Sites.Selected 883ea226-0bf2-4a8f-9f9d-92c9162a727d Access selected site collections Allow the application to access a subset of site collections without a signed in user. The specific site collections and the permissions granted will be configured in SharePoint Online.
Team.Create 23fc2474-f741-46ce-8465-674744c5c361 Create teams Allows the app to create teams without a signed-in user.
Team.ReadBasic.All 2280dda6-0bfd-44ee-a2f4-cb867cfc4c1e Get a list of all teams Get a list of all teams, without a signed-in user.
TeamMember.Read.All 660b7406-55f1-41ca-a0ed-0b035e182f3e Read the members of all teams Read the members of all teams, without a signed-in user.
TeamMember.ReadWrite.All 0121dc95-1b9f-4aed-8bac-58c5ac466691 Add and remove members from all teams Add and remove members from all teams, without a signed-in user. Also allows changing a team member�s role, for example from owner to non-owner.
TeamMember.ReadWriteNonOwnerRole.All 4437522e-9a86-4a41-a7da-e380edd4a97d Add and remove members with non-owner role for all teams Add and remove members from all teams, without a signed-in user. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role.
TeamSettings.Read.All 242607bd-1d2c-432c-82eb-bdb27baa23ab Read all teams� settings Read all team�s settings, without a signed-in user.
TeamSettings.ReadWrite.All bdd80a03-d9bc-451d-b7c4-ce7c63fe3c8f Read and change all teams� settings Read and change all teams� settings, without a signed-in user.
TeamsActivity.Read.All 70dec828-f620-4914-aa83-a29117306807 Read all users� teamwork activity feed Allows the app to read all users� teamwork activity feed, without a signed-in user.
TeamsActivity.Send a267235f-af13-44dc-8385-c1dc93023186 Send a teamwork activity to any user Allows the app to create new notifications in users� teamwork activity feeds without a signed in user. These notifications may not be discoverable or be held or governed by compliance policies.
TeamsApp.Read.All afdb422a-4b2a-4e07-a708-8ceed48196bf Read all users� installed Teams apps Allows the app to read the Teams apps that are installed for any user, without a signed-in user. Does not give the ability to read application-specific settings.
TeamsApp.ReadWrite.All eb6b3d76-ed75-4be6-ac36-158d04c0a555 Manage all users� Teams apps Allows the app to read, install, upgrade, and uninstall Teams apps for any user, without a signed-in user. Does not give the ability to read or write application-specific settings.
TeamsAppInstallation.ReadForChat.All cc7e7635-2586-41d6-adaa-a8d3bcad5ee5 Read installed Teams apps for all chats Allows the app to read the Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings.
TeamsAppInstallation.ReadForTeam.All 1f615aea-6bf9-4b05-84bd-46388e138537 Read installed Teams apps for all teams Allows the app to read the Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings.
TeamsAppInstallation.ReadForUser.All 9ce09611-f4f7-4abd-a629-a05450422a97 Read installed Teams apps for all users Allows the app to read the Teams apps that are installed for any user, without a signed-in user. Does not give the ability to read application-specific settings.
TeamsAppInstallation.ReadWriteForChat.All 9e19bae1-2623-4c4f-ab6e-2664615ff9a0 Manage Teams apps for all chats Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings.
TeamsAppInstallation.ReadWriteForTeam.All 5dad17ba-f6cc-4954-a5a2-a0dcc95154f0 Manage Teams apps for all teams Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings.
TeamsAppInstallation.ReadWriteForUser.All 74ef0291-ca83-4d02-8c7e-d2391e6a444f Manage Teams apps for all users Allows the app to read, install, upgrade, and uninstall Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings.
TeamsAppInstallation.ReadWriteSelfForChat.All 73a45059-f39c-4baf-9182-4954ac0e55cf Allow the Teams app to manage itself for all chats Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user.
TeamsAppInstallation.ReadWriteSelfForTeam.All 9f67436c-5415-4e7f-8ac1-3014a7132630 Allow the Teams app to manage itself for all teams Allows a Teams app to read, install, upgrade, and uninstall itself in any team, without a signed-in user.
TeamsAppInstallation.ReadWriteSelfForUser.All 908de74d-f8b2-4d6b-a9ed-2a17b3b78179 Allow the app to manage itself for all users Allows a Teams app to read, install, upgrade, and uninstall itself to any user, without a signed-in user.
TeamsTab.Create 49981c42-fd7b-4530-be03-e77b21aed25e Create tabs in Microsoft Teams. Allows the app to create tabs in any team in Microsoft Teams, without a signed-in user. This does not grant the ability to read, modify or delete tabs after they are created, or give access to the content inside the tabs.
TeamsTab.Read.All 46890524-499a-4bb2-ad64-1476b4f3e1cf Read tabs in Microsoft Teams. Read the names and settings of tabs inside any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs.
TeamsTab.ReadWrite.All a96d855f-016b-47d7-b51c-1218a98d791c Read and write tabs in Microsoft Teams. Read and write tabs in any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs.
TeamsTab.ReadWriteForChat.All fd9ce730-a250-40dc-bd44-8dc8d20f39ea Allow the Teams app to manage all tabs for all chats Allows a Teams app to read, install, upgrade, and uninstall all tabs for any chat, without a signed-in user.
TeamsTab.ReadWriteForTeam.All 6163d4f4-fbf8-43da-a7b4-060fe85ed148 Allow the Teams app to manage all tabs for all teams Allows a Teams app to read, install, upgrade, and uninstall all tabs in any team, without a signed-in user.
TeamsTab.ReadWriteForUser.All 425b4b59-d5af-45c8-832f-bb0b7402348a Allow the app to manage all tabs for all users Allows a Teams app to read, install, upgrade, and uninstall all tabs for any user, without a signed-in user.
Teamwork.Migrate.All dfb0dd15-61de-45b2-be36-d6a69fba3c79 Create chat and channel messages with anyone�s identity and with any timestamp Allows the app to create chat and channel messages, without a signed in user. The app specifies which user appears as the sender, and can backdate the message to appear as if it was sent long ago. The messages can be sent to any chat or channel in the organization.
TeamworkTag.Read.All b74fd6c4-4bde-488e-9695-eeb100e4907f Read tags in Teams Allows the app to read tags in Teams without a signed-in user.
TeamworkTag.ReadWrite.All a3371ca5-911d-46d6-901c-42c8c7a937d8 Read and write tags in Teams Allows the app to read and write tags in Teams without a signed-in user.
TermStore.Read.All ea047cc2-df29-4f3e-83a3-205de61501ca Read all term store data Allows the app to read all term store data, without a signed-in user. This includes all sets, groups and terms in the term store.
TermStore.ReadWrite.All f12eb8d6-28e3-46e6-b2c0-b7e4dc69fc95 Read and write all term store data Allows the app to read, edit or write all term store data, without a signed-in user. This includes all sets, groups and terms in the term store.
ThreatAssessment.Read.All f8f035bb-2cce-47fb-8bf5-7baf3ecbee48 Read threat assessment requests Allows an app to read your organization�s threat assessment requests, without a signed-in user.
ThreatIndicators.Read.All 197ee4e9-b993-4066-898f-d6aecc55125b Read all threat indicators Allows the app to read all the indicators for your organization, without a signed-in user.
ThreatIndicators.ReadWrite.OwnedBy 21792b6c-c986-4ffc-85de-df9da54b52fa Manage threat indicators this app creates or owns Allows the app to create threat indicators, and fully manage those threat indicators (read, update and delete), without a signed-in user. It cannot update any threat indicators it does not own.
TrustFrameworkKeySet.Read.All fff194f1-7dce-4428-8301-1badb5518201 Read trust framework key sets Allows the app to read trust framework key set properties without a signed-in user.
TrustFrameworkKeySet.ReadWrite.All 4a771c9a-1cf2-4609-b88e-3d3e02d539cd Read and write trust framework key sets Allows the app to read and write trust framework key set properties without a signed-in user.
User.Export.All 405a51b5-8d8d-430b-9842-8be4b0e9f324 Export user�s data Allows the app to export data (e.g. customer content or system-generated logs), associated with any user in your company, when the app is used by a privileged user (e.g. a Company Administrator).
User.Invite.All 09850681-111b-4a89-9bed-3f2cae46d706 Invite guest users to the organization Allows the app to invite guest users to the organization, without a signed-in user.
User.ManageIdentities.All c529cfca-c91b-489c-af2b-d92990b66ce6 Manage all users� identities Allows the app to read, update and delete identities that are associated with a user�s account, without a signed in user. This controls the identities users can sign-in with.
User.Read.All df021288-bdef-4463-88db-98f22de89214 Read all users� full profiles Allows the app to read user profiles without a signed in user.
User.ReadWrite.All 741f803b-c850-494e-b5df-cde7c675a1ca Read and write all users� full profiles Allows the app to read and update user profiles without a signed in user.
UserAuthenticationMethod.Read.All 38d9df27-64da-44fd-b7c5-a6fbac20248f Read all users� authentication methods Allows the app to read authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user�s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.
UserAuthenticationMethod.ReadWrite.All 50483e42-d915-4231-9639-7fdb7fd190e5 Read and write all users� authentication methods Allows the application to read and write authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user�s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods
UserNotification.ReadWrite.CreatedByApp 4e774092-a092-48d1-90bd-baad67c7eb47 Deliver and manage all user�s notifications Allows the app to send, read, update and delete user�s notifications, without a signed-in user.
UserShiftPreferences.Read.All de023814-96df-4f53-9376-1e2891ef5a18 Read all user shift preferences Allows the app to read all users� shift schedule preferences without a signed-in user.
UserShiftPreferences.ReadWrite.All d1eec298-80f3-49b0-9efb-d90e224798ac Read and write all user shift preferences Allows the app to manage all users� shift schedule preferences without a signed-in user.
WindowsUpdates.ReadWrite.All 7dd1be58-6e76-4401-bf8d-31d1e8180d5b Read and write all Windows update deployment settings Allows the app to read and write all Windows update deployment settings for the organization without a signed-in user.
WorkforceIntegration.ReadWrite.All 202bf709-e8e6-478e-bcfd-5d63c50b68e3 Read and write workforce integrations Allows the app to manage workforce integrations to synchronize data from Microsoft Teams Shifts, without a signed-in user.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment