Microsoft Graph Permissions Well-Known Ids

If you’re working with the Microsoft identity platform, you’re probably familiar with the concept of application Scopes or Roles. Scopes or Roles are used to either expose a permission in your application or to grant a permission (defined in another application) to it, e.g. grant Microsoft Graph permissions to read the user profile.

When you’re granting permissions to an application, you need to understand what type of permission to grant: it can be a delegated (scope) permission or an app-only (role) one. If this part is confusing to you, I’ve found this page quite useful, especially the following paragraph:

Delegated permissions, also called scopes, allow the application to act on behalf of the signed-in user. Application permissions, also called app roles, allow the app to access data on its own, without a signed-in user.

On top of understanding the differences between scope and roles, you also need to know the ID of the permission that you are interested in e.g. You want to grant GroupMember.Read.All to your application so you can fetch the members of a given group.

The issue I found working with these IDS is that I’m not able to find a comprehensive list of those, alongside their name and description so I decided to list them in this blog post, mostly to simplify my life when working with it.

Actually while writing this article, I found this page where the same permissions are listed, but I still find the following tables handier since they contains all the data I need.

Besides that, I also wanted to share a tiny az cli command that you can use to fetch all the defined scopes and roles.

az ad sp show --id 00000003-0000-0000-c000-000000000000 --query "{roles: appRoles, scopes: oauth2PermissionScopes}"

The snippet above displays all the roles and scope defined for the Microsoft Graph application, the 00000003-0000-0000-c000-000000000000 is the globally unique ID of the Microsoft Graph Service principal in the Azure Active directory.

Pro tip! If you add -o jsonc at the end of an az cli command, you will get a nice colorized json output. You can find all the output modifiers for az cli in the documentation

Well-known scopes

Here below you can find the list of all the well-known scopes defined by Microsoft Graph

Well-known roles

Here below you can find the list of all the well-known roles defined by Microsoft Graph

Till the next time!