Connect-MgGraph -Scopes: which permissions to request in Microsoft Graph PowerShell

Connect-MgGraph -Scopes signs you in to Microsoft Graph PowerShell and requests the listed delegated permissions for the session:

Connect-MgGraph -Scopes "User.Read.All", "Group.ReadWrite.All"

The first time a scope is requested, Microsoft Entra ID shows a consent prompt; scopes marked "admin consent required" need an administrator to consent for the organization. Request only what the script needs: the token is only as limited as the scopes you ask for.

Find the scope a cmdlet needs

Find-MgGraphCommand (in Microsoft.Graph.Authentication) knows the API call and permissions behind every cmdlet, and works offline. For Get-MgUser listing users, the User.* permissions in module 2.41.2:

Import-Module Microsoft.Graph.Authentication
Find-MgGraphCommand -Command Get-MgUser |
  Where-Object URI -eq '/users' |
  Select-Object -ExpandProperty Permissions |
  Where-Object Name -like 'User.*' |
  Sort-Object PermissionType, Name -Unique |
  ForEach-Object { '{0,-14} {1,-26} admin consent: {2}' -f $_.PermissionType, $_.Name, $_.IsAdmin }

Application    User.Read.All              admin consent: True
Application    User.ReadBasic.All         admin consent: True
Application    User.ReadWrite.All         admin consent: True
Application    User.ReadWrite.CrossCloud  admin consent: False
DelegatedWork  User.Read.All              admin consent: True
DelegatedWork  User.ReadBasic.All         admin consent: False
DelegatedWork  User.ReadWrite.All         admin consent: True

Any one of the listed permissions is enough; the least privileged one that returns the properties you need is the right choice (User.ReadBasic.All returns only basic profile properties). DelegatedWork rows apply to -Scopes; Application rows are app roles for app-only sign-in.

Connection options

In module 2.41.2 -UseDeviceCode also accepts the aliases -UseDeviceAuthentication, -DeviceCode, -DeviceAuth and -Device; -ClientId accepts -AppId and -ApplicationId.

App-only: no -Scopes

With certificate, client secret or managed identity sign-in, -Scopes is not used. The permissions are the application permissions granted to the app registration (with admin consent) in the Entra admin center, and the token carries all of them. Check what you got with Get-MgContext.

Adding a scope later

Run Connect-MgGraph -Scopes again with the extra scope; the new consent is added to the session. If a cmdlet fails with Insufficient privileges to complete the operation, the missing piece is usually a scope (delegated) or an application permission (app-only), or for delegated access a directory role on the signed-in user.