/compare/entra-id/graph-permission-vs-entra-role
Microsoft Graph permission vs Microsoft Entra role: delegated scopes, app roles and admin roles
- tool
- Microsoft Entra ID
- compares
- Microsoft Graph permission vs Microsoft Entra role
A Microsoft Graph permission (for example User.ReadWrite.All) is granted to an application and decides which Graph APIs the app may call. A Microsoft Entra role (for example User Administrator) is assigned to a user, group or service principal and decides what that identity may do in the directory, through any tool. In delegated access (a user signed in, as with Connect-MgGraph -Scopes) the effective rights are the intersection of both: the app cannot do more than the user could do.
| Criterion | Graph permission | Entra role |
|---|---|---|
| Granted to | An application (its service principal) | A user, a role-assignable group or a service principal |
| Controls | Which Graph API operations the app may call | Which directory and service operations the identity may perform |
| Examples | User.Read.All, Group.ReadWrite.All, Mail.Send, Sites.Read.All | User Administrator, Groups Administrator, Exchange Administrator, Global Reader |
| Granted by | Consent: user or admin for delegated, admin only for application permissions | Role assignment by a Privileged Role Administrator or Global Administrator |
| Recorded as | oAuth2PermissionGrant (delegated) or appRoleAssignment (application) | Role assignment (unifiedRoleAssignment) |
| In a token | scp claim (delegated) or roles claim (application) | wids claim for the user, when roles are included |
Delegated access: both are needed
Microsoft's permissions overview: the privileges an app has on behalf of a user are determined by the permissions the app was granted and the user's own permissions. Examples with Microsoft Graph PowerShell:
| Scope granted | User role | Result of Update-MgUser on another user |
|---|---|---|
| User.ReadWrite.All | none | Insufficient privileges: the user cannot edit other users |
| User.Read.All | User Administrator | Insufficient privileges: the token does not allow writes |
| User.ReadWrite.All | User Administrator | Works for normal users |
App-only access: the permission is the right
With app-only sign-in (certificate, secret or managed identity), there is no user. An application permission such as User.ReadWrite.All lets the app act on every object the permission covers, which is why only a Privileged Role Administrator or Global Administrator can consent to application permissions. Some services and operations check Entra roles instead of, or in addition to, Graph permissions:
- Exchange Online and Security & Compliance PowerShell app-only access needs the
Exchange.ManageAsApppermission plus an Entra role (such as Exchange Administrator) assigned to the app's service principal. - Teams policy cmdlets (
Grant-Cs*,Set-Cs*) with app-only sign-in rely on an Entra role assigned to the service principal.
Choosing the least privilege
- Prefer delegated access with the narrowest scope that works; use app-only only for unattended jobs.
- Look up the permissions of a Graph PowerShell cmdlet with
Find-MgGraphCommand -Command NAME, and pick the least privileged one listed. - Give admins task-specific roles (User Administrator, Groups Administrator, License Administrator) instead of Global Administrator.