1 00:00:00,040 --> 00:00:03,279 Welcome to the M365 FM podcast, where we explore the people, 2 00:00:03,279 --> 00:00:06,200 ideas and technologies shaping the future of work. 3 00:00:06,200 --> 00:00:09,720 The checkpoint every app has to pass one graph. 4 00:00:09,720 --> 00:00:12,199 Permission can hand an app every mailbox in your company. 5 00:00:12,199 --> 00:00:13,519 Most people never notice that 6 00:00:13,519 --> 00:00:14,919 line until a security review 7 00:00:14,919 --> 00:00:16,280 points at it because the 8 00:00:16,280 --> 00:00:17,679 permission sits quietly inside 9 00:00:17,679 --> 00:00:19,239 an app somebody set up months 10 00:00:19,239 --> 00:00:19,879 ago. 11 00:00:19,879 --> 00:00:21,120 Microsoft Graph is the single 12 00:00:21,120 --> 00:00:22,379 doorway apps used to reach your 13 00:00:22,379 --> 00:00:23,920 mail, your files, your teams 14 00:00:23,920 --> 00:00:25,440 messages, and the people in your 15 00:00:25,440 --> 00:00:26,039 directory. 16 00:00:26,039 --> 00:00:28,559 And it won't open for anything that wasn't granted permission. 17 00:00:28,559 --> 00:00:32,219 First, an app can ask in two ways acting as a signed in 18 00:00:32,219 --> 00:00:35,280 person or acting as itself with nobody in the room. 19 00:00:35,280 --> 00:00:38,640 And that choice decides whether it touches one person's data or 20 00:00:38,640 --> 00:00:40,280 the whole organization. 21 00:00:40,280 --> 00:00:43,000 Most graph projects don't fall apart because of code, and when 22 00:00:43,000 --> 00:00:45,679 they do fall apart, it's usually at consent because somebody 23 00:00:45,679 --> 00:00:47,759 asked for far more access than the job needed. 24 00:00:47,759 --> 00:00:48,880 By the end of this, you'll be 25 00:00:48,880 --> 00:00:50,399 able to read any permission name 26 00:00:50,399 --> 00:00:51,840 and know exactly what it lets an 27 00:00:51,840 --> 00:00:52,600 app do. 28 00:00:52,600 --> 00:00:54,320 What a graph permission actually is. 29 00:00:54,320 --> 00:00:56,880 Microsoft Graph is one doorway into almost everything your 30 00:00:56,880 --> 00:00:58,479 organization keeps in the cloud. 31 00:00:58,479 --> 00:00:59,640 Mail sits behind it. 32 00:00:59,640 --> 00:01:01,090 So do files and folders. 33 00:01:01,090 --> 00:01:02,570 So do teams conversations. 34 00:01:02,570 --> 00:01:03,810 And so does the directory that 35 00:01:03,810 --> 00:01:05,170 lists every account your company 36 00:01:05,170 --> 00:01:05,890 manages. 37 00:01:05,890 --> 00:01:08,769 Rather than learning a separate door for each service, an app 38 00:01:08,769 --> 00:01:11,890 learns this one and asks for the specific things it needs. 39 00:01:11,890 --> 00:01:13,129 A permission is the privilege an 40 00:01:13,129 --> 00:01:14,250 app has been granted before 41 00:01:14,250 --> 00:01:15,769 graph hands over anything at 42 00:01:15,769 --> 00:01:16,370 all. 43 00:01:16,370 --> 00:01:18,450 When an app asks for data, it wasn't granted. 44 00:01:18,450 --> 00:01:19,810 Graph refuses the request and 45 00:01:19,810 --> 00:01:21,049 returns an error instead of the 46 00:01:21,049 --> 00:01:21,530 answer. 47 00:01:21,530 --> 00:01:23,769 The permission name is what's printed on the key card, and 48 00:01:23,769 --> 00:01:26,010 that card decides which doors open for that app. 49 00:01:26,010 --> 00:01:28,370 Being signed in and being permitted are two separate 50 00:01:28,370 --> 00:01:31,049 gates, and beginners blur them together all the time. 51 00:01:31,049 --> 00:01:33,489 A person can be signed in and still see nothing, because the 52 00:01:33,489 --> 00:01:35,409 app was never granted the permission that matches the 53 00:01:35,409 --> 00:01:38,329 request, and no amount of logging in again will fix it. 54 00:01:38,329 --> 00:01:41,370 What makes this one model worth learning is how far it reaches. 55 00:01:41,370 --> 00:01:43,609 The same permission system covers exchange, mail, 56 00:01:43,609 --> 00:01:47,010 SharePoint, and OneDrive files, teams, and the users and groups. 57 00:01:47,010 --> 00:01:49,609 In Microsoft Entra ID, that means a single permission name 58 00:01:49,609 --> 00:01:52,129 can decide how far an app travels across all of it. 59 00:01:52,129 --> 00:01:54,129 It's also why the name deserves a second look. 60 00:01:54,129 --> 00:01:55,209 Say you build a small app that 61 00:01:55,209 --> 00:01:56,510 greets people by name when they 62 00:01:56,510 --> 00:01:57,170 sign in. 63 00:01:57,170 --> 00:01:58,290 It needs to read a bit of the 64 00:01:58,290 --> 00:01:59,980 signed in user's profile and 65 00:01:59,980 --> 00:02:00,790 nothing more. 66 00:02:00,790 --> 00:02:02,150 So it asks for one narrow 67 00:02:02,150 --> 00:02:03,709 permission that covers exactly 68 00:02:03,709 --> 00:02:03,950 that. 69 00:02:03,950 --> 00:02:06,310 If it instead asks for permission to change every 70 00:02:06,310 --> 00:02:09,030 profile in the company, the request would still work. 71 00:02:09,030 --> 00:02:11,770 And that gap between what the app needs and what it asked for 72 00:02:11,770 --> 00:02:13,310 is where trouble lives. 73 00:02:13,310 --> 00:02:15,789 Microsoft doesn't make you guess at any of this. 74 00:02:15,789 --> 00:02:18,430 Every permission in graph is documented, named in a 75 00:02:18,430 --> 00:02:21,150 consistent way and grouped by the resource it touches. 76 00:02:21,150 --> 00:02:22,389 So you can look one up and read 77 00:02:22,389 --> 00:02:23,789 what it allows before you ever 78 00:02:23,789 --> 00:02:24,669 approve it. 79 00:02:24,669 --> 00:02:26,750 The vocabulary is smaller than it looks, too. 80 00:02:26,750 --> 00:02:30,150 There are permissions for mail, calendars, files, groups, users, 81 00:02:30,150 --> 00:02:33,030 and the apps themselves, and they all follow the same shape. 82 00:02:33,030 --> 00:02:35,349 So learning one teaches you how to read the rest. 83 00:02:35,349 --> 00:02:38,069 The other thing worth knowing early is that a permission is 84 00:02:38,069 --> 00:02:41,349 attached to an app, rather than to a person or a device. 85 00:02:41,349 --> 00:02:44,110 Two people using the same app share the app's permissions, and 86 00:02:44,110 --> 00:02:46,229 when the app was granted something broad, both of them 87 00:02:46,229 --> 00:02:48,030 inherit that reach the moment they sign in. 88 00:02:48,030 --> 00:02:50,509 There's one small word inside these names that decides whether 89 00:02:50,509 --> 00:02:53,750 an app touches a single person's data or everyone's, and we'll 90 00:02:53,750 --> 00:02:55,629 come back to it in a moment. 91 00:02:55,629 --> 00:02:57,110 The two kinds of permission. 92 00:02:57,110 --> 00:02:59,270 Nobody separates at first graph 93 00:02:59,270 --> 00:03:00,599 gives an AB two completely 94 00:03:00,599 --> 00:03:01,840 different ways to ask, and 95 00:03:01,840 --> 00:03:03,120 almost everything else about 96 00:03:03,120 --> 00:03:04,759 permissions flows from that one 97 00:03:04,759 --> 00:03:05,599 split. 98 00:03:05,599 --> 00:03:07,840 The first way is called delegated access, and it means 99 00:03:07,840 --> 00:03:10,479 the app calls graph on behalf of a signed in user. 100 00:03:10,479 --> 00:03:13,000 The app borrows that person's identity for the moment of the 101 00:03:13,000 --> 00:03:16,159 request, and it can never reach past what that person can 102 00:03:16,159 --> 00:03:17,680 already reach on their own. 103 00:03:17,680 --> 00:03:19,120 If your account can't open a 104 00:03:19,120 --> 00:03:20,919 particular folder, an app acting 105 00:03:20,919 --> 00:03:22,400 as you can't open it either, no 106 00:03:22,400 --> 00:03:23,439 matter which permissions it 107 00:03:23,439 --> 00:03:24,000 holds. 108 00:03:24,000 --> 00:03:25,719 The second way is called Application Access. 109 00:03:25,719 --> 00:03:27,879 And here the app calls graph as itself. 110 00:03:27,879 --> 00:03:29,240 With nobody signed in at all. 111 00:03:29,240 --> 00:03:31,639 There's no person to borrow an identity from, so the app's own 112 00:03:31,639 --> 00:03:34,060 permissions are the only limit, and that limit can stretch 113 00:03:34,060 --> 00:03:35,520 across the whole organization. 114 00:03:35,520 --> 00:03:36,759 Microsoft's own documentation 115 00:03:36,759 --> 00:03:38,000 gives a blunt example, because 116 00:03:38,000 --> 00:03:40,520 an app holding the files read 117 00:03:40,520 --> 00:03:42,080 all application permission can 118 00:03:42,080 --> 00:03:42,960 read any file in the 119 00:03:42,960 --> 00:03:44,680 organization, not one person's 120 00:03:44,680 --> 00:03:45,080 files. 121 00:03:45,080 --> 00:03:45,800 All of them. 122 00:03:45,800 --> 00:03:47,080 What surprises people here is 123 00:03:47,080 --> 00:03:48,520 the overlap in the delegated 124 00:03:48,520 --> 00:03:49,000 model. 125 00:03:49,000 --> 00:03:50,360 The app's real access is the 126 00:03:50,360 --> 00:03:51,639 intersection of two things the 127 00:03:51,639 --> 00:03:53,240 permissions it was granted, and 128 00:03:53,240 --> 00:03:54,479 whatever the signed in user 129 00:03:54,479 --> 00:03:55,639 already had. 130 00:03:55,639 --> 00:03:58,240 Both limits apply at the same time, so a generous permission 131 00:03:58,240 --> 00:04:00,699 handed to an app doesn't widen what the person can see. 132 00:04:00,699 --> 00:04:03,340 That overlap is the reason delegated access is treated as 133 00:04:03,340 --> 00:04:06,340 the safer default, and Microsoft says so, directly calling it the 134 00:04:06,340 --> 00:04:08,740 recommended approach whenever it meets the app's needs. 135 00:04:08,740 --> 00:04:10,979 The instinct that flips here is worth naming. 136 00:04:10,979 --> 00:04:12,199 You might think asking for more 137 00:04:12,199 --> 00:04:13,699 is the safe move, but the app 138 00:04:13,699 --> 00:04:14,979 only model is actually the one 139 00:04:14,979 --> 00:04:15,979 that reaches your entire 140 00:04:15,979 --> 00:04:17,459 company, and it's the one that 141 00:04:17,459 --> 00:04:18,819 triggers the loudest consent 142 00:04:18,819 --> 00:04:19,899 prompt. 143 00:04:19,899 --> 00:04:22,980 Asking for everything points straight at the riskiest option. 144 00:04:22,980 --> 00:04:25,540 The better question is never how much access makes this easy. 145 00:04:25,540 --> 00:04:27,300 It's how little access makes this work. 146 00:04:27,300 --> 00:04:28,220 This split also answers 147 00:04:28,220 --> 00:04:29,180 something you may have wondered 148 00:04:29,180 --> 00:04:30,420 about, which is why the same app 149 00:04:30,420 --> 00:04:31,579 sometimes asks you to sign in 150 00:04:31,579 --> 00:04:32,540 and sometimes asks an 151 00:04:32,540 --> 00:04:33,740 administrator instead. 152 00:04:33,740 --> 00:04:36,019 The model it chose decides who gets asked. 153 00:04:36,019 --> 00:04:37,100 The practical version of the 154 00:04:37,100 --> 00:04:38,139 split comes down to one 155 00:04:38,139 --> 00:04:38,579 question. 156 00:04:38,579 --> 00:04:40,579 If a person has to be present for the work to happen, 157 00:04:40,579 --> 00:04:43,500 delegated access usually fits if the work has to happen while 158 00:04:43,500 --> 00:04:46,459 everyone is asleep, application access is the only option, and 159 00:04:46,459 --> 00:04:49,019 that's the moment to slow down and ask what the smallest 160 00:04:49,019 --> 00:04:50,579 version of it looks like. 161 00:04:50,579 --> 00:04:52,740 How to read a permission name like a sentence. 162 00:04:52,740 --> 00:04:55,319 Every graph permission name follows the same three part 163 00:04:55,319 --> 00:04:57,379 shape, and once you see it, you can't unsee it. 164 00:04:57,379 --> 00:04:58,584 The first part names the 165 00:04:58,584 --> 00:04:59,810 resource, the thing being 166 00:04:59,810 --> 00:05:00,430 touched. 167 00:05:00,430 --> 00:05:01,430 The second part names the 168 00:05:01,430 --> 00:05:02,949 operation usually read or read 169 00:05:02,949 --> 00:05:03,629 and write. 170 00:05:03,629 --> 00:05:06,350 The third part is the constraint and it's optional, which is the 171 00:05:06,350 --> 00:05:07,709 detail that matters most. 172 00:05:07,709 --> 00:05:09,990 Read a few out loud and the patent shows up fast. 173 00:05:09,990 --> 00:05:11,509 User dot read lets an app read 174 00:05:11,509 --> 00:05:12,589 the signed in user's own 175 00:05:12,589 --> 00:05:13,470 profile. 176 00:05:13,470 --> 00:05:14,870 Group A create is for making new 177 00:05:14,870 --> 00:05:16,029 groups, though not changing or 178 00:05:16,029 --> 00:05:16,949 deleting them. 179 00:05:16,949 --> 00:05:17,949 Application. 180 00:05:17,949 --> 00:05:18,310 Read. 181 00:05:18,310 --> 00:05:22,230 Write all reaches every app in the tenant while application 182 00:05:22,230 --> 00:05:26,509 read write owned by shrinks that to only the apps the app itself 183 00:05:26,509 --> 00:05:28,350 created or owns. 184 00:05:28,350 --> 00:05:30,910 The constraint is where the reach lives, and it comes in a 185 00:05:30,910 --> 00:05:31,949 small set of words. 186 00:05:31,949 --> 00:05:34,709 All means the whole organization owned by narrows things to what 187 00:05:34,709 --> 00:05:35,990 the app owns. 188 00:05:35,990 --> 00:05:39,730 Selected, shared, hidden and app folder each tighten the scope in 189 00:05:39,730 --> 00:05:40,670 their own way. 190 00:05:40,670 --> 00:05:43,149 The payoff of that flagged word arrives right here. 191 00:05:43,149 --> 00:05:44,990 When a permission carries no constraint at all. 192 00:05:44,990 --> 00:05:47,110 The default is that one person's own data. 193 00:05:47,110 --> 00:05:48,670 That's why user read reads u 194 00:05:48,670 --> 00:05:50,629 while user read all reads 195 00:05:50,629 --> 00:05:51,069 everyone. 196 00:05:51,069 --> 00:05:53,790 And the missing word is doing an enormous amount of work on a 197 00:05:53,790 --> 00:05:55,149 screen that's easy to skim. 198 00:05:55,149 --> 00:05:56,790 One honest limit belongs here 199 00:05:56,790 --> 00:05:58,339 because names describe intent, 200 00:05:58,339 --> 00:05:59,569 and intent isn't always the 201 00:05:59,569 --> 00:06:00,449 whole story. 202 00:06:00,449 --> 00:06:03,810 Microsoft's own materials note that names like mail, read, 203 00:06:03,810 --> 00:06:08,170 write, and sites dot full control all imply broad reach, 204 00:06:08,170 --> 00:06:11,209 and the practical advice is to test in a safe tenant rather 205 00:06:11,209 --> 00:06:12,889 than trusting the label alone. 206 00:06:12,889 --> 00:06:16,089 This is the skill that changes how you read a consent screen. 207 00:06:16,089 --> 00:06:17,370 Instead of seeing a wall of 208 00:06:17,370 --> 00:06:18,850 unfamiliar names, you start 209 00:06:18,850 --> 00:06:20,250 seeing sentences and the 210 00:06:20,250 --> 00:06:21,329 sentence tells you who is 211 00:06:21,329 --> 00:06:22,730 affected and how far the app can 212 00:06:22,730 --> 00:06:23,209 go. 213 00:06:23,209 --> 00:06:24,529 The name stay consistent across 214 00:06:24,529 --> 00:06:25,889 the whole service, so the effort 215 00:06:25,889 --> 00:06:27,129 you spend learning this shape 216 00:06:27,129 --> 00:06:28,449 pays off everywhere, and none of 217 00:06:28,449 --> 00:06:29,610 it asks you to memorize a 218 00:06:29,610 --> 00:06:30,769 separate dictionary. 219 00:06:30,769 --> 00:06:33,290 You'll also notice the names are specific enough to argue with 220 00:06:33,290 --> 00:06:34,329 which is the point. 221 00:06:34,329 --> 00:06:35,769 A permission that says all is 222 00:06:35,769 --> 00:06:36,930 telling you in plain language 223 00:06:36,930 --> 00:06:38,170 that it crosses every part of 224 00:06:38,170 --> 00:06:39,449 the organization, so nobody can 225 00:06:39,449 --> 00:06:40,490 claim the reach came as a 226 00:06:40,490 --> 00:06:41,250 surprise. 227 00:06:41,250 --> 00:06:43,889 If a name feels too broad for the job, it usually is, and 228 00:06:43,889 --> 00:06:48,329 there's almost always a smaller one nearby who gets to say yes. 229 00:06:48,329 --> 00:06:50,730 Reading the name tells you what an app wants. 230 00:06:50,730 --> 00:06:52,850 It doesn't tell you who's allowed to hand it over. 231 00:06:52,850 --> 00:06:54,610 And that second question has its 232 00:06:54,610 --> 00:06:56,129 own set of rules for delegated 233 00:06:56,129 --> 00:06:56,649 permissions. 234 00:06:56,649 --> 00:06:58,459 The answer is fairly forgiving. 235 00:06:58,459 --> 00:06:59,660 A person can consent for their 236 00:06:59,660 --> 00:07:01,259 own data, which is why a small 237 00:07:01,259 --> 00:07:02,459 app can ask you to approve a 238 00:07:02,459 --> 00:07:03,639 narrow permission the moment you 239 00:07:03,639 --> 00:07:04,339 sign in. 240 00:07:04,339 --> 00:07:06,899 An administrator can also consent on behalf of everyone at 241 00:07:06,899 --> 00:07:09,540 once, which helps when you'd rather not make every colleague 242 00:07:09,540 --> 00:07:12,259 click through the same prompt for application permissions, the 243 00:07:12,259 --> 00:07:13,740 door narrows sharply. 244 00:07:13,740 --> 00:07:16,220 Only an administrator can consent, and Microsoft is 245 00:07:16,220 --> 00:07:18,939 specific about which ones privileged role administrator 246 00:07:18,939 --> 00:07:22,259 and global administrator are the two roles that can grant an app. 247 00:07:22,259 --> 00:07:23,980 The app only permissions it's asking for. 248 00:07:23,980 --> 00:07:25,060 If you've ever watched a rollout 249 00:07:25,060 --> 00:07:26,339 stall while everyone waited on 250 00:07:26,339 --> 00:07:27,920 one person, this is usually why 251 00:07:27,920 --> 00:07:29,100 there's also a convenience 252 00:07:29,100 --> 00:07:30,560 feature that's easy to overlook, 253 00:07:30,560 --> 00:07:32,060 called tenant wide admin 254 00:07:32,060 --> 00:07:32,939 consent. 255 00:07:32,939 --> 00:07:35,540 An administrator approves an app once for everyone, and after 256 00:07:35,540 --> 00:07:37,860 that, people aren't nagged with prompts when they sign in, it 257 00:07:37,860 --> 00:07:40,939 removes friction, and it also means the approval decision gets 258 00:07:40,939 --> 00:07:43,779 made far away from the people who'll actually use the thing. 259 00:07:43,779 --> 00:07:45,160 One more gate sits on top of all 260 00:07:45,160 --> 00:07:46,259 of this, and it belongs to your 261 00:07:46,259 --> 00:07:47,540 own organization. 262 00:07:47,540 --> 00:07:49,839 Even when a permission technically allows a user to 263 00:07:49,839 --> 00:07:53,220 consent, your tenant's app, consent policies can restrict or 264 00:07:53,220 --> 00:07:56,139 block that, and plenty of organizations do exactly that. 265 00:07:56,139 --> 00:07:57,300 A permission can be perfectly 266 00:07:57,300 --> 00:07:59,120 valid on paper and still stop at 267 00:07:59,120 --> 00:08:00,120 a policy someone set 268 00:08:00,120 --> 00:08:00,959 deliberately. 269 00:08:00,959 --> 00:08:03,639 The moment of consent is worth watching closely, because it's 270 00:08:03,639 --> 00:08:06,240 the clearest view you'll ever get of what an app can do. 271 00:08:06,240 --> 00:08:08,879 The prompt lists the permissions in plain language, and a 272 00:08:08,879 --> 00:08:11,639 delegated request reads like a request to act as you. 273 00:08:11,639 --> 00:08:13,839 While an application request reads like a request to act 274 00:08:13,839 --> 00:08:16,600 across everyone reading that screen instead of clicking past. 275 00:08:16,600 --> 00:08:18,720 It is the cheapest security habit there is. 276 00:08:18,720 --> 00:08:20,079 This is why the same app can 277 00:08:20,079 --> 00:08:21,439 install smoothly in a test 278 00:08:21,439 --> 00:08:23,079 tenant and grind to a halt in a 279 00:08:23,079 --> 00:08:23,519 real one. 280 00:08:23,519 --> 00:08:24,600 Test tenants tend to leave 281 00:08:24,600 --> 00:08:25,879 consent open, and production 282 00:08:25,879 --> 00:08:27,439 tenants tend to close it, so the 283 00:08:27,439 --> 00:08:29,000 app's success has less to do 284 00:08:29,000 --> 00:08:30,439 with the app than with the rules 285 00:08:30,439 --> 00:08:31,079 around it. 286 00:08:31,079 --> 00:08:33,480 Once the approval is in hand, the next question is how big 287 00:08:33,480 --> 00:08:34,360 that approval should be. 288 00:08:34,360 --> 00:08:37,840 And that's where most projects get themselves into trouble. 289 00:08:37,840 --> 00:08:39,679 The trap of asking for too much. 290 00:08:39,679 --> 00:08:41,600 Everything so far leads to one 291 00:08:41,600 --> 00:08:43,279 habit that separates a smooth 292 00:08:43,279 --> 00:08:44,960 rollout from a painful one, and 293 00:08:44,960 --> 00:08:46,740 Microsoft states it plainly 294 00:08:46,740 --> 00:08:48,039 grant the app the minimum 295 00:08:48,039 --> 00:08:49,200 permission it needs for the 296 00:08:49,200 --> 00:08:50,840 operation, and nothing beyond 297 00:08:50,840 --> 00:08:51,360 that. 298 00:08:51,360 --> 00:08:53,639 Microsoft's own examples make the Gap concrete. 299 00:08:53,639 --> 00:08:57,044 An app that reads the signed in user's profile, needs only user 300 00:08:57,044 --> 00:08:58,090 read and handing it. 301 00:08:58,090 --> 00:09:00,769 User read write makes it overprivileged because the app 302 00:09:00,769 --> 00:09:02,330 never needs to change anything. 303 00:09:02,330 --> 00:09:03,529 Reading groups without a signed 304 00:09:03,529 --> 00:09:05,389 in user needs only group member 305 00:09:05,389 --> 00:09:06,370 read all. 306 00:09:06,370 --> 00:09:07,750 A calendar that's only ever read 307 00:09:07,750 --> 00:09:09,490 needs calendars read while 308 00:09:09,490 --> 00:09:09,929 calendars. 309 00:09:09,929 --> 00:09:12,570 Read write belongs to apps that actually schedule something. 310 00:09:12,570 --> 00:09:14,929 The real tension here is what happens when you ignore it 311 00:09:14,929 --> 00:09:17,970 because the cost is documented rather than theoretical. 312 00:09:17,970 --> 00:09:19,529 Granting an app more privileges 313 00:09:19,529 --> 00:09:21,370 than it needs is a poor security 314 00:09:21,370 --> 00:09:22,970 practice, in Microsoft's words, 315 00:09:22,970 --> 00:09:24,169 because it raises the app's 316 00:09:24,169 --> 00:09:25,690 exposure to unauthorized and 317 00:09:25,690 --> 00:09:26,970 unintended access. 318 00:09:26,970 --> 00:09:29,929 The same overreach carries a second cost that hits adoption. 319 00:09:29,929 --> 00:09:31,049 Since asking for more than 320 00:09:31,049 --> 00:09:32,470 necessary makes people refuse to 321 00:09:32,470 --> 00:09:34,669 consent, and a refused consent 322 00:09:34,669 --> 00:09:36,289 screen ends the rollout right 323 00:09:36,289 --> 00:09:36,690 there. 324 00:09:36,690 --> 00:09:39,289 There's a hard ceiling to which surprises people who assume 325 00:09:39,289 --> 00:09:40,730 permissions are unlimited. 326 00:09:40,730 --> 00:09:44,009 Microsoft Entry ID caps an app at four hundred permissions, and 327 00:09:44,009 --> 00:09:46,250 no more than four hundred of those can be graph permissions 328 00:09:46,250 --> 00:09:47,529 for work and school apps. 329 00:09:47,529 --> 00:09:49,850 Personal Microsoft Account apps are capped at thirty. 330 00:09:49,850 --> 00:09:52,649 If you are picturing an endless menu, it isn't one picture how 331 00:09:52,649 --> 00:09:53,889 this plays out in practice. 332 00:09:53,889 --> 00:09:55,289 A team wants SharePoint data for 333 00:09:55,289 --> 00:09:56,779 a quarterly report and asks for 334 00:09:56,779 --> 00:09:58,389 access to every site and the 335 00:09:58,389 --> 00:09:59,830 request lands in security review 336 00:09:59,830 --> 00:10:00,389 and stops. 337 00:10:00,389 --> 00:10:02,870 They trim the list down to the sites they actually read. 338 00:10:02,870 --> 00:10:04,110 Attach a short note explaining 339 00:10:04,110 --> 00:10:05,429 why each one is needed, and the 340 00:10:05,429 --> 00:10:06,789 approval moves in a fraction of 341 00:10:06,789 --> 00:10:07,429 the time. 342 00:10:07,429 --> 00:10:09,870 The permission list was the whole problem, and it was the 343 00:10:09,870 --> 00:10:11,549 one part they controlled. 344 00:10:11,549 --> 00:10:13,669 The lesson is unglamorous and it works. 345 00:10:13,669 --> 00:10:15,029 Ask for what the app does today 346 00:10:15,029 --> 00:10:16,269 rather than for what it might do 347 00:10:16,269 --> 00:10:16,909 someday. 348 00:10:16,909 --> 00:10:18,110 Because every extra permission 349 00:10:18,110 --> 00:10:19,250 is a question somebody has to 350 00:10:19,250 --> 00:10:20,409 answer before you're allowed to 351 00:10:20,409 --> 00:10:21,029 ship. 352 00:10:21,029 --> 00:10:23,509 There's a simple test you can run on any permissionless before 353 00:10:23,509 --> 00:10:24,830 you send it for approval. 354 00:10:24,830 --> 00:10:26,149 For each permission, name the 355 00:10:26,149 --> 00:10:27,429 exact feature that breaks 356 00:10:27,429 --> 00:10:28,269 without it. 357 00:10:28,269 --> 00:10:31,149 If you can't name one, that permission is a wish rather than 358 00:10:31,149 --> 00:10:33,710 a requirement, and it's the first thing a reviewer will ask 359 00:10:33,710 --> 00:10:35,269 you to justify. 360 00:10:35,269 --> 00:10:36,590 Where this breaks down. 361 00:10:36,590 --> 00:10:39,029 Careful permission choices get you most of the way, and they 362 00:10:39,029 --> 00:10:40,509 don't remove every wall. 363 00:10:40,509 --> 00:10:41,950 Some limits belong to the system 364 00:10:41,950 --> 00:10:43,549 itself, and knowing them early 365 00:10:43,549 --> 00:10:44,750 saves a confusing afternoon 366 00:10:44,750 --> 00:10:45,309 later. 367 00:10:45,309 --> 00:10:47,950 The first of them is easy to misread, and it wastes the most 368 00:10:47,950 --> 00:10:50,909 time when an app asks for the members of a group graph, can 369 00:10:50,909 --> 00:10:53,870 answer with a success code and still hand back almost nothing. 370 00:10:53,870 --> 00:10:56,274 Members whose type the app isn't permitted to read come back with 371 00:10:56,274 --> 00:10:59,080 little more than an identifier and their real properties arrive 372 00:10:59,080 --> 00:11:00,080 as empty values. 373 00:11:00,080 --> 00:11:01,559 The request succeeded, and the 374 00:11:01,559 --> 00:11:02,960 data simply isn't there, which 375 00:11:02,960 --> 00:11:04,340 is why the failure is so easy to 376 00:11:04,340 --> 00:11:04,960 miss. 377 00:11:04,960 --> 00:11:07,320 Then there are the permissions that carry the most weight 378 00:11:07,320 --> 00:11:10,320 directory access as user, all is the highest privilege. 379 00:11:10,320 --> 00:11:11,679 Delegated permission in graph, 380 00:11:11,679 --> 00:11:12,720 and it reaches nearly every 381 00:11:12,720 --> 00:11:14,159 operation across Microsoft entra 382 00:11:14,159 --> 00:11:15,200 ID directory. 383 00:11:15,200 --> 00:11:16,799 Read write all ranked second and 384 00:11:16,799 --> 00:11:18,360 directory read all is the 385 00:11:18,360 --> 00:11:18,759 strongest. 386 00:11:18,759 --> 00:11:20,879 Read only permission in that same space. 387 00:11:20,879 --> 00:11:23,559 Microsoft's guidance on all three is to use them only when 388 00:11:23,559 --> 00:11:24,919 nothing smaller will do. 389 00:11:24,919 --> 00:11:26,039 A narrower option exists for 390 00:11:26,039 --> 00:11:27,279 some situations, and it deserves 391 00:11:27,279 --> 00:11:28,240 a name. 392 00:11:28,240 --> 00:11:31,120 Resource specific consent grants an app access to one instance of 393 00:11:31,120 --> 00:11:33,840 a resource, like a single team or a single chat, instead of 394 00:11:33,840 --> 00:11:35,120 every instance in the tenant. 395 00:11:35,120 --> 00:11:36,519 It's supported for a subset of 396 00:11:36,519 --> 00:11:38,059 features such as teams, chats, 397 00:11:38,059 --> 00:11:39,360 and messages, and it's the 398 00:11:39,360 --> 00:11:40,720 closest thing to a scalpel in a 399 00:11:40,720 --> 00:11:41,960 model that often feels like a 400 00:11:41,960 --> 00:11:42,480 hammer. 401 00:11:42,480 --> 00:11:44,639 Scale brings its own pushback because graph slows you down 402 00:11:44,639 --> 00:11:45,759 when you ask to fast. 403 00:11:45,759 --> 00:11:48,519 When an app exceeds the limits, graph returns a throttling error 404 00:11:48,519 --> 00:11:51,179 instead of the data, and the global ceiling is one hundred 405 00:11:51,179 --> 00:11:54,480 and thirty thousand requests per 10s per app across all tenants 406 00:11:54,480 --> 00:11:57,460 with tighter limits underneath for individual services. 407 00:11:57,460 --> 00:11:58,720 The fix is to read the retry 408 00:11:58,720 --> 00:12:00,100 after header, wait the amount of 409 00:12:00,100 --> 00:12:01,779 time it names and slow down 410 00:12:01,779 --> 00:12:02,740 rather than hammering the 411 00:12:02,740 --> 00:12:03,460 endpoint. 412 00:12:03,460 --> 00:12:04,580 The newest wrinkle points in a 413 00:12:04,580 --> 00:12:05,779 promising direction for 414 00:12:05,779 --> 00:12:07,580 Microsoft Entra Agent ID some 415 00:12:07,580 --> 00:12:09,019 high risk graph permissions are 416 00:12:09,019 --> 00:12:10,580 blocked outright and can't be 417 00:12:10,580 --> 00:12:12,019 granted to agent identities at 418 00:12:12,019 --> 00:12:13,139 all, which tells you the 419 00:12:13,139 --> 00:12:14,320 platform is moving toward 420 00:12:14,320 --> 00:12:15,620 tighter defaults rather than 421 00:12:15,620 --> 00:12:16,940 looser ones. 422 00:12:16,940 --> 00:12:18,340 None of these limits are reasons 423 00:12:18,340 --> 00:12:19,740 to avoid graph, and they're the 424 00:12:19,740 --> 00:12:20,899 reasons so much of this gets 425 00:12:20,899 --> 00:12:21,919 documented rather than 426 00:12:21,919 --> 00:12:23,299 discovered the hard way the 427 00:12:23,299 --> 00:12:24,340 system tells you when it 428 00:12:24,340 --> 00:12:25,700 throttles, it documents its 429 00:12:25,700 --> 00:12:27,220 privilege rankings, and it flags 430 00:12:27,220 --> 00:12:28,379 the permissions it considers 431 00:12:28,379 --> 00:12:28,899 risky. 432 00:12:28,899 --> 00:12:30,779 So most of the surprises are avoidable. 433 00:12:30,779 --> 00:12:33,179 If you read first how this fits 434 00:12:33,179 --> 00:12:34,379 into your Microsoft three 435 00:12:34,379 --> 00:12:35,700 hundred sixty five and Azure 436 00:12:35,700 --> 00:12:36,379 World. 437 00:12:36,379 --> 00:12:39,740 All of this lives in a place you may already recognize. 438 00:12:39,740 --> 00:12:42,820 The app itself is registered in Microsoft Entra ID, and the 439 00:12:42,820 --> 00:12:45,100 consent it received is recorded there as a grant. 440 00:12:45,100 --> 00:12:46,820 While the mail files and team's 441 00:12:46,820 --> 00:12:48,659 data sit behind the door in the 442 00:12:48,659 --> 00:12:49,820 Microsoft three hundred sixty 443 00:12:49,820 --> 00:12:51,460 five and Azure services you use 444 00:12:51,460 --> 00:12:52,419 every day. 445 00:12:52,419 --> 00:12:53,740 When someone asks who approved 446 00:12:53,740 --> 00:12:55,164 an app, entra ID holds the 447 00:12:55,164 --> 00:12:56,590 answer with that picture in 448 00:12:56,590 --> 00:12:57,149 place. 449 00:12:57,149 --> 00:12:59,990 A few habits turn the theory into something workable. 450 00:12:59,990 --> 00:13:01,190 Keep user facing data on 451 00:13:01,190 --> 00:13:02,350 delegated permissions wherever 452 00:13:02,350 --> 00:13:03,149 you can. 453 00:13:03,149 --> 00:13:05,950 Reserve the app only model for the jobs that genuinely run 454 00:13:05,950 --> 00:13:08,950 unattended, like a nightly sync with nobody at the keyboard. 455 00:13:08,950 --> 00:13:11,429 Map out the permissions your project needs before you build, 456 00:13:11,429 --> 00:13:14,029 because discovering them during a security review is the slowest 457 00:13:14,029 --> 00:13:15,470 possible time to learn them. 458 00:13:15,470 --> 00:13:17,230 Staging helps to pilot with a 459 00:13:17,230 --> 00:13:18,629 small group of people first, 460 00:13:18,629 --> 00:13:19,909 show them what each permission 461 00:13:19,909 --> 00:13:21,169 does and what the app can never 462 00:13:21,169 --> 00:13:21,509 see. 463 00:13:21,509 --> 00:13:24,509 Then widen the audience once the first group is comfortable. 464 00:13:24,509 --> 00:13:27,230 That approach builds advocates instead of objections, and it 465 00:13:27,230 --> 00:13:29,629 gives you a chance to catch an overbroad request while it's 466 00:13:29,629 --> 00:13:30,830 still cheap to change. 467 00:13:30,830 --> 00:13:32,070 Write down why each permission 468 00:13:32,070 --> 00:13:33,710 is required in one plain 469 00:13:33,710 --> 00:13:34,230 sentence. 470 00:13:34,230 --> 00:13:35,389 That short justification is 471 00:13:35,389 --> 00:13:36,669 often the difference between an 472 00:13:36,669 --> 00:13:38,110 approval that moves and one that 473 00:13:38,110 --> 00:13:38,750 sits. 474 00:13:38,750 --> 00:13:41,110 And it's also the thing you'll want when the app gets reviewed 475 00:13:41,110 --> 00:13:42,190 six months later. 476 00:13:42,190 --> 00:13:44,470 The plumbing underneath is more familiar than it sounds. 477 00:13:44,470 --> 00:13:47,070 The same permission model sits under the Power Automate flows. 478 00:13:47,070 --> 00:13:49,509 You build the power apps connectors you add, and the 479 00:13:49,509 --> 00:13:51,870 copilot agents you're starting to spin up. 480 00:13:51,870 --> 00:13:53,029 So the habit travels with you 481 00:13:53,029 --> 00:13:54,309 across every tool in the 482 00:13:54,309 --> 00:13:55,370 platform. 483 00:13:55,370 --> 00:13:58,330 The order you do this in matters more than the individual steps. 484 00:13:58,330 --> 00:14:01,210 Decide what the app needs, write it down, get the approval 485 00:14:01,210 --> 00:14:04,169 conversation started, and only then build the part that depends 486 00:14:04,169 --> 00:14:05,210 on the access. 487 00:14:05,210 --> 00:14:08,129 Teams that build first and ask later spend their best weeks 488 00:14:08,129 --> 00:14:10,610 waiting on a consent screen instead of shipping. 489 00:14:10,610 --> 00:14:11,730 Governance is what keeps the 490 00:14:11,730 --> 00:14:12,809 habit alive through a busy 491 00:14:12,809 --> 00:14:13,370 quarter. 492 00:14:13,370 --> 00:14:14,570 Pre-Approval workflows. 493 00:14:14,570 --> 00:14:15,809 Clear tags on each app. 494 00:14:15,809 --> 00:14:16,929 Audit logs that record who 495 00:14:16,929 --> 00:14:18,330 consented to what, and a 496 00:14:18,330 --> 00:14:19,570 periodic review of permissions 497 00:14:19,570 --> 00:14:20,929 that are no longer needed or 498 00:14:20,929 --> 00:14:21,850 keep an environment from 499 00:14:21,850 --> 00:14:23,230 drifting slowly into over 500 00:14:23,230 --> 00:14:24,289 permission. 501 00:14:24,289 --> 00:14:25,649 What to take away. 502 00:14:25,649 --> 00:14:26,570 That's the whole picture. 503 00:14:26,570 --> 00:14:28,450 In plain terms, a permission is 504 00:14:28,450 --> 00:14:29,970 the privilege Microsoft Graph 505 00:14:29,970 --> 00:14:31,409 demands before an app can touch 506 00:14:31,409 --> 00:14:32,370 your data. 507 00:14:32,370 --> 00:14:35,309 Delegated access acts as a person, and application access 508 00:14:35,309 --> 00:14:36,929 acts as the app itself. 509 00:14:36,929 --> 00:14:39,289 The name on the permission tells you exactly how far it can 510 00:14:39,289 --> 00:14:42,009 reach, and an administrator holds the final yes. 511 00:14:42,009 --> 00:14:44,169 One question is worth sitting with for a moment. 512 00:14:44,169 --> 00:14:45,409 If you opened your own tenant 513 00:14:45,409 --> 00:14:46,730 today, which apps permissions 514 00:14:46,730 --> 00:14:47,970 would you want to double check 515 00:14:47,970 --> 00:14:48,450 first? 516 00:14:48,450 --> 00:14:49,690 If this made the topic feel less 517 00:14:49,690 --> 00:14:51,929 intimidating, subscribe to M365 518 00:14:51,929 --> 00:14:53,690 FM to master the tools and the 519 00:14:53,690 --> 00:14:55,129 mindset shaping the future of 520 00:14:55,129 --> 00:14:55,730 work.