1
00:00:00,000 --> 00:00:01,800
What exactly is the Microsoft Graph API?

2
00:00:01,800 --> 00:00:04,640
Is it a database, a service, or just something for developers?

3
00:00:04,640 --> 00:00:05,960
I hear these questions all the time,

4
00:00:05,960 --> 00:00:07,960
and honestly, the confusion makes sense.

5
00:00:07,960 --> 00:00:09,960
Microsoft throws a lot of names at you.

6
00:00:09,960 --> 00:00:13,080
Graph, Graph API, Graph Explorer, Graph SDK,

7
00:00:13,080 --> 00:00:14,760
it's easy to get lost in all that.

8
00:00:14,760 --> 00:00:16,320
So here's what we're going to do today.

9
00:00:16,320 --> 00:00:17,840
I'm going to explain what Graph actually is

10
00:00:17,840 --> 00:00:19,480
in plain English using one simple analogy

11
00:00:19,480 --> 00:00:20,360
that will stick with you.

12
00:00:20,360 --> 00:00:21,760
By the end of this episode,

13
00:00:21,760 --> 00:00:25,000
you'll see how it connects everything in Microsoft 365.

14
00:00:25,000 --> 00:00:28,000
And why it matters, whether you're an admin, a developer,

15
00:00:28,000 --> 00:00:31,080
or someone who just wants to automate your work.

16
00:00:31,080 --> 00:00:33,600
The old way, before Microsoft Graph,

17
00:00:33,600 --> 00:00:36,600
imagine the Microsoft ecosystem about 10 years ago.

18
00:00:36,600 --> 00:00:38,520
Every single service spoke its own language,

19
00:00:38,520 --> 00:00:40,360
exchange had its own API.

20
00:00:40,360 --> 00:00:43,040
SharePoint had a completely different one, Azure AD,

21
00:00:43,040 --> 00:00:44,160
another one entirely.

22
00:00:44,160 --> 00:00:46,280
And if you wanted to work with Teams or OneDrive,

23
00:00:46,280 --> 00:00:48,200
more APIs with their own rules.

24
00:00:48,200 --> 00:00:50,440
So if you were a developer or an admin,

25
00:00:50,440 --> 00:00:53,040
trying to automate something, say, create a new user,

26
00:00:53,040 --> 00:00:56,240
give them a mailbox, and add them to a SharePoint site.

27
00:00:56,240 --> 00:00:58,000
You had to learn three different APIs

28
00:00:58,000 --> 00:01:00,280
with three different authentication methods.

29
00:01:00,280 --> 00:01:02,200
Each one had its own way of logging in,

30
00:01:02,200 --> 00:01:04,120
making requests and handling errors.

31
00:01:04,120 --> 00:01:06,760
It was slow, complex, and it meant a lot of manual work

32
00:01:06,760 --> 00:01:08,320
that should have been automated.

33
00:01:08,320 --> 00:01:10,200
Microsoft looked at the situation and realized

34
00:01:10,200 --> 00:01:11,920
they needed something better.

35
00:01:11,920 --> 00:01:14,320
A single unified doorway into everything.

36
00:01:14,320 --> 00:01:15,760
That's what Graph is.

37
00:01:15,760 --> 00:01:16,960
What is an API?

38
00:01:16,960 --> 00:01:18,080
A simple definition.

39
00:01:18,080 --> 00:01:20,360
Before we go further, let's get on the same page

40
00:01:20,360 --> 00:01:22,120
about what an API actually is.

41
00:01:22,120 --> 00:01:23,680
Think of it like a waiter in a restaurant.

42
00:01:23,680 --> 00:01:25,200
You sit down, tell them your order,

43
00:01:25,200 --> 00:01:27,080
they go to the kitchen, the food gets made,

44
00:01:27,080 --> 00:01:28,400
and they bring it back to you.

45
00:01:28,400 --> 00:01:30,160
You don't need to know how the kitchen works.

46
00:01:30,160 --> 00:01:31,880
You just need the waiter.

47
00:01:31,880 --> 00:01:33,280
Now, before Graph came along,

48
00:01:33,280 --> 00:01:35,320
imagine a building with 10 different restaurants,

49
00:01:35,320 --> 00:01:37,600
each with its own kitchen and its own waiter.

50
00:01:37,600 --> 00:01:39,760
If you wanted food from three different restaurants,

51
00:01:39,760 --> 00:01:41,320
you had to talk to three different waiters,

52
00:01:41,320 --> 00:01:43,400
each with a different menu and ordering process.

53
00:01:43,400 --> 00:01:45,000
That was the old Microsoft world.

54
00:01:45,000 --> 00:01:48,400
Graph API is the master waiter who works with every kitchen at once.

55
00:01:48,400 --> 00:01:50,280
You place a single order and Graph talks

56
00:01:50,280 --> 00:01:54,040
to Exchange SharePoint Teams and everything else behind the scenes.

57
00:01:54,040 --> 00:01:57,440
It uses standard HTTP methods, get to read data,

58
00:01:57,440 --> 00:02:00,200
post to create something new, patch to update,

59
00:02:00,200 --> 00:02:01,360
and delete to remove.

60
00:02:01,360 --> 00:02:03,000
Think of it as a universal translator

61
00:02:03,000 --> 00:02:06,120
for all of Microsoft services, one language,

62
00:02:06,120 --> 00:02:09,360
one way of ordering, and everything gets delivered to your table.

63
00:02:09,360 --> 00:02:10,800
What is Microsoft Graph?

64
00:02:10,800 --> 00:02:12,120
The Office Building analogy.

65
00:02:12,120 --> 00:02:14,080
So here's the analogy that makes this all click.

66
00:02:14,080 --> 00:02:17,360
Imagine Microsoft 365 as a modern office building.

67
00:02:17,360 --> 00:02:19,640
It has different rooms that each server purpose.

68
00:02:19,640 --> 00:02:21,720
Exchange Online is the mail room for your email.

69
00:02:21,720 --> 00:02:24,160
SharePoint is the filing room for documents.

70
00:02:24,160 --> 00:02:25,840
Teams is the conference room for meetings.

71
00:02:25,840 --> 00:02:27,600
One drive is your personal desk drawer.

72
00:02:27,600 --> 00:02:30,240
An enter ID is the security desk at the front entrance.

73
00:02:30,240 --> 00:02:33,040
Now before Graph, if you needed something from each of these rooms,

74
00:02:33,040 --> 00:02:34,960
you had to walk to each one separately.

75
00:02:34,960 --> 00:02:37,400
A file from SharePoint meant walking to the filing room,

76
00:02:37,400 --> 00:02:39,280
checking someone's email meant the mail room,

77
00:02:39,280 --> 00:02:41,520
setting up a Teams meeting meant the conference room.

78
00:02:41,520 --> 00:02:44,000
Every room had its own door, key, and rules.

79
00:02:44,000 --> 00:02:46,000
Microsoft Graph changes that completely.

80
00:02:46,000 --> 00:02:49,040
Graph API is like the reception desk at the front of the building.

81
00:02:49,040 --> 00:02:51,240
You walk in, tell the receptionist what you need,

82
00:02:51,240 --> 00:02:53,320
John's email, the sales Teams SharePoint files,

83
00:02:53,320 --> 00:02:54,560
and a new Teams channel.

84
00:02:54,560 --> 00:02:55,720
And they take care of it.

85
00:02:55,720 --> 00:02:58,120
One conversation, one person, everything handled.

86
00:02:58,120 --> 00:02:59,080
But here's the thing.

87
00:02:59,080 --> 00:03:01,840
Under the hood, Graph isn't just a simple list of data.

88
00:03:01,840 --> 00:03:04,720
It's a Graph database, which means everything is connected.

89
00:03:04,720 --> 00:03:07,640
Users are connected to groups, groups are connected to files.

90
00:03:07,640 --> 00:03:09,560
Files are connected to Teams channels.

91
00:03:09,560 --> 00:03:11,600
And Teams channels are connected to meetings.

92
00:03:11,600 --> 00:03:14,040
It's a web of relationships, not a flat list.

93
00:03:14,040 --> 00:03:16,560
So when you ask for something, Graph understands not just

94
00:03:16,560 --> 00:03:19,520
what you're asking for, but how it connects to everything else.

95
00:03:19,520 --> 00:03:21,280
Now you'll hear about two versions of Graph.

96
00:03:21,280 --> 00:03:23,640
There's V1.0, the stable production ready version

97
00:03:23,640 --> 00:03:26,720
where Microsoft guarantees nothing will break or change unexpectedly.

98
00:03:26,720 --> 00:03:29,680
Then there's Beta, where new features show up first.

99
00:03:29,680 --> 00:03:32,680
Beta features are experimental and might change or not work perfectly,

100
00:03:32,680 --> 00:03:35,160
but they give you early access to the latest capabilities.

101
00:03:35,160 --> 00:03:37,880
Most people should start with V1.0 and only dip into Beta

102
00:03:37,880 --> 00:03:39,400
when they need something specific.

103
00:03:39,400 --> 00:03:40,440
And here's the best part.

104
00:03:40,440 --> 00:03:44,280
You only need to remember one address, one single endpoint, Graph,

105
00:03:44,280 --> 00:03:45,960
Microsoft.com.

106
00:03:45,960 --> 00:03:46,560
That's it.

107
00:03:46,560 --> 00:03:48,800
Whether you're working with users, email, files,

108
00:03:48,800 --> 00:03:51,720
Teams or security, every request goes to the same place,

109
00:03:51,720 --> 00:03:54,240
one URL, one doorway.

110
00:03:54,240 --> 00:03:55,760
That's the whole point.

111
00:03:55,760 --> 00:03:56,520
How does it work?

112
00:03:56,520 --> 00:03:58,080
Authentication and permissions.

113
00:03:58,080 --> 00:04:00,000
So how does this actually work in practice?

114
00:04:00,000 --> 00:04:02,480
Let's walk through the front door together.

115
00:04:02,480 --> 00:04:05,400
Every request to Graph starts by proving who you are.

116
00:04:05,400 --> 00:04:06,440
That's authentication.

117
00:04:06,440 --> 00:04:09,680
You're basically saying, hello, I'm Merco and here's my ID.

118
00:04:09,680 --> 00:04:11,120
Entra ID handles that check.

119
00:04:11,120 --> 00:04:13,760
It verifies your credentials, makes sure you're really you

120
00:04:13,760 --> 00:04:15,480
and then issues a digital pass.

121
00:04:15,480 --> 00:04:18,320
Show your driver's license at the reception desk and you're in.

122
00:04:18,320 --> 00:04:20,360
But getting in the building is only half the story.

123
00:04:20,360 --> 00:04:22,120
Next comes authorization.

124
00:04:22,120 --> 00:04:24,000
What are you actually allowed to see and do?

125
00:04:24,000 --> 00:04:26,640
Being inside doesn't give you access to every room.

126
00:04:26,640 --> 00:04:28,800
You might reach the mail room but not the filing room.

127
00:04:28,800 --> 00:04:30,680
You might read files but not delete them.

128
00:04:30,680 --> 00:04:32,400
That's where permissions come into play.

129
00:04:32,400 --> 00:04:34,800
In Graph, those permissions are called scopes.

130
00:04:34,800 --> 00:04:36,200
Think of them like a keycard.

131
00:04:36,200 --> 00:04:39,960
Your keycard might say, read users only or read and write all mail.

132
00:04:39,960 --> 00:04:42,600
Each scope defines a specific level of access.

133
00:04:42,600 --> 00:04:43,880
And here's the important part.

134
00:04:43,880 --> 00:04:45,360
You don't automatically get everything.

135
00:04:45,360 --> 00:04:47,640
You have to request each scope explicitly

136
00:04:47,640 --> 00:04:49,760
and someone with admin rights has to approve it.

137
00:04:49,760 --> 00:04:50,520
That's deliberate.

138
00:04:50,520 --> 00:04:52,880
Microsoft built Graph on the principle of least privilege,

139
00:04:52,880 --> 00:04:55,400
meaning you only get access to what you actually need.

140
00:04:55,400 --> 00:04:56,920
Two main types of scopes exist.

141
00:04:56,920 --> 00:04:59,960
Delegated permissions let an application act on behalf of a user.

142
00:04:59,960 --> 00:05:02,040
So if you're using an app that reads your calendar,

143
00:05:02,040 --> 00:05:04,040
it's using delegated permissions.

144
00:05:04,040 --> 00:05:06,640
It's doing what you would do just through the app.

145
00:05:06,640 --> 00:05:07,960
App-only permissions are different.

146
00:05:07,960 --> 00:05:10,240
That's when an application has its own identity separate

147
00:05:10,240 --> 00:05:11,440
from any user.

148
00:05:11,440 --> 00:05:14,160
This is common for background services and automated scripts

149
00:05:14,160 --> 00:05:15,960
that run without anyone logged in.

150
00:05:15,960 --> 00:05:19,240
An app-only permission can read all mailboxes in the organization

151
00:05:19,240 --> 00:05:21,120
even if no user is signed in.

152
00:05:21,120 --> 00:05:22,720
So what does an actual Graph call look like?

153
00:05:22,720 --> 00:05:24,120
It's surprisingly simple.

154
00:05:24,120 --> 00:05:27,200
Send a get request to a URL like graph, Microsoft.com,

155
00:05:27,200 --> 00:05:29,760
v1.0 users, and you get a list of all users.

156
00:05:29,760 --> 00:05:34,120
Or graph.microsoft.com.v1.0.me for your own profile.

157
00:05:34,120 --> 00:05:36,600
The response comes back as clean, JSON data,

158
00:05:36,600 --> 00:05:39,520
a structured format, any app or script can understand

159
00:05:39,520 --> 00:05:40,600
and use immediately.

160
00:05:40,600 --> 00:05:42,760
No complex passing, no custom connectors,

161
00:05:42,760 --> 00:05:44,200
just a URL and a response.

162
00:05:44,200 --> 00:05:45,560
That's really all there is to it.

163
00:05:45,560 --> 00:05:47,560
Authenticate, get your token, make your request,

164
00:05:47,560 --> 00:05:48,600
get your data.

165
00:05:48,600 --> 00:05:51,600
The complexity all happens behind the scenes.

166
00:05:51,600 --> 00:05:52,840
What can you automate?

167
00:05:52,840 --> 00:05:54,240
Real-world building blocks.

168
00:05:54,240 --> 00:05:55,680
So what does this look like in practice?

169
00:05:55,680 --> 00:05:57,720
What can you build with that unified doorway?

170
00:05:57,720 --> 00:05:59,160
Let's look at some real examples.

171
00:05:59,160 --> 00:06:00,800
Start with users and groups.

172
00:06:00,800 --> 00:06:02,880
Every company has an onboarding process,

173
00:06:02,880 --> 00:06:05,760
someone new joins, and you need to create their account,

174
00:06:05,760 --> 00:06:08,200
assign licenses, add them to the right distribution

175
00:06:08,200 --> 00:06:10,040
groups and set up their manager.

176
00:06:10,040 --> 00:06:13,240
Before Graph, that meant logging into multiple admin centers

177
00:06:13,240 --> 00:06:15,360
or running separate PowerShell modules.

178
00:06:15,360 --> 00:06:18,400
With Graph, you write one script that creates the user,

179
00:06:18,400 --> 00:06:20,560
assigns the license, adds them to groups,

180
00:06:20,560 --> 00:06:24,080
and updates their manager, all in a single workflow.

181
00:06:24,080 --> 00:06:26,240
Offboarding works the same way in reverse.

182
00:06:26,240 --> 00:06:27,640
Now move to Mail and Calendar.

183
00:06:27,640 --> 00:06:29,840
You can build automations that read your inbox,

184
00:06:29,840 --> 00:06:31,880
schedule meetings based on email content

185
00:06:31,880 --> 00:06:34,760
or send automated notifications when something changes.

186
00:06:34,760 --> 00:06:37,680
Imagine a support system that reads incoming emails,

187
00:06:37,680 --> 00:06:40,240
creates a ticket, and sends a calendar invite

188
00:06:40,240 --> 00:06:43,960
to the right team member, or without anyone touching a keyboard.

189
00:06:43,960 --> 00:06:45,880
Files are where Graph really delivers.

190
00:06:45,880 --> 00:06:48,200
SharePoint and OneDrive hold most of your organization's

191
00:06:48,200 --> 00:06:51,200
documents, with Graph you can search across all of them.

192
00:06:51,200 --> 00:06:54,080
Organize files into folders, manage permissions,

193
00:06:54,080 --> 00:06:56,440
and build custom document workflows.

194
00:06:56,440 --> 00:06:59,040
Need to find every file related to a specific project

195
00:06:59,040 --> 00:07:00,760
that was modified in the last week?

196
00:07:00,760 --> 00:07:02,240
One Graph call handles it.

197
00:07:02,240 --> 00:07:04,400
Teams Automation is a common use case right now.

198
00:07:04,400 --> 00:07:07,640
You can create channels, post messages, manage meetings,

199
00:07:07,640 --> 00:07:10,000
and add members to Teams programmatically.

200
00:07:10,000 --> 00:07:12,480
Think about a scenario where a new project kicks off.

201
00:07:12,480 --> 00:07:14,560
Graph creates the team, adds the members,

202
00:07:14,560 --> 00:07:17,040
sets up the channels, and posts a welcome message,

203
00:07:17,040 --> 00:07:18,240
all automatically.

204
00:07:18,240 --> 00:07:19,560
And then there's Security.

205
00:07:19,560 --> 00:07:22,480
Graph gives you access to alerts from Microsoft Defender,

206
00:07:22,480 --> 00:07:25,960
lets you investigate incidents, and even trigger response actions.

207
00:07:25,960 --> 00:07:28,400
If a threat is detected, you can pull the alert,

208
00:07:28,400 --> 00:07:31,800
gather context about the affected user, and take action.

209
00:07:31,800 --> 00:07:34,600
All through the same endpoint you use for everything else.

210
00:07:34,600 --> 00:07:36,560
The pattern stays the same every time.

211
00:07:36,560 --> 00:07:39,080
Authenticate call the right endpoint take action.

212
00:07:39,080 --> 00:07:42,280
Users mail files team security, although it's the same flow.

213
00:07:42,280 --> 00:07:44,320
And here's a rule of thumb that served me well.

214
00:07:44,320 --> 00:07:46,120
If you can do it in the admin center,

215
00:07:46,120 --> 00:07:47,760
you can automate it with Graph.

216
00:07:47,760 --> 00:07:49,880
Graph API for non-developers.

217
00:07:49,880 --> 00:07:52,120
Now here's the part that surprises a lot of people.

218
00:07:52,120 --> 00:07:54,640
You don't have to be a developer to use the Graph API.

219
00:07:54,640 --> 00:07:57,200
Microsoft built several bridges that let anyone tap

220
00:07:57,200 --> 00:07:59,320
into Graph's power without writing code.

221
00:07:59,320 --> 00:08:01,000
The biggest bridge is Power Platform.

222
00:08:01,000 --> 00:08:03,000
Both Power Automate and Power Apps give you

223
00:08:03,000 --> 00:08:04,800
a low-code way to connect to Graph.

224
00:08:04,800 --> 00:08:07,120
Power Automate comes with pre-built connectors

225
00:08:07,120 --> 00:08:08,440
that speak Graph for you.

226
00:08:08,440 --> 00:08:10,560
Want to send an email when a SharePoint file changes?

227
00:08:10,560 --> 00:08:11,720
There's a connector for that.

228
00:08:11,720 --> 00:08:14,120
Want to create a Teams meeting when someone fills out a form?

229
00:08:14,120 --> 00:08:15,280
There's a connector for that too.

230
00:08:15,280 --> 00:08:17,640
You just drag, drop, and configure what you need.

231
00:08:17,640 --> 00:08:19,240
But what if the pre-built connector

232
00:08:19,240 --> 00:08:21,480
doesn't have the exact action you need?

233
00:08:21,480 --> 00:08:22,280
No problem.

234
00:08:22,280 --> 00:08:25,160
Power Automate lets you send custom HTTP requests

235
00:08:25,160 --> 00:08:26,880
to any Graph endpoint.

236
00:08:26,880 --> 00:08:29,240
Copy a URL from the Graph documentation,

237
00:08:29,240 --> 00:08:32,280
paste it into Power Automate, and build a workflow around it.

238
00:08:32,280 --> 00:08:34,240
No coding required, just configuration.

239
00:08:34,240 --> 00:08:35,800
Power Apps takes it even further.

240
00:08:35,800 --> 00:08:38,360
You can build apps that display live user profiles,

241
00:08:38,360 --> 00:08:40,880
show org charts, pull file data from SharePoint

242
00:08:40,880 --> 00:08:42,600
or let managers approve requests,

243
00:08:42,600 --> 00:08:44,720
all powered by Graph behind the scenes.

244
00:08:44,720 --> 00:08:47,760
Your users never see the API, just a clean interface that works.

245
00:08:47,760 --> 00:08:50,160
And if you want to test things out first, there's Graph Explorer.

246
00:08:50,160 --> 00:08:52,160
It's a web-based playground where you can run queries

247
00:08:52,160 --> 00:08:54,400
against your tenant's data, see the responses,

248
00:08:54,400 --> 00:08:56,200
and figure out exactly what you need.

249
00:08:56,200 --> 00:08:58,640
No code, no setup, just a browser.

250
00:08:58,640 --> 00:09:00,400
Test an endpoint, see what data comes back,

251
00:09:00,400 --> 00:09:02,320
then build your automation with confidence.

252
00:09:02,320 --> 00:09:05,160
Microsoft is making Graph accessible to everyone.

253
00:09:05,160 --> 00:09:07,320
They want citizen developers, people in HR,

254
00:09:07,320 --> 00:09:11,160
finance operations, to build automations without waiting for IT.

255
00:09:11,160 --> 00:09:13,800
Graph is the engine, but Power Platform is the steering wheel.

256
00:09:13,800 --> 00:09:16,480
You don't need to know how the engine works to drive the car.

257
00:09:16,480 --> 00:09:18,680
Why it matters today and tomorrow.

258
00:09:18,680 --> 00:09:20,720
Now here's the thing about Microsoft Graph.

259
00:09:20,720 --> 00:09:22,560
It's not just a nice to have anymore.

260
00:09:22,560 --> 00:09:24,640
It's becoming the only path forward.

261
00:09:24,640 --> 00:09:27,400
Exchange web services or EWS is being retired.

262
00:09:27,400 --> 00:09:29,480
That's the old API developers have used for years

263
00:09:29,480 --> 00:09:31,760
to work with mailboxes and calendars.

264
00:09:31,760 --> 00:09:34,920
By October 1, 2026, Calendar Interoperability with Services

265
00:09:34,920 --> 00:09:37,000
like Google Workspace will move entirely to Graph.

266
00:09:37,000 --> 00:09:40,480
If you're still running on EWS, you're running on borrowed time.

267
00:09:40,480 --> 00:09:44,000
And there's another deadline, December 31, 2026.

268
00:09:44,000 --> 00:09:46,840
After that date, if you want to modify sensitive properties

269
00:09:46,840 --> 00:09:49,240
on received emails, things like the subject, body,

270
00:09:49,240 --> 00:09:51,680
or recipients, you'll need new advanced permissions,

271
00:09:51,680 --> 00:09:52,680
the old mail.

272
00:09:52,680 --> 00:09:54,520
Read Write permission won't cut it anymore.

273
00:09:54,520 --> 00:09:56,320
You'll need mail advanced, read Write,

274
00:09:56,320 --> 00:09:57,760
and it requires admin consent.

275
00:09:57,760 --> 00:10:00,080
Microsoft is locking things down and Graph is the key.

276
00:10:00,080 --> 00:10:01,080
So here's the bottom line.

277
00:10:01,080 --> 00:10:03,240
Microsoft is consolidating everything into Graph.

278
00:10:03,240 --> 00:10:05,000
Legacy APIs are shutting down.

279
00:10:05,000 --> 00:10:06,720
New features only show up in Graph.

280
00:10:06,720 --> 00:10:10,400
If you want to integrate with Microsoft 365 in any meaningful way,

281
00:10:10,400 --> 00:10:11,680
Graph is the standard.

282
00:10:11,680 --> 00:10:12,920
It's not optional anymore.

283
00:10:12,920 --> 00:10:14,720
Organizations that learn Graph now

284
00:10:14,720 --> 00:10:17,160
are preparing their automation for the future.

285
00:10:17,160 --> 00:10:19,120
The connected platform keeps expanding.

286
00:10:19,120 --> 00:10:21,440
New endpoints release regularly, and every month

287
00:10:21,440 --> 00:10:22,920
there's something new you can do.

288
00:10:22,920 --> 00:10:24,320
The sooner you understand how it works,

289
00:10:24,320 --> 00:10:27,720
the easier it is to adapt when the next change comes.

290
00:10:27,720 --> 00:10:30,240
Security and permissions, build for safety.

291
00:10:30,240 --> 00:10:32,720
With all that power, you might wonder about security.

292
00:10:32,720 --> 00:10:35,160
Microsoft built it into Graph's DNA from day one.

293
00:10:35,160 --> 00:10:36,080
Here's the thing.

294
00:10:36,080 --> 00:10:38,080
The core principle is least privilege.

295
00:10:38,080 --> 00:10:40,000
You only get access to what you ask for.

296
00:10:40,000 --> 00:10:40,880
Nothing more.

297
00:10:40,880 --> 00:10:43,040
If you request permission to read user profiles,

298
00:10:43,040 --> 00:10:44,800
you can't suddenly start reading mail.

299
00:10:44,800 --> 00:10:47,120
Every scope is explicit, and every permission

300
00:10:47,120 --> 00:10:48,840
must be granted and consented to.

301
00:10:48,840 --> 00:10:51,000
For broad scopes like reading all mailboxes

302
00:10:51,000 --> 00:10:54,080
or modifying user accounts, admin consent is required.

303
00:10:54,080 --> 00:10:55,600
That adds a governance layer.

304
00:10:55,600 --> 00:10:57,600
An administrator has to explicitly approve

305
00:10:57,600 --> 00:10:58,840
that level of access.

306
00:10:58,840 --> 00:11:01,640
It's not automatic, and that prevents rogue apps

307
00:11:01,640 --> 00:11:04,200
or scripts from grabbing permissions they shouldn't have.

308
00:11:04,200 --> 00:11:06,440
App registrations create clear security boundaries.

309
00:11:06,440 --> 00:11:07,960
Every application that talks to Graph

310
00:11:07,960 --> 00:11:09,920
has its own identity in Enter ID.

311
00:11:09,920 --> 00:11:12,040
You can see exactly which apps have which permissions,

312
00:11:12,040 --> 00:11:14,400
who approved them, and when they were last used.

313
00:11:14,400 --> 00:11:15,520
No back doors.

314
00:11:15,520 --> 00:11:17,360
Everything is audited and trackable.

315
00:11:17,360 --> 00:11:18,880
If something suspicious happens,

316
00:11:18,880 --> 00:11:20,680
you can trace it back to the specific app

317
00:11:20,680 --> 00:11:22,080
and permission that was used.

318
00:11:22,080 --> 00:11:24,560
Now let's clear up a common point of confusion.

319
00:11:24,560 --> 00:11:27,360
Delegated versus app-only permissions.

320
00:11:27,360 --> 00:11:29,680
Delegated means the app acts on behalf of a user.

321
00:11:29,680 --> 00:11:31,560
App-only means the app has its own identity.

322
00:11:31,560 --> 00:11:33,640
You choose the right level for your scenario,

323
00:11:33,640 --> 00:11:35,440
which lets you build secure automations

324
00:11:35,440 --> 00:11:37,200
without over complicating things.

325
00:11:37,200 --> 00:11:39,600
Microsoft treats Graph as a high-value surface,

326
00:11:39,600 --> 00:11:42,040
so they invest heavily in its security,

327
00:11:42,040 --> 00:11:45,040
continuous monitoring, threat detection, regular audits.

328
00:11:45,040 --> 00:11:48,080
When you use Graph, you're not just getting a powerful API.

329
00:11:48,080 --> 00:11:51,560
You're getting Microsoft's full security infrastructure behind it.

330
00:11:51,560 --> 00:11:53,320
The one API to rule them all.

331
00:11:53,320 --> 00:11:54,240
Let's sum this up.

332
00:11:54,240 --> 00:11:56,680
Microsoft Graph API is the unified reception desk

333
00:11:56,680 --> 00:12:00,280
for all of Microsoft 365, one endpoint, one way of working,

334
00:12:00,280 --> 00:12:01,560
access to everything.

335
00:12:01,560 --> 00:12:03,280
The real value isn't any single features.

336
00:12:03,280 --> 00:12:04,600
It's the integration.

337
00:12:04,600 --> 00:12:07,520
One call can connect users, files, mail and teams.

338
00:12:07,520 --> 00:12:08,880
That's what makes it powerful.

339
00:12:08,880 --> 00:12:10,360
And that's what makes it the foundation

340
00:12:10,360 --> 00:12:12,360
of modern Microsoft Cloud automation.

341
00:12:12,360 --> 00:12:14,080
Understanding Graph means understanding

342
00:12:14,080 --> 00:12:15,960
how the modern Microsoft Cloud works.

343
00:12:15,960 --> 00:12:18,320
If you want to see how to build your first power automate

344
00:12:18,320 --> 00:12:20,560
flow using Graph, click the video right here.

345
00:12:20,560 --> 00:12:22,480
Subscribe on your favorite podcast platform

346
00:12:22,480 --> 00:12:25,040
and share this with someone just starting their journey.

347
00:12:25,040 --> 00:12:27,000
I'll see you in the next one.