1
00:00:00,040 --> 00:00:03,279
Welcome to the M365 FM podcast,
where we explore the people,
2
00:00:03,279 --> 00:00:06,200
ideas and technologies shaping
the future of work.
3
00:00:06,200 --> 00:00:09,720
The checkpoint every app has to
pass one graph.
4
00:00:09,720 --> 00:00:12,199
Permission can hand an app every
mailbox in your company.
5
00:00:12,199 --> 00:00:13,519
Most people never notice that
6
00:00:13,519 --> 00:00:14,919
line until a security review
7
00:00:14,919 --> 00:00:16,280
points at it because the
8
00:00:16,280 --> 00:00:17,679
permission sits quietly inside
9
00:00:17,679 --> 00:00:19,239
an app somebody set up months
10
00:00:19,239 --> 00:00:19,879
ago.
11
00:00:19,879 --> 00:00:21,120
Microsoft Graph is the single
12
00:00:21,120 --> 00:00:22,379
doorway apps used to reach your
13
00:00:22,379 --> 00:00:23,920
mail, your files, your teams
14
00:00:23,920 --> 00:00:25,440
messages, and the people in your
15
00:00:25,440 --> 00:00:26,039
directory.
16
00:00:26,039 --> 00:00:28,559
And it won't open for anything
that wasn't granted permission.
17
00:00:28,559 --> 00:00:32,219
First, an app can ask in two
ways acting as a signed in
18
00:00:32,219 --> 00:00:35,280
person or acting as itself with
nobody in the room.
19
00:00:35,280 --> 00:00:38,640
And that choice decides whether
it touches one person's data or
20
00:00:38,640 --> 00:00:40,280
the whole organization.
21
00:00:40,280 --> 00:00:43,000
Most graph projects don't fall
apart because of code, and when
22
00:00:43,000 --> 00:00:45,679
they do fall apart, it's usually
at consent because somebody
23
00:00:45,679 --> 00:00:47,759
asked for far more access than
the job needed.
24
00:00:47,759 --> 00:00:48,880
By the end of this, you'll be
25
00:00:48,880 --> 00:00:50,399
able to read any permission name
26
00:00:50,399 --> 00:00:51,840
and know exactly what it lets an
27
00:00:51,840 --> 00:00:52,600
app do.
28
00:00:52,600 --> 00:00:54,320
What a graph permission actually
is.
29
00:00:54,320 --> 00:00:56,880
Microsoft Graph is one doorway
into almost everything your
30
00:00:56,880 --> 00:00:58,479
organization keeps in the cloud.
31
00:00:58,479 --> 00:00:59,640
Mail sits behind it.
32
00:00:59,640 --> 00:01:01,090
So do files and folders.
33
00:01:01,090 --> 00:01:02,570
So do teams conversations.
34
00:01:02,570 --> 00:01:03,810
And so does the directory that
35
00:01:03,810 --> 00:01:05,170
lists every account your company
36
00:01:05,170 --> 00:01:05,890
manages.
37
00:01:05,890 --> 00:01:08,769
Rather than learning a separate
door for each service, an app
38
00:01:08,769 --> 00:01:11,890
learns this one and asks for the
specific things it needs.
39
00:01:11,890 --> 00:01:13,129
A permission is the privilege an
40
00:01:13,129 --> 00:01:14,250
app has been granted before
41
00:01:14,250 --> 00:01:15,769
graph hands over anything at
42
00:01:15,769 --> 00:01:16,370
all.
43
00:01:16,370 --> 00:01:18,450
When an app asks for data, it
wasn't granted.
44
00:01:18,450 --> 00:01:19,810
Graph refuses the request and
45
00:01:19,810 --> 00:01:21,049
returns an error instead of the
46
00:01:21,049 --> 00:01:21,530
answer.
47
00:01:21,530 --> 00:01:23,769
The permission name is what's
printed on the key card, and
48
00:01:23,769 --> 00:01:26,010
that card decides which doors
open for that app.
49
00:01:26,010 --> 00:01:28,370
Being signed in and being
permitted are two separate
50
00:01:28,370 --> 00:01:31,049
gates, and beginners blur them
together all the time.
51
00:01:31,049 --> 00:01:33,489
A person can be signed in and
still see nothing, because the
52
00:01:33,489 --> 00:01:35,409
app was never granted the
permission that matches the
53
00:01:35,409 --> 00:01:38,329
request, and no amount of
logging in again will fix it.
54
00:01:38,329 --> 00:01:41,370
What makes this one model worth
learning is how far it reaches.
55
00:01:41,370 --> 00:01:43,609
The same permission system
covers exchange, mail,
56
00:01:43,609 --> 00:01:47,010
SharePoint, and OneDrive files,
teams, and the users and groups.
57
00:01:47,010 --> 00:01:49,609
In Microsoft Entra ID, that
means a single permission name
58
00:01:49,609 --> 00:01:52,129
can decide how far an app
travels across all of it.
59
00:01:52,129 --> 00:01:54,129
It's also why the name deserves
a second look.
60
00:01:54,129 --> 00:01:55,209
Say you build a small app that
61
00:01:55,209 --> 00:01:56,510
greets people by name when they
62
00:01:56,510 --> 00:01:57,170
sign in.
63
00:01:57,170 --> 00:01:58,290
It needs to read a bit of the
64
00:01:58,290 --> 00:01:59,980
signed in user's profile and
65
00:01:59,980 --> 00:02:00,790
nothing more.
66
00:02:00,790 --> 00:02:02,150
So it asks for one narrow
67
00:02:02,150 --> 00:02:03,709
permission that covers exactly
68
00:02:03,709 --> 00:02:03,950
that.
69
00:02:03,950 --> 00:02:06,310
If it instead asks for
permission to change every
70
00:02:06,310 --> 00:02:09,030
profile in the company, the
request would still work.
71
00:02:09,030 --> 00:02:11,770
And that gap between what the
app needs and what it asked for
72
00:02:11,770 --> 00:02:13,310
is where trouble lives.
73
00:02:13,310 --> 00:02:15,789
Microsoft doesn't make you guess
at any of this.
74
00:02:15,789 --> 00:02:18,430
Every permission in graph is
documented, named in a
75
00:02:18,430 --> 00:02:21,150
consistent way and grouped by
the resource it touches.
76
00:02:21,150 --> 00:02:22,389
So you can look one up and read
77
00:02:22,389 --> 00:02:23,789
what it allows before you ever
78
00:02:23,789 --> 00:02:24,669
approve it.
79
00:02:24,669 --> 00:02:26,750
The vocabulary is smaller than
it looks, too.
80
00:02:26,750 --> 00:02:30,150
There are permissions for mail,
calendars, files, groups, users,
81
00:02:30,150 --> 00:02:33,030
and the apps themselves, and
they all follow the same shape.
82
00:02:33,030 --> 00:02:35,349
So learning one teaches you how
to read the rest.
83
00:02:35,349 --> 00:02:38,069
The other thing worth knowing
early is that a permission is
84
00:02:38,069 --> 00:02:41,349
attached to an app, rather than
to a person or a device.
85
00:02:41,349 --> 00:02:44,110
Two people using the same app
share the app's permissions, and
86
00:02:44,110 --> 00:02:46,229
when the app was granted
something broad, both of them
87
00:02:46,229 --> 00:02:48,030
inherit that reach the moment
they sign in.
88
00:02:48,030 --> 00:02:50,509
There's one small word inside
these names that decides whether
89
00:02:50,509 --> 00:02:53,750
an app touches a single person's
data or everyone's, and we'll
90
00:02:53,750 --> 00:02:55,629
come back to it in a moment.
91
00:02:55,629 --> 00:02:57,110
The two kinds of permission.
92
00:02:57,110 --> 00:02:59,270
Nobody separates at first graph
93
00:02:59,270 --> 00:03:00,599
gives an AB two completely
94
00:03:00,599 --> 00:03:01,840
different ways to ask, and
95
00:03:01,840 --> 00:03:03,120
almost everything else about
96
00:03:03,120 --> 00:03:04,759
permissions flows from that one
97
00:03:04,759 --> 00:03:05,599
split.
98
00:03:05,599 --> 00:03:07,840
The first way is called
delegated access, and it means
99
00:03:07,840 --> 00:03:10,479
the app calls graph on behalf of
a signed in user.
100
00:03:10,479 --> 00:03:13,000
The app borrows that person's
identity for the moment of the
101
00:03:13,000 --> 00:03:16,159
request, and it can never reach
past what that person can
102
00:03:16,159 --> 00:03:17,680
already reach on their own.
103
00:03:17,680 --> 00:03:19,120
If your account can't open a
104
00:03:19,120 --> 00:03:20,919
particular folder, an app acting
105
00:03:20,919 --> 00:03:22,400
as you can't open it either, no
106
00:03:22,400 --> 00:03:23,439
matter which permissions it
107
00:03:23,439 --> 00:03:24,000
holds.
108
00:03:24,000 --> 00:03:25,719
The second way is called
Application Access.
109
00:03:25,719 --> 00:03:27,879
And here the app calls graph as
itself.
110
00:03:27,879 --> 00:03:29,240
With nobody signed in at all.
111
00:03:29,240 --> 00:03:31,639
There's no person to borrow an
identity from, so the app's own
112
00:03:31,639 --> 00:03:34,060
permissions are the only limit,
and that limit can stretch
113
00:03:34,060 --> 00:03:35,520
across the whole organization.
114
00:03:35,520 --> 00:03:36,759
Microsoft's own documentation
115
00:03:36,759 --> 00:03:38,000
gives a blunt example, because
116
00:03:38,000 --> 00:03:40,520
an app holding the files read
117
00:03:40,520 --> 00:03:42,080
all application permission can
118
00:03:42,080 --> 00:03:42,960
read any file in the
119
00:03:42,960 --> 00:03:44,680
organization, not one person's
120
00:03:44,680 --> 00:03:45,080
files.
121
00:03:45,080 --> 00:03:45,800
All of them.
122
00:03:45,800 --> 00:03:47,080
What surprises people here is
123
00:03:47,080 --> 00:03:48,520
the overlap in the delegated
124
00:03:48,520 --> 00:03:49,000
model.
125
00:03:49,000 --> 00:03:50,360
The app's real access is the
126
00:03:50,360 --> 00:03:51,639
intersection of two things the
127
00:03:51,639 --> 00:03:53,240
permissions it was granted, and
128
00:03:53,240 --> 00:03:54,479
whatever the signed in user
129
00:03:54,479 --> 00:03:55,639
already had.
130
00:03:55,639 --> 00:03:58,240
Both limits apply at the same
time, so a generous permission
131
00:03:58,240 --> 00:04:00,699
handed to an app doesn't widen
what the person can see.
132
00:04:00,699 --> 00:04:03,340
That overlap is the reason
delegated access is treated as
133
00:04:03,340 --> 00:04:06,340
the safer default, and Microsoft
says so, directly calling it the
134
00:04:06,340 --> 00:04:08,740
recommended approach whenever it
meets the app's needs.
135
00:04:08,740 --> 00:04:10,979
The instinct that flips here is
worth naming.
136
00:04:10,979 --> 00:04:12,199
You might think asking for more
137
00:04:12,199 --> 00:04:13,699
is the safe move, but the app
138
00:04:13,699 --> 00:04:14,979
only model is actually the one
139
00:04:14,979 --> 00:04:15,979
that reaches your entire
140
00:04:15,979 --> 00:04:17,459
company, and it's the one that
141
00:04:17,459 --> 00:04:18,819
triggers the loudest consent
142
00:04:18,819 --> 00:04:19,899
prompt.
143
00:04:19,899 --> 00:04:22,980
Asking for everything points
straight at the riskiest option.
144
00:04:22,980 --> 00:04:25,540
The better question is never how
much access makes this easy.
145
00:04:25,540 --> 00:04:27,300
It's how little access makes
this work.
146
00:04:27,300 --> 00:04:28,220
This split also answers
147
00:04:28,220 --> 00:04:29,180
something you may have wondered
148
00:04:29,180 --> 00:04:30,420
about, which is why the same app
149
00:04:30,420 --> 00:04:31,579
sometimes asks you to sign in
150
00:04:31,579 --> 00:04:32,540
and sometimes asks an
151
00:04:32,540 --> 00:04:33,740
administrator instead.
152
00:04:33,740 --> 00:04:36,019
The model it chose decides who
gets asked.
153
00:04:36,019 --> 00:04:37,100
The practical version of the
154
00:04:37,100 --> 00:04:38,139
split comes down to one
155
00:04:38,139 --> 00:04:38,579
question.
156
00:04:38,579 --> 00:04:40,579
If a person has to be present
for the work to happen,
157
00:04:40,579 --> 00:04:43,500
delegated access usually fits if
the work has to happen while
158
00:04:43,500 --> 00:04:46,459
everyone is asleep, application
access is the only option, and
159
00:04:46,459 --> 00:04:49,019
that's the moment to slow down
and ask what the smallest
160
00:04:49,019 --> 00:04:50,579
version of it looks like.
161
00:04:50,579 --> 00:04:52,740
How to read a permission name
like a sentence.
162
00:04:52,740 --> 00:04:55,319
Every graph permission name
follows the same three part
163
00:04:55,319 --> 00:04:57,379
shape, and once you see it, you
can't unsee it.
164
00:04:57,379 --> 00:04:58,584
The first part names the
165
00:04:58,584 --> 00:04:59,810
resource, the thing being
166
00:04:59,810 --> 00:05:00,430
touched.
167
00:05:00,430 --> 00:05:01,430
The second part names the
168
00:05:01,430 --> 00:05:02,949
operation usually read or read
169
00:05:02,949 --> 00:05:03,629
and write.
170
00:05:03,629 --> 00:05:06,350
The third part is the constraint
and it's optional, which is the
171
00:05:06,350 --> 00:05:07,709
detail that matters most.
172
00:05:07,709 --> 00:05:09,990
Read a few out loud and the
patent shows up fast.
173
00:05:09,990 --> 00:05:11,509
User dot read lets an app read
174
00:05:11,509 --> 00:05:12,589
the signed in user's own
175
00:05:12,589 --> 00:05:13,470
profile.
176
00:05:13,470 --> 00:05:14,870
Group A create is for making new
177
00:05:14,870 --> 00:05:16,029
groups, though not changing or
178
00:05:16,029 --> 00:05:16,949
deleting them.
179
00:05:16,949 --> 00:05:17,949
Application.
180
00:05:17,949 --> 00:05:18,310
Read.
181
00:05:18,310 --> 00:05:22,230
Write all reaches every app in
the tenant while application
182
00:05:22,230 --> 00:05:26,509
read write owned by shrinks that
to only the apps the app itself
183
00:05:26,509 --> 00:05:28,350
created or owns.
184
00:05:28,350 --> 00:05:30,910
The constraint is where the
reach lives, and it comes in a
185
00:05:30,910 --> 00:05:31,949
small set of words.
186
00:05:31,949 --> 00:05:34,709
All means the whole organization
owned by narrows things to what
187
00:05:34,709 --> 00:05:35,990
the app owns.
188
00:05:35,990 --> 00:05:39,730
Selected, shared, hidden and app
folder each tighten the scope in
189
00:05:39,730 --> 00:05:40,670
their own way.
190
00:05:40,670 --> 00:05:43,149
The payoff of that flagged word
arrives right here.
191
00:05:43,149 --> 00:05:44,990
When a permission carries no
constraint at all.
192
00:05:44,990 --> 00:05:47,110
The default is that one person's
own data.
193
00:05:47,110 --> 00:05:48,670
That's why user read reads u
194
00:05:48,670 --> 00:05:50,629
while user read all reads
195
00:05:50,629 --> 00:05:51,069
everyone.
196
00:05:51,069 --> 00:05:53,790
And the missing word is doing an
enormous amount of work on a
197
00:05:53,790 --> 00:05:55,149
screen that's easy to skim.
198
00:05:55,149 --> 00:05:56,790
One honest limit belongs here
199
00:05:56,790 --> 00:05:58,339
because names describe intent,
200
00:05:58,339 --> 00:05:59,569
and intent isn't always the
201
00:05:59,569 --> 00:06:00,449
whole story.
202
00:06:00,449 --> 00:06:03,810
Microsoft's own materials note
that names like mail, read,
203
00:06:03,810 --> 00:06:08,170
write, and sites dot full
control all imply broad reach,
204
00:06:08,170 --> 00:06:11,209
and the practical advice is to
test in a safe tenant rather
205
00:06:11,209 --> 00:06:12,889
than trusting the label alone.
206
00:06:12,889 --> 00:06:16,089
This is the skill that changes
how you read a consent screen.
207
00:06:16,089 --> 00:06:17,370
Instead of seeing a wall of
208
00:06:17,370 --> 00:06:18,850
unfamiliar names, you start
209
00:06:18,850 --> 00:06:20,250
seeing sentences and the
210
00:06:20,250 --> 00:06:21,329
sentence tells you who is
211
00:06:21,329 --> 00:06:22,730
affected and how far the app can
212
00:06:22,730 --> 00:06:23,209
go.
213
00:06:23,209 --> 00:06:24,529
The name stay consistent across
214
00:06:24,529 --> 00:06:25,889
the whole service, so the effort
215
00:06:25,889 --> 00:06:27,129
you spend learning this shape
216
00:06:27,129 --> 00:06:28,449
pays off everywhere, and none of
217
00:06:28,449 --> 00:06:29,610
it asks you to memorize a
218
00:06:29,610 --> 00:06:30,769
separate dictionary.
219
00:06:30,769 --> 00:06:33,290
You'll also notice the names are
specific enough to argue with
220
00:06:33,290 --> 00:06:34,329
which is the point.
221
00:06:34,329 --> 00:06:35,769
A permission that says all is
222
00:06:35,769 --> 00:06:36,930
telling you in plain language
223
00:06:36,930 --> 00:06:38,170
that it crosses every part of
224
00:06:38,170 --> 00:06:39,449
the organization, so nobody can
225
00:06:39,449 --> 00:06:40,490
claim the reach came as a
226
00:06:40,490 --> 00:06:41,250
surprise.
227
00:06:41,250 --> 00:06:43,889
If a name feels too broad for
the job, it usually is, and
228
00:06:43,889 --> 00:06:48,329
there's almost always a smaller
one nearby who gets to say yes.
229
00:06:48,329 --> 00:06:50,730
Reading the name tells you what
an app wants.
230
00:06:50,730 --> 00:06:52,850
It doesn't tell you who's
allowed to hand it over.
231
00:06:52,850 --> 00:06:54,610
And that second question has its
232
00:06:54,610 --> 00:06:56,129
own set of rules for delegated
233
00:06:56,129 --> 00:06:56,649
permissions.
234
00:06:56,649 --> 00:06:58,459
The answer is fairly forgiving.
235
00:06:58,459 --> 00:06:59,660
A person can consent for their
236
00:06:59,660 --> 00:07:01,259
own data, which is why a small
237
00:07:01,259 --> 00:07:02,459
app can ask you to approve a
238
00:07:02,459 --> 00:07:03,639
narrow permission the moment you
239
00:07:03,639 --> 00:07:04,339
sign in.
240
00:07:04,339 --> 00:07:06,899
An administrator can also
consent on behalf of everyone at
241
00:07:06,899 --> 00:07:09,540
once, which helps when you'd
rather not make every colleague
242
00:07:09,540 --> 00:07:12,259
click through the same prompt
for application permissions, the
243
00:07:12,259 --> 00:07:13,740
door narrows sharply.
244
00:07:13,740 --> 00:07:16,220
Only an administrator can
consent, and Microsoft is
245
00:07:16,220 --> 00:07:18,939
specific about which ones
privileged role administrator
246
00:07:18,939 --> 00:07:22,259
and global administrator are the
two roles that can grant an app.
247
00:07:22,259 --> 00:07:23,980
The app only permissions it's
asking for.
248
00:07:23,980 --> 00:07:25,060
If you've ever watched a rollout
249
00:07:25,060 --> 00:07:26,339
stall while everyone waited on
250
00:07:26,339 --> 00:07:27,920
one person, this is usually why
251
00:07:27,920 --> 00:07:29,100
there's also a convenience
252
00:07:29,100 --> 00:07:30,560
feature that's easy to overlook,
253
00:07:30,560 --> 00:07:32,060
called tenant wide admin
254
00:07:32,060 --> 00:07:32,939
consent.
255
00:07:32,939 --> 00:07:35,540
An administrator approves an app
once for everyone, and after
256
00:07:35,540 --> 00:07:37,860
that, people aren't nagged with
prompts when they sign in, it
257
00:07:37,860 --> 00:07:40,939
removes friction, and it also
means the approval decision gets
258
00:07:40,939 --> 00:07:43,779
made far away from the people
who'll actually use the thing.
259
00:07:43,779 --> 00:07:45,160
One more gate sits on top of all
260
00:07:45,160 --> 00:07:46,259
of this, and it belongs to your
261
00:07:46,259 --> 00:07:47,540
own organization.
262
00:07:47,540 --> 00:07:49,839
Even when a permission
technically allows a user to
263
00:07:49,839 --> 00:07:53,220
consent, your tenant's app,
consent policies can restrict or
264
00:07:53,220 --> 00:07:56,139
block that, and plenty of
organizations do exactly that.
265
00:07:56,139 --> 00:07:57,300
A permission can be perfectly
266
00:07:57,300 --> 00:07:59,120
valid on paper and still stop at
267
00:07:59,120 --> 00:08:00,120
a policy someone set
268
00:08:00,120 --> 00:08:00,959
deliberately.
269
00:08:00,959 --> 00:08:03,639
The moment of consent is worth
watching closely, because it's
270
00:08:03,639 --> 00:08:06,240
the clearest view you'll ever
get of what an app can do.
271
00:08:06,240 --> 00:08:08,879
The prompt lists the permissions
in plain language, and a
272
00:08:08,879 --> 00:08:11,639
delegated request reads like a
request to act as you.
273
00:08:11,639 --> 00:08:13,839
While an application request
reads like a request to act
274
00:08:13,839 --> 00:08:16,600
across everyone reading that
screen instead of clicking past.
275
00:08:16,600 --> 00:08:18,720
It is the cheapest security
habit there is.
276
00:08:18,720 --> 00:08:20,079
This is why the same app can
277
00:08:20,079 --> 00:08:21,439
install smoothly in a test
278
00:08:21,439 --> 00:08:23,079
tenant and grind to a halt in a
279
00:08:23,079 --> 00:08:23,519
real one.
280
00:08:23,519 --> 00:08:24,600
Test tenants tend to leave
281
00:08:24,600 --> 00:08:25,879
consent open, and production
282
00:08:25,879 --> 00:08:27,439
tenants tend to close it, so the
283
00:08:27,439 --> 00:08:29,000
app's success has less to do
284
00:08:29,000 --> 00:08:30,439
with the app than with the rules
285
00:08:30,439 --> 00:08:31,079
around it.
286
00:08:31,079 --> 00:08:33,480
Once the approval is in hand,
the next question is how big
287
00:08:33,480 --> 00:08:34,360
that approval should be.
288
00:08:34,360 --> 00:08:37,840
And that's where most projects
get themselves into trouble.
289
00:08:37,840 --> 00:08:39,679
The trap of asking for too much.
290
00:08:39,679 --> 00:08:41,600
Everything so far leads to one
291
00:08:41,600 --> 00:08:43,279
habit that separates a smooth
292
00:08:43,279 --> 00:08:44,960
rollout from a painful one, and
293
00:08:44,960 --> 00:08:46,740
Microsoft states it plainly
294
00:08:46,740 --> 00:08:48,039
grant the app the minimum
295
00:08:48,039 --> 00:08:49,200
permission it needs for the
296
00:08:49,200 --> 00:08:50,840
operation, and nothing beyond
297
00:08:50,840 --> 00:08:51,360
that.
298
00:08:51,360 --> 00:08:53,639
Microsoft's own examples make
the Gap concrete.
299
00:08:53,639 --> 00:08:57,044
An app that reads the signed in
user's profile, needs only user
300
00:08:57,044 --> 00:08:58,090
read and handing it.
301
00:08:58,090 --> 00:09:00,769
User read write makes it
overprivileged because the app
302
00:09:00,769 --> 00:09:02,330
never needs to change anything.
303
00:09:02,330 --> 00:09:03,529
Reading groups without a signed
304
00:09:03,529 --> 00:09:05,389
in user needs only group member
305
00:09:05,389 --> 00:09:06,370
read all.
306
00:09:06,370 --> 00:09:07,750
A calendar that's only ever read
307
00:09:07,750 --> 00:09:09,490
needs calendars read while
308
00:09:09,490 --> 00:09:09,929
calendars.
309
00:09:09,929 --> 00:09:12,570
Read write belongs to apps that
actually schedule something.
310
00:09:12,570 --> 00:09:14,929
The real tension here is what
happens when you ignore it
311
00:09:14,929 --> 00:09:17,970
because the cost is documented
rather than theoretical.
312
00:09:17,970 --> 00:09:19,529
Granting an app more privileges
313
00:09:19,529 --> 00:09:21,370
than it needs is a poor security
314
00:09:21,370 --> 00:09:22,970
practice, in Microsoft's words,
315
00:09:22,970 --> 00:09:24,169
because it raises the app's
316
00:09:24,169 --> 00:09:25,690
exposure to unauthorized and
317
00:09:25,690 --> 00:09:26,970
unintended access.
318
00:09:26,970 --> 00:09:29,929
The same overreach carries a
second cost that hits adoption.
319
00:09:29,929 --> 00:09:31,049
Since asking for more than
320
00:09:31,049 --> 00:09:32,470
necessary makes people refuse to
321
00:09:32,470 --> 00:09:34,669
consent, and a refused consent
322
00:09:34,669 --> 00:09:36,289
screen ends the rollout right
323
00:09:36,289 --> 00:09:36,690
there.
324
00:09:36,690 --> 00:09:39,289
There's a hard ceiling to which
surprises people who assume
325
00:09:39,289 --> 00:09:40,730
permissions are unlimited.
326
00:09:40,730 --> 00:09:44,009
Microsoft Entry ID caps an app
at four hundred permissions, and
327
00:09:44,009 --> 00:09:46,250
no more than four hundred of
those can be graph permissions
328
00:09:46,250 --> 00:09:47,529
for work and school apps.
329
00:09:47,529 --> 00:09:49,850
Personal Microsoft Account apps
are capped at thirty.
330
00:09:49,850 --> 00:09:52,649
If you are picturing an endless
menu, it isn't one picture how
331
00:09:52,649 --> 00:09:53,889
this plays out in practice.
332
00:09:53,889 --> 00:09:55,289
A team wants SharePoint data for
333
00:09:55,289 --> 00:09:56,779
a quarterly report and asks for
334
00:09:56,779 --> 00:09:58,389
access to every site and the
335
00:09:58,389 --> 00:09:59,830
request lands in security review
336
00:09:59,830 --> 00:10:00,389
and stops.
337
00:10:00,389 --> 00:10:02,870
They trim the list down to the
sites they actually read.
338
00:10:02,870 --> 00:10:04,110
Attach a short note explaining
339
00:10:04,110 --> 00:10:05,429
why each one is needed, and the
340
00:10:05,429 --> 00:10:06,789
approval moves in a fraction of
341
00:10:06,789 --> 00:10:07,429
the time.
342
00:10:07,429 --> 00:10:09,870
The permission list was the
whole problem, and it was the
343
00:10:09,870 --> 00:10:11,549
one part they controlled.
344
00:10:11,549 --> 00:10:13,669
The lesson is unglamorous and it
works.
345
00:10:13,669 --> 00:10:15,029
Ask for what the app does today
346
00:10:15,029 --> 00:10:16,269
rather than for what it might do
347
00:10:16,269 --> 00:10:16,909
someday.
348
00:10:16,909 --> 00:10:18,110
Because every extra permission
349
00:10:18,110 --> 00:10:19,250
is a question somebody has to
350
00:10:19,250 --> 00:10:20,409
answer before you're allowed to
351
00:10:20,409 --> 00:10:21,029
ship.
352
00:10:21,029 --> 00:10:23,509
There's a simple test you can
run on any permissionless before
353
00:10:23,509 --> 00:10:24,830
you send it for approval.
354
00:10:24,830 --> 00:10:26,149
For each permission, name the
355
00:10:26,149 --> 00:10:27,429
exact feature that breaks
356
00:10:27,429 --> 00:10:28,269
without it.
357
00:10:28,269 --> 00:10:31,149
If you can't name one, that
permission is a wish rather than
358
00:10:31,149 --> 00:10:33,710
a requirement, and it's the
first thing a reviewer will ask
359
00:10:33,710 --> 00:10:35,269
you to justify.
360
00:10:35,269 --> 00:10:36,590
Where this breaks down.
361
00:10:36,590 --> 00:10:39,029
Careful permission choices get
you most of the way, and they
362
00:10:39,029 --> 00:10:40,509
don't remove every wall.
363
00:10:40,509 --> 00:10:41,950
Some limits belong to the system
364
00:10:41,950 --> 00:10:43,549
itself, and knowing them early
365
00:10:43,549 --> 00:10:44,750
saves a confusing afternoon
366
00:10:44,750 --> 00:10:45,309
later.
367
00:10:45,309 --> 00:10:47,950
The first of them is easy to
misread, and it wastes the most
368
00:10:47,950 --> 00:10:50,909
time when an app asks for the
members of a group graph, can
369
00:10:50,909 --> 00:10:53,870
answer with a success code and
still hand back almost nothing.
370
00:10:53,870 --> 00:10:56,274
Members whose type the app isn't
permitted to read come back with
371
00:10:56,274 --> 00:10:59,080
little more than an identifier
and their real properties arrive
372
00:10:59,080 --> 00:11:00,080
as empty values.
373
00:11:00,080 --> 00:11:01,559
The request succeeded, and the
374
00:11:01,559 --> 00:11:02,960
data simply isn't there, which
375
00:11:02,960 --> 00:11:04,340
is why the failure is so easy to
376
00:11:04,340 --> 00:11:04,960
miss.
377
00:11:04,960 --> 00:11:07,320
Then there are the permissions
that carry the most weight
378
00:11:07,320 --> 00:11:10,320
directory access as user, all is
the highest privilege.
379
00:11:10,320 --> 00:11:11,679
Delegated permission in graph,
380
00:11:11,679 --> 00:11:12,720
and it reaches nearly every
381
00:11:12,720 --> 00:11:14,159
operation across Microsoft entra
382
00:11:14,159 --> 00:11:15,200
ID directory.
383
00:11:15,200 --> 00:11:16,799
Read write all ranked second and
384
00:11:16,799 --> 00:11:18,360
directory read all is the
385
00:11:18,360 --> 00:11:18,759
strongest.
386
00:11:18,759 --> 00:11:20,879
Read only permission in that
same space.
387
00:11:20,879 --> 00:11:23,559
Microsoft's guidance on all
three is to use them only when
388
00:11:23,559 --> 00:11:24,919
nothing smaller will do.
389
00:11:24,919 --> 00:11:26,039
A narrower option exists for
390
00:11:26,039 --> 00:11:27,279
some situations, and it deserves
391
00:11:27,279 --> 00:11:28,240
a name.
392
00:11:28,240 --> 00:11:31,120
Resource specific consent grants
an app access to one instance of
393
00:11:31,120 --> 00:11:33,840
a resource, like a single team
or a single chat, instead of
394
00:11:33,840 --> 00:11:35,120
every instance in the tenant.
395
00:11:35,120 --> 00:11:36,519
It's supported for a subset of
396
00:11:36,519 --> 00:11:38,059
features such as teams, chats,
397
00:11:38,059 --> 00:11:39,360
and messages, and it's the
398
00:11:39,360 --> 00:11:40,720
closest thing to a scalpel in a
399
00:11:40,720 --> 00:11:41,960
model that often feels like a
400
00:11:41,960 --> 00:11:42,480
hammer.
401
00:11:42,480 --> 00:11:44,639
Scale brings its own pushback
because graph slows you down
402
00:11:44,639 --> 00:11:45,759
when you ask to fast.
403
00:11:45,759 --> 00:11:48,519
When an app exceeds the limits,
graph returns a throttling error
404
00:11:48,519 --> 00:11:51,179
instead of the data, and the
global ceiling is one hundred
405
00:11:51,179 --> 00:11:54,480
and thirty thousand requests per
10s per app across all tenants
406
00:11:54,480 --> 00:11:57,460
with tighter limits underneath
for individual services.
407
00:11:57,460 --> 00:11:58,720
The fix is to read the retry
408
00:11:58,720 --> 00:12:00,100
after header, wait the amount of
409
00:12:00,100 --> 00:12:01,779
time it names and slow down
410
00:12:01,779 --> 00:12:02,740
rather than hammering the
411
00:12:02,740 --> 00:12:03,460
endpoint.
412
00:12:03,460 --> 00:12:04,580
The newest wrinkle points in a
413
00:12:04,580 --> 00:12:05,779
promising direction for
414
00:12:05,779 --> 00:12:07,580
Microsoft Entra Agent ID some
415
00:12:07,580 --> 00:12:09,019
high risk graph permissions are
416
00:12:09,019 --> 00:12:10,580
blocked outright and can't be
417
00:12:10,580 --> 00:12:12,019
granted to agent identities at
418
00:12:12,019 --> 00:12:13,139
all, which tells you the
419
00:12:13,139 --> 00:12:14,320
platform is moving toward
420
00:12:14,320 --> 00:12:15,620
tighter defaults rather than
421
00:12:15,620 --> 00:12:16,940
looser ones.
422
00:12:16,940 --> 00:12:18,340
None of these limits are reasons
423
00:12:18,340 --> 00:12:19,740
to avoid graph, and they're the
424
00:12:19,740 --> 00:12:20,899
reasons so much of this gets
425
00:12:20,899 --> 00:12:21,919
documented rather than
426
00:12:21,919 --> 00:12:23,299
discovered the hard way the
427
00:12:23,299 --> 00:12:24,340
system tells you when it
428
00:12:24,340 --> 00:12:25,700
throttles, it documents its
429
00:12:25,700 --> 00:12:27,220
privilege rankings, and it flags
430
00:12:27,220 --> 00:12:28,379
the permissions it considers
431
00:12:28,379 --> 00:12:28,899
risky.
432
00:12:28,899 --> 00:12:30,779
So most of the surprises are
avoidable.
433
00:12:30,779 --> 00:12:33,179
If you read first how this fits
434
00:12:33,179 --> 00:12:34,379
into your Microsoft three
435
00:12:34,379 --> 00:12:35,700
hundred sixty five and Azure
436
00:12:35,700 --> 00:12:36,379
World.
437
00:12:36,379 --> 00:12:39,740
All of this lives in a place you
may already recognize.
438
00:12:39,740 --> 00:12:42,820
The app itself is registered in
Microsoft Entra ID, and the
439
00:12:42,820 --> 00:12:45,100
consent it received is recorded
there as a grant.
440
00:12:45,100 --> 00:12:46,820
While the mail files and team's
441
00:12:46,820 --> 00:12:48,659
data sit behind the door in the
442
00:12:48,659 --> 00:12:49,820
Microsoft three hundred sixty
443
00:12:49,820 --> 00:12:51,460
five and Azure services you use
444
00:12:51,460 --> 00:12:52,419
every day.
445
00:12:52,419 --> 00:12:53,740
When someone asks who approved
446
00:12:53,740 --> 00:12:55,164
an app, entra ID holds the
447
00:12:55,164 --> 00:12:56,590
answer with that picture in
448
00:12:56,590 --> 00:12:57,149
place.
449
00:12:57,149 --> 00:12:59,990
A few habits turn the theory
into something workable.
450
00:12:59,990 --> 00:13:01,190
Keep user facing data on
451
00:13:01,190 --> 00:13:02,350
delegated permissions wherever
452
00:13:02,350 --> 00:13:03,149
you can.
453
00:13:03,149 --> 00:13:05,950
Reserve the app only model for
the jobs that genuinely run
454
00:13:05,950 --> 00:13:08,950
unattended, like a nightly sync
with nobody at the keyboard.
455
00:13:08,950 --> 00:13:11,429
Map out the permissions your
project needs before you build,
456
00:13:11,429 --> 00:13:14,029
because discovering them during
a security review is the slowest
457
00:13:14,029 --> 00:13:15,470
possible time to learn them.
458
00:13:15,470 --> 00:13:17,230
Staging helps to pilot with a
459
00:13:17,230 --> 00:13:18,629
small group of people first,
460
00:13:18,629 --> 00:13:19,909
show them what each permission
461
00:13:19,909 --> 00:13:21,169
does and what the app can never
462
00:13:21,169 --> 00:13:21,509
see.
463
00:13:21,509 --> 00:13:24,509
Then widen the audience once the
first group is comfortable.
464
00:13:24,509 --> 00:13:27,230
That approach builds advocates
instead of objections, and it
465
00:13:27,230 --> 00:13:29,629
gives you a chance to catch an
overbroad request while it's
466
00:13:29,629 --> 00:13:30,830
still cheap to change.
467
00:13:30,830 --> 00:13:32,070
Write down why each permission
468
00:13:32,070 --> 00:13:33,710
is required in one plain
469
00:13:33,710 --> 00:13:34,230
sentence.
470
00:13:34,230 --> 00:13:35,389
That short justification is
471
00:13:35,389 --> 00:13:36,669
often the difference between an
472
00:13:36,669 --> 00:13:38,110
approval that moves and one that
473
00:13:38,110 --> 00:13:38,750
sits.
474
00:13:38,750 --> 00:13:41,110
And it's also the thing you'll
want when the app gets reviewed
475
00:13:41,110 --> 00:13:42,190
six months later.
476
00:13:42,190 --> 00:13:44,470
The plumbing underneath is more
familiar than it sounds.
477
00:13:44,470 --> 00:13:47,070
The same permission model sits
under the Power Automate flows.
478
00:13:47,070 --> 00:13:49,509
You build the power apps
connectors you add, and the
479
00:13:49,509 --> 00:13:51,870
copilot agents you're starting
to spin up.
480
00:13:51,870 --> 00:13:53,029
So the habit travels with you
481
00:13:53,029 --> 00:13:54,309
across every tool in the
482
00:13:54,309 --> 00:13:55,370
platform.
483
00:13:55,370 --> 00:13:58,330
The order you do this in matters
more than the individual steps.
484
00:13:58,330 --> 00:14:01,210
Decide what the app needs, write
it down, get the approval
485
00:14:01,210 --> 00:14:04,169
conversation started, and only
then build the part that depends
486
00:14:04,169 --> 00:14:05,210
on the access.
487
00:14:05,210 --> 00:14:08,129
Teams that build first and ask
later spend their best weeks
488
00:14:08,129 --> 00:14:10,610
waiting on a consent screen
instead of shipping.
489
00:14:10,610 --> 00:14:11,730
Governance is what keeps the
490
00:14:11,730 --> 00:14:12,809
habit alive through a busy
491
00:14:12,809 --> 00:14:13,370
quarter.
492
00:14:13,370 --> 00:14:14,570
Pre-Approval workflows.
493
00:14:14,570 --> 00:14:15,809
Clear tags on each app.
494
00:14:15,809 --> 00:14:16,929
Audit logs that record who
495
00:14:16,929 --> 00:14:18,330
consented to what, and a
496
00:14:18,330 --> 00:14:19,570
periodic review of permissions
497
00:14:19,570 --> 00:14:20,929
that are no longer needed or
498
00:14:20,929 --> 00:14:21,850
keep an environment from
499
00:14:21,850 --> 00:14:23,230
drifting slowly into over
500
00:14:23,230 --> 00:14:24,289
permission.
501
00:14:24,289 --> 00:14:25,649
What to take away.
502
00:14:25,649 --> 00:14:26,570
That's the whole picture.
503
00:14:26,570 --> 00:14:28,450
In plain terms, a permission is
504
00:14:28,450 --> 00:14:29,970
the privilege Microsoft Graph
505
00:14:29,970 --> 00:14:31,409
demands before an app can touch
506
00:14:31,409 --> 00:14:32,370
your data.
507
00:14:32,370 --> 00:14:35,309
Delegated access acts as a
person, and application access
508
00:14:35,309 --> 00:14:36,929
acts as the app itself.
509
00:14:36,929 --> 00:14:39,289
The name on the permission tells
you exactly how far it can
510
00:14:39,289 --> 00:14:42,009
reach, and an administrator
holds the final yes.
511
00:14:42,009 --> 00:14:44,169
One question is worth sitting
with for a moment.
512
00:14:44,169 --> 00:14:45,409
If you opened your own tenant
513
00:14:45,409 --> 00:14:46,730
today, which apps permissions
514
00:14:46,730 --> 00:14:47,970
would you want to double check
515
00:14:47,970 --> 00:14:48,450
first?
516
00:14:48,450 --> 00:14:49,690
If this made the topic feel less
517
00:14:49,690 --> 00:14:51,929
intimidating, subscribe to M365
518
00:14:51,929 --> 00:14:53,690
FM to master the tools and the
519
00:14:53,690 --> 00:14:55,129
mindset shaping the future of
520
00:14:55,129 --> 00:14:55,730
work.
00:00:00,040 --> 00:00:03,279
Welcome to the M365 FM podcast,
where we explore the people,
2
00:00:03,279 --> 00:00:06,200
ideas and technologies shaping
the future of work.
3
00:00:06,200 --> 00:00:09,720
The checkpoint every app has to
pass one graph.
4
00:00:09,720 --> 00:00:12,199
Permission can hand an app every
mailbox in your company.
5
00:00:12,199 --> 00:00:13,519
Most people never notice that
6
00:00:13,519 --> 00:00:14,919
line until a security review
7
00:00:14,919 --> 00:00:16,280
points at it because the
8
00:00:16,280 --> 00:00:17,679
permission sits quietly inside
9
00:00:17,679 --> 00:00:19,239
an app somebody set up months
10
00:00:19,239 --> 00:00:19,879
ago.
11
00:00:19,879 --> 00:00:21,120
Microsoft Graph is the single
12
00:00:21,120 --> 00:00:22,379
doorway apps used to reach your
13
00:00:22,379 --> 00:00:23,920
mail, your files, your teams
14
00:00:23,920 --> 00:00:25,440
messages, and the people in your
15
00:00:25,440 --> 00:00:26,039
directory.
16
00:00:26,039 --> 00:00:28,559
And it won't open for anything
that wasn't granted permission.
17
00:00:28,559 --> 00:00:32,219
First, an app can ask in two
ways acting as a signed in
18
00:00:32,219 --> 00:00:35,280
person or acting as itself with
nobody in the room.
19
00:00:35,280 --> 00:00:38,640
And that choice decides whether
it touches one person's data or
20
00:00:38,640 --> 00:00:40,280
the whole organization.
21
00:00:40,280 --> 00:00:43,000
Most graph projects don't fall
apart because of code, and when
22
00:00:43,000 --> 00:00:45,679
they do fall apart, it's usually
at consent because somebody
23
00:00:45,679 --> 00:00:47,759
asked for far more access than
the job needed.
24
00:00:47,759 --> 00:00:48,880
By the end of this, you'll be
25
00:00:48,880 --> 00:00:50,399
able to read any permission name
26
00:00:50,399 --> 00:00:51,840
and know exactly what it lets an
27
00:00:51,840 --> 00:00:52,600
app do.
28
00:00:52,600 --> 00:00:54,320
What a graph permission actually
is.
29
00:00:54,320 --> 00:00:56,880
Microsoft Graph is one doorway
into almost everything your
30
00:00:56,880 --> 00:00:58,479
organization keeps in the cloud.
31
00:00:58,479 --> 00:00:59,640
Mail sits behind it.
32
00:00:59,640 --> 00:01:01,090
So do files and folders.
33
00:01:01,090 --> 00:01:02,570
So do teams conversations.
34
00:01:02,570 --> 00:01:03,810
And so does the directory that
35
00:01:03,810 --> 00:01:05,170
lists every account your company
36
00:01:05,170 --> 00:01:05,890
manages.
37
00:01:05,890 --> 00:01:08,769
Rather than learning a separate
door for each service, an app
38
00:01:08,769 --> 00:01:11,890
learns this one and asks for the
specific things it needs.
39
00:01:11,890 --> 00:01:13,129
A permission is the privilege an
40
00:01:13,129 --> 00:01:14,250
app has been granted before
41
00:01:14,250 --> 00:01:15,769
graph hands over anything at
42
00:01:15,769 --> 00:01:16,370
all.
43
00:01:16,370 --> 00:01:18,450
When an app asks for data, it
wasn't granted.
44
00:01:18,450 --> 00:01:19,810
Graph refuses the request and
45
00:01:19,810 --> 00:01:21,049
returns an error instead of the
46
00:01:21,049 --> 00:01:21,530
answer.
47
00:01:21,530 --> 00:01:23,769
The permission name is what's
printed on the key card, and
48
00:01:23,769 --> 00:01:26,010
that card decides which doors
open for that app.
49
00:01:26,010 --> 00:01:28,370
Being signed in and being
permitted are two separate
50
00:01:28,370 --> 00:01:31,049
gates, and beginners blur them
together all the time.
51
00:01:31,049 --> 00:01:33,489
A person can be signed in and
still see nothing, because the
52
00:01:33,489 --> 00:01:35,409
app was never granted the
permission that matches the
53
00:01:35,409 --> 00:01:38,329
request, and no amount of
logging in again will fix it.
54
00:01:38,329 --> 00:01:41,370
What makes this one model worth
learning is how far it reaches.
55
00:01:41,370 --> 00:01:43,609
The same permission system
covers exchange, mail,
56
00:01:43,609 --> 00:01:47,010
SharePoint, and OneDrive files,
teams, and the users and groups.
57
00:01:47,010 --> 00:01:49,609
In Microsoft Entra ID, that
means a single permission name
58
00:01:49,609 --> 00:01:52,129
can decide how far an app
travels across all of it.
59
00:01:52,129 --> 00:01:54,129
It's also why the name deserves
a second look.
60
00:01:54,129 --> 00:01:55,209
Say you build a small app that
61
00:01:55,209 --> 00:01:56,510
greets people by name when they
62
00:01:56,510 --> 00:01:57,170
sign in.
63
00:01:57,170 --> 00:01:58,290
It needs to read a bit of the
64
00:01:58,290 --> 00:01:59,980
signed in user's profile and
65
00:01:59,980 --> 00:02:00,790
nothing more.
66
00:02:00,790 --> 00:02:02,150
So it asks for one narrow
67
00:02:02,150 --> 00:02:03,709
permission that covers exactly
68
00:02:03,709 --> 00:02:03,950
that.
69
00:02:03,950 --> 00:02:06,310
If it instead asks for
permission to change every
70
00:02:06,310 --> 00:02:09,030
profile in the company, the
request would still work.
71
00:02:09,030 --> 00:02:11,770
And that gap between what the
app needs and what it asked for
72
00:02:11,770 --> 00:02:13,310
is where trouble lives.
73
00:02:13,310 --> 00:02:15,789
Microsoft doesn't make you guess
at any of this.
74
00:02:15,789 --> 00:02:18,430
Every permission in graph is
documented, named in a
75
00:02:18,430 --> 00:02:21,150
consistent way and grouped by
the resource it touches.
76
00:02:21,150 --> 00:02:22,389
So you can look one up and read
77
00:02:22,389 --> 00:02:23,789
what it allows before you ever
78
00:02:23,789 --> 00:02:24,669
approve it.
79
00:02:24,669 --> 00:02:26,750
The vocabulary is smaller than
it looks, too.
80
00:02:26,750 --> 00:02:30,150
There are permissions for mail,
calendars, files, groups, users,
81
00:02:30,150 --> 00:02:33,030
and the apps themselves, and
they all follow the same shape.
82
00:02:33,030 --> 00:02:35,349
So learning one teaches you how
to read the rest.
83
00:02:35,349 --> 00:02:38,069
The other thing worth knowing
early is that a permission is
84
00:02:38,069 --> 00:02:41,349
attached to an app, rather than
to a person or a device.
85
00:02:41,349 --> 00:02:44,110
Two people using the same app
share the app's permissions, and
86
00:02:44,110 --> 00:02:46,229
when the app was granted
something broad, both of them
87
00:02:46,229 --> 00:02:48,030
inherit that reach the moment
they sign in.
88
00:02:48,030 --> 00:02:50,509
There's one small word inside
these names that decides whether
89
00:02:50,509 --> 00:02:53,750
an app touches a single person's
data or everyone's, and we'll
90
00:02:53,750 --> 00:02:55,629
come back to it in a moment.
91
00:02:55,629 --> 00:02:57,110
The two kinds of permission.
92
00:02:57,110 --> 00:02:59,270
Nobody separates at first graph
93
00:02:59,270 --> 00:03:00,599
gives an AB two completely
94
00:03:00,599 --> 00:03:01,840
different ways to ask, and
95
00:03:01,840 --> 00:03:03,120
almost everything else about
96
00:03:03,120 --> 00:03:04,759
permissions flows from that one
97
00:03:04,759 --> 00:03:05,599
split.
98
00:03:05,599 --> 00:03:07,840
The first way is called
delegated access, and it means
99
00:03:07,840 --> 00:03:10,479
the app calls graph on behalf of
a signed in user.
100
00:03:10,479 --> 00:03:13,000
The app borrows that person's
identity for the moment of the
101
00:03:13,000 --> 00:03:16,159
request, and it can never reach
past what that person can
102
00:03:16,159 --> 00:03:17,680
already reach on their own.
103
00:03:17,680 --> 00:03:19,120
If your account can't open a
104
00:03:19,120 --> 00:03:20,919
particular folder, an app acting
105
00:03:20,919 --> 00:03:22,400
as you can't open it either, no
106
00:03:22,400 --> 00:03:23,439
matter which permissions it
107
00:03:23,439 --> 00:03:24,000
holds.
108
00:03:24,000 --> 00:03:25,719
The second way is called
Application Access.
109
00:03:25,719 --> 00:03:27,879
And here the app calls graph as
itself.
110
00:03:27,879 --> 00:03:29,240
With nobody signed in at all.
111
00:03:29,240 --> 00:03:31,639
There's no person to borrow an
identity from, so the app's own
112
00:03:31,639 --> 00:03:34,060
permissions are the only limit,
and that limit can stretch
113
00:03:34,060 --> 00:03:35,520
across the whole organization.
114
00:03:35,520 --> 00:03:36,759
Microsoft's own documentation
115
00:03:36,759 --> 00:03:38,000
gives a blunt example, because
116
00:03:38,000 --> 00:03:40,520
an app holding the files read
117
00:03:40,520 --> 00:03:42,080
all application permission can
118
00:03:42,080 --> 00:03:42,960
read any file in the
119
00:03:42,960 --> 00:03:44,680
organization, not one person's
120
00:03:44,680 --> 00:03:45,080
files.
121
00:03:45,080 --> 00:03:45,800
All of them.
122
00:03:45,800 --> 00:03:47,080
What surprises people here is
123
00:03:47,080 --> 00:03:48,520
the overlap in the delegated
124
00:03:48,520 --> 00:03:49,000
model.
125
00:03:49,000 --> 00:03:50,360
The app's real access is the
126
00:03:50,360 --> 00:03:51,639
intersection of two things the
127
00:03:51,639 --> 00:03:53,240
permissions it was granted, and
128
00:03:53,240 --> 00:03:54,479
whatever the signed in user
129
00:03:54,479 --> 00:03:55,639
already had.
130
00:03:55,639 --> 00:03:58,240
Both limits apply at the same
time, so a generous permission
131
00:03:58,240 --> 00:04:00,699
handed to an app doesn't widen
what the person can see.
132
00:04:00,699 --> 00:04:03,340
That overlap is the reason
delegated access is treated as
133
00:04:03,340 --> 00:04:06,340
the safer default, and Microsoft
says so, directly calling it the
134
00:04:06,340 --> 00:04:08,740
recommended approach whenever it
meets the app's needs.
135
00:04:08,740 --> 00:04:10,979
The instinct that flips here is
worth naming.
136
00:04:10,979 --> 00:04:12,199
You might think asking for more
137
00:04:12,199 --> 00:04:13,699
is the safe move, but the app
138
00:04:13,699 --> 00:04:14,979
only model is actually the one
139
00:04:14,979 --> 00:04:15,979
that reaches your entire
140
00:04:15,979 --> 00:04:17,459
company, and it's the one that
141
00:04:17,459 --> 00:04:18,819
triggers the loudest consent
142
00:04:18,819 --> 00:04:19,899
prompt.
143
00:04:19,899 --> 00:04:22,980
Asking for everything points
straight at the riskiest option.
144
00:04:22,980 --> 00:04:25,540
The better question is never how
much access makes this easy.
145
00:04:25,540 --> 00:04:27,300
It's how little access makes
this work.
146
00:04:27,300 --> 00:04:28,220
This split also answers
147
00:04:28,220 --> 00:04:29,180
something you may have wondered
148
00:04:29,180 --> 00:04:30,420
about, which is why the same app
149
00:04:30,420 --> 00:04:31,579
sometimes asks you to sign in
150
00:04:31,579 --> 00:04:32,540
and sometimes asks an
151
00:04:32,540 --> 00:04:33,740
administrator instead.
152
00:04:33,740 --> 00:04:36,019
The model it chose decides who
gets asked.
153
00:04:36,019 --> 00:04:37,100
The practical version of the
154
00:04:37,100 --> 00:04:38,139
split comes down to one
155
00:04:38,139 --> 00:04:38,579
question.
156
00:04:38,579 --> 00:04:40,579
If a person has to be present
for the work to happen,
157
00:04:40,579 --> 00:04:43,500
delegated access usually fits if
the work has to happen while
158
00:04:43,500 --> 00:04:46,459
everyone is asleep, application
access is the only option, and
159
00:04:46,459 --> 00:04:49,019
that's the moment to slow down
and ask what the smallest
160
00:04:49,019 --> 00:04:50,579
version of it looks like.
161
00:04:50,579 --> 00:04:52,740
How to read a permission name
like a sentence.
162
00:04:52,740 --> 00:04:55,319
Every graph permission name
follows the same three part
163
00:04:55,319 --> 00:04:57,379
shape, and once you see it, you
can't unsee it.
164
00:04:57,379 --> 00:04:58,584
The first part names the
165
00:04:58,584 --> 00:04:59,810
resource, the thing being
166
00:04:59,810 --> 00:05:00,430
touched.
167
00:05:00,430 --> 00:05:01,430
The second part names the
168
00:05:01,430 --> 00:05:02,949
operation usually read or read
169
00:05:02,949 --> 00:05:03,629
and write.
170
00:05:03,629 --> 00:05:06,350
The third part is the constraint
and it's optional, which is the
171
00:05:06,350 --> 00:05:07,709
detail that matters most.
172
00:05:07,709 --> 00:05:09,990
Read a few out loud and the
patent shows up fast.
173
00:05:09,990 --> 00:05:11,509
User dot read lets an app read
174
00:05:11,509 --> 00:05:12,589
the signed in user's own
175
00:05:12,589 --> 00:05:13,470
profile.
176
00:05:13,470 --> 00:05:14,870
Group A create is for making new
177
00:05:14,870 --> 00:05:16,029
groups, though not changing or
178
00:05:16,029 --> 00:05:16,949
deleting them.
179
00:05:16,949 --> 00:05:17,949
Application.
180
00:05:17,949 --> 00:05:18,310
Read.
181
00:05:18,310 --> 00:05:22,230
Write all reaches every app in
the tenant while application
182
00:05:22,230 --> 00:05:26,509
read write owned by shrinks that
to only the apps the app itself
183
00:05:26,509 --> 00:05:28,350
created or owns.
184
00:05:28,350 --> 00:05:30,910
The constraint is where the
reach lives, and it comes in a
185
00:05:30,910 --> 00:05:31,949
small set of words.
186
00:05:31,949 --> 00:05:34,709
All means the whole organization
owned by narrows things to what
187
00:05:34,709 --> 00:05:35,990
the app owns.
188
00:05:35,990 --> 00:05:39,730
Selected, shared, hidden and app
folder each tighten the scope in
189
00:05:39,730 --> 00:05:40,670
their own way.
190
00:05:40,670 --> 00:05:43,149
The payoff of that flagged word
arrives right here.
191
00:05:43,149 --> 00:05:44,990
When a permission carries no
constraint at all.
192
00:05:44,990 --> 00:05:47,110
The default is that one person's
own data.
193
00:05:47,110 --> 00:05:48,670
That's why user read reads u
194
00:05:48,670 --> 00:05:50,629
while user read all reads
195
00:05:50,629 --> 00:05:51,069
everyone.
196
00:05:51,069 --> 00:05:53,790
And the missing word is doing an
enormous amount of work on a
197
00:05:53,790 --> 00:05:55,149
screen that's easy to skim.
198
00:05:55,149 --> 00:05:56,790
One honest limit belongs here
199
00:05:56,790 --> 00:05:58,339
because names describe intent,
200
00:05:58,339 --> 00:05:59,569
and intent isn't always the
201
00:05:59,569 --> 00:06:00,449
whole story.
202
00:06:00,449 --> 00:06:03,810
Microsoft's own materials note
that names like mail, read,
203
00:06:03,810 --> 00:06:08,170
write, and sites dot full
control all imply broad reach,
204
00:06:08,170 --> 00:06:11,209
and the practical advice is to
test in a safe tenant rather
205
00:06:11,209 --> 00:06:12,889
than trusting the label alone.
206
00:06:12,889 --> 00:06:16,089
This is the skill that changes
how you read a consent screen.
207
00:06:16,089 --> 00:06:17,370
Instead of seeing a wall of
208
00:06:17,370 --> 00:06:18,850
unfamiliar names, you start
209
00:06:18,850 --> 00:06:20,250
seeing sentences and the
210
00:06:20,250 --> 00:06:21,329
sentence tells you who is
211
00:06:21,329 --> 00:06:22,730
affected and how far the app can
212
00:06:22,730 --> 00:06:23,209
go.
213
00:06:23,209 --> 00:06:24,529
The name stay consistent across
214
00:06:24,529 --> 00:06:25,889
the whole service, so the effort
215
00:06:25,889 --> 00:06:27,129
you spend learning this shape
216
00:06:27,129 --> 00:06:28,449
pays off everywhere, and none of
217
00:06:28,449 --> 00:06:29,610
it asks you to memorize a
218
00:06:29,610 --> 00:06:30,769
separate dictionary.
219
00:06:30,769 --> 00:06:33,290
You'll also notice the names are
specific enough to argue with
220
00:06:33,290 --> 00:06:34,329
which is the point.
221
00:06:34,329 --> 00:06:35,769
A permission that says all is
222
00:06:35,769 --> 00:06:36,930
telling you in plain language
223
00:06:36,930 --> 00:06:38,170
that it crosses every part of
224
00:06:38,170 --> 00:06:39,449
the organization, so nobody can
225
00:06:39,449 --> 00:06:40,490
claim the reach came as a
226
00:06:40,490 --> 00:06:41,250
surprise.
227
00:06:41,250 --> 00:06:43,889
If a name feels too broad for
the job, it usually is, and
228
00:06:43,889 --> 00:06:48,329
there's almost always a smaller
one nearby who gets to say yes.
229
00:06:48,329 --> 00:06:50,730
Reading the name tells you what
an app wants.
230
00:06:50,730 --> 00:06:52,850
It doesn't tell you who's
allowed to hand it over.
231
00:06:52,850 --> 00:06:54,610
And that second question has its
232
00:06:54,610 --> 00:06:56,129
own set of rules for delegated
233
00:06:56,129 --> 00:06:56,649
permissions.
234
00:06:56,649 --> 00:06:58,459
The answer is fairly forgiving.
235
00:06:58,459 --> 00:06:59,660
A person can consent for their
236
00:06:59,660 --> 00:07:01,259
own data, which is why a small
237
00:07:01,259 --> 00:07:02,459
app can ask you to approve a
238
00:07:02,459 --> 00:07:03,639
narrow permission the moment you
239
00:07:03,639 --> 00:07:04,339
sign in.
240
00:07:04,339 --> 00:07:06,899
An administrator can also
consent on behalf of everyone at
241
00:07:06,899 --> 00:07:09,540
once, which helps when you'd
rather not make every colleague
242
00:07:09,540 --> 00:07:12,259
click through the same prompt
for application permissions, the
243
00:07:12,259 --> 00:07:13,740
door narrows sharply.
244
00:07:13,740 --> 00:07:16,220
Only an administrator can
consent, and Microsoft is
245
00:07:16,220 --> 00:07:18,939
specific about which ones
privileged role administrator
246
00:07:18,939 --> 00:07:22,259
and global administrator are the
two roles that can grant an app.
247
00:07:22,259 --> 00:07:23,980
The app only permissions it's
asking for.
248
00:07:23,980 --> 00:07:25,060
If you've ever watched a rollout
249
00:07:25,060 --> 00:07:26,339
stall while everyone waited on
250
00:07:26,339 --> 00:07:27,920
one person, this is usually why
251
00:07:27,920 --> 00:07:29,100
there's also a convenience
252
00:07:29,100 --> 00:07:30,560
feature that's easy to overlook,
253
00:07:30,560 --> 00:07:32,060
called tenant wide admin
254
00:07:32,060 --> 00:07:32,939
consent.
255
00:07:32,939 --> 00:07:35,540
An administrator approves an app
once for everyone, and after
256
00:07:35,540 --> 00:07:37,860
that, people aren't nagged with
prompts when they sign in, it
257
00:07:37,860 --> 00:07:40,939
removes friction, and it also
means the approval decision gets
258
00:07:40,939 --> 00:07:43,779
made far away from the people
who'll actually use the thing.
259
00:07:43,779 --> 00:07:45,160
One more gate sits on top of all
260
00:07:45,160 --> 00:07:46,259
of this, and it belongs to your
261
00:07:46,259 --> 00:07:47,540
own organization.
262
00:07:47,540 --> 00:07:49,839
Even when a permission
technically allows a user to
263
00:07:49,839 --> 00:07:53,220
consent, your tenant's app,
consent policies can restrict or
264
00:07:53,220 --> 00:07:56,139
block that, and plenty of
organizations do exactly that.
265
00:07:56,139 --> 00:07:57,300
A permission can be perfectly
266
00:07:57,300 --> 00:07:59,120
valid on paper and still stop at
267
00:07:59,120 --> 00:08:00,120
a policy someone set
268
00:08:00,120 --> 00:08:00,959
deliberately.
269
00:08:00,959 --> 00:08:03,639
The moment of consent is worth
watching closely, because it's
270
00:08:03,639 --> 00:08:06,240
the clearest view you'll ever
get of what an app can do.
271
00:08:06,240 --> 00:08:08,879
The prompt lists the permissions
in plain language, and a
272
00:08:08,879 --> 00:08:11,639
delegated request reads like a
request to act as you.
273
00:08:11,639 --> 00:08:13,839
While an application request
reads like a request to act
274
00:08:13,839 --> 00:08:16,600
across everyone reading that
screen instead of clicking past.
275
00:08:16,600 --> 00:08:18,720
It is the cheapest security
habit there is.
276
00:08:18,720 --> 00:08:20,079
This is why the same app can
277
00:08:20,079 --> 00:08:21,439
install smoothly in a test
278
00:08:21,439 --> 00:08:23,079
tenant and grind to a halt in a
279
00:08:23,079 --> 00:08:23,519
real one.
280
00:08:23,519 --> 00:08:24,600
Test tenants tend to leave
281
00:08:24,600 --> 00:08:25,879
consent open, and production
282
00:08:25,879 --> 00:08:27,439
tenants tend to close it, so the
283
00:08:27,439 --> 00:08:29,000
app's success has less to do
284
00:08:29,000 --> 00:08:30,439
with the app than with the rules
285
00:08:30,439 --> 00:08:31,079
around it.
286
00:08:31,079 --> 00:08:33,480
Once the approval is in hand,
the next question is how big
287
00:08:33,480 --> 00:08:34,360
that approval should be.
288
00:08:34,360 --> 00:08:37,840
And that's where most projects
get themselves into trouble.
289
00:08:37,840 --> 00:08:39,679
The trap of asking for too much.
290
00:08:39,679 --> 00:08:41,600
Everything so far leads to one
291
00:08:41,600 --> 00:08:43,279
habit that separates a smooth
292
00:08:43,279 --> 00:08:44,960
rollout from a painful one, and
293
00:08:44,960 --> 00:08:46,740
Microsoft states it plainly
294
00:08:46,740 --> 00:08:48,039
grant the app the minimum
295
00:08:48,039 --> 00:08:49,200
permission it needs for the
296
00:08:49,200 --> 00:08:50,840
operation, and nothing beyond
297
00:08:50,840 --> 00:08:51,360
that.
298
00:08:51,360 --> 00:08:53,639
Microsoft's own examples make
the Gap concrete.
299
00:08:53,639 --> 00:08:57,044
An app that reads the signed in
user's profile, needs only user
300
00:08:57,044 --> 00:08:58,090
read and handing it.
301
00:08:58,090 --> 00:09:00,769
User read write makes it
overprivileged because the app
302
00:09:00,769 --> 00:09:02,330
never needs to change anything.
303
00:09:02,330 --> 00:09:03,529
Reading groups without a signed
304
00:09:03,529 --> 00:09:05,389
in user needs only group member
305
00:09:05,389 --> 00:09:06,370
read all.
306
00:09:06,370 --> 00:09:07,750
A calendar that's only ever read
307
00:09:07,750 --> 00:09:09,490
needs calendars read while
308
00:09:09,490 --> 00:09:09,929
calendars.
309
00:09:09,929 --> 00:09:12,570
Read write belongs to apps that
actually schedule something.
310
00:09:12,570 --> 00:09:14,929
The real tension here is what
happens when you ignore it
311
00:09:14,929 --> 00:09:17,970
because the cost is documented
rather than theoretical.
312
00:09:17,970 --> 00:09:19,529
Granting an app more privileges
313
00:09:19,529 --> 00:09:21,370
than it needs is a poor security
314
00:09:21,370 --> 00:09:22,970
practice, in Microsoft's words,
315
00:09:22,970 --> 00:09:24,169
because it raises the app's
316
00:09:24,169 --> 00:09:25,690
exposure to unauthorized and
317
00:09:25,690 --> 00:09:26,970
unintended access.
318
00:09:26,970 --> 00:09:29,929
The same overreach carries a
second cost that hits adoption.
319
00:09:29,929 --> 00:09:31,049
Since asking for more than
320
00:09:31,049 --> 00:09:32,470
necessary makes people refuse to
321
00:09:32,470 --> 00:09:34,669
consent, and a refused consent
322
00:09:34,669 --> 00:09:36,289
screen ends the rollout right
323
00:09:36,289 --> 00:09:36,690
there.
324
00:09:36,690 --> 00:09:39,289
There's a hard ceiling to which
surprises people who assume
325
00:09:39,289 --> 00:09:40,730
permissions are unlimited.
326
00:09:40,730 --> 00:09:44,009
Microsoft Entry ID caps an app
at four hundred permissions, and
327
00:09:44,009 --> 00:09:46,250
no more than four hundred of
those can be graph permissions
328
00:09:46,250 --> 00:09:47,529
for work and school apps.
329
00:09:47,529 --> 00:09:49,850
Personal Microsoft Account apps
are capped at thirty.
330
00:09:49,850 --> 00:09:52,649
If you are picturing an endless
menu, it isn't one picture how
331
00:09:52,649 --> 00:09:53,889
this plays out in practice.
332
00:09:53,889 --> 00:09:55,289
A team wants SharePoint data for
333
00:09:55,289 --> 00:09:56,779
a quarterly report and asks for
334
00:09:56,779 --> 00:09:58,389
access to every site and the
335
00:09:58,389 --> 00:09:59,830
request lands in security review
336
00:09:59,830 --> 00:10:00,389
and stops.
337
00:10:00,389 --> 00:10:02,870
They trim the list down to the
sites they actually read.
338
00:10:02,870 --> 00:10:04,110
Attach a short note explaining
339
00:10:04,110 --> 00:10:05,429
why each one is needed, and the
340
00:10:05,429 --> 00:10:06,789
approval moves in a fraction of
341
00:10:06,789 --> 00:10:07,429
the time.
342
00:10:07,429 --> 00:10:09,870
The permission list was the
whole problem, and it was the
343
00:10:09,870 --> 00:10:11,549
one part they controlled.
344
00:10:11,549 --> 00:10:13,669
The lesson is unglamorous and it
works.
345
00:10:13,669 --> 00:10:15,029
Ask for what the app does today
346
00:10:15,029 --> 00:10:16,269
rather than for what it might do
347
00:10:16,269 --> 00:10:16,909
someday.
348
00:10:16,909 --> 00:10:18,110
Because every extra permission
349
00:10:18,110 --> 00:10:19,250
is a question somebody has to
350
00:10:19,250 --> 00:10:20,409
answer before you're allowed to
351
00:10:20,409 --> 00:10:21,029
ship.
352
00:10:21,029 --> 00:10:23,509
There's a simple test you can
run on any permissionless before
353
00:10:23,509 --> 00:10:24,830
you send it for approval.
354
00:10:24,830 --> 00:10:26,149
For each permission, name the
355
00:10:26,149 --> 00:10:27,429
exact feature that breaks
356
00:10:27,429 --> 00:10:28,269
without it.
357
00:10:28,269 --> 00:10:31,149
If you can't name one, that
permission is a wish rather than
358
00:10:31,149 --> 00:10:33,710
a requirement, and it's the
first thing a reviewer will ask
359
00:10:33,710 --> 00:10:35,269
you to justify.
360
00:10:35,269 --> 00:10:36,590
Where this breaks down.
361
00:10:36,590 --> 00:10:39,029
Careful permission choices get
you most of the way, and they
362
00:10:39,029 --> 00:10:40,509
don't remove every wall.
363
00:10:40,509 --> 00:10:41,950
Some limits belong to the system
364
00:10:41,950 --> 00:10:43,549
itself, and knowing them early
365
00:10:43,549 --> 00:10:44,750
saves a confusing afternoon
366
00:10:44,750 --> 00:10:45,309
later.
367
00:10:45,309 --> 00:10:47,950
The first of them is easy to
misread, and it wastes the most
368
00:10:47,950 --> 00:10:50,909
time when an app asks for the
members of a group graph, can
369
00:10:50,909 --> 00:10:53,870
answer with a success code and
still hand back almost nothing.
370
00:10:53,870 --> 00:10:56,274
Members whose type the app isn't
permitted to read come back with
371
00:10:56,274 --> 00:10:59,080
little more than an identifier
and their real properties arrive
372
00:10:59,080 --> 00:11:00,080
as empty values.
373
00:11:00,080 --> 00:11:01,559
The request succeeded, and the
374
00:11:01,559 --> 00:11:02,960
data simply isn't there, which
375
00:11:02,960 --> 00:11:04,340
is why the failure is so easy to
376
00:11:04,340 --> 00:11:04,960
miss.
377
00:11:04,960 --> 00:11:07,320
Then there are the permissions
that carry the most weight
378
00:11:07,320 --> 00:11:10,320
directory access as user, all is
the highest privilege.
379
00:11:10,320 --> 00:11:11,679
Delegated permission in graph,
380
00:11:11,679 --> 00:11:12,720
and it reaches nearly every
381
00:11:12,720 --> 00:11:14,159
operation across Microsoft entra
382
00:11:14,159 --> 00:11:15,200
ID directory.
383
00:11:15,200 --> 00:11:16,799
Read write all ranked second and
384
00:11:16,799 --> 00:11:18,360
directory read all is the
385
00:11:18,360 --> 00:11:18,759
strongest.
386
00:11:18,759 --> 00:11:20,879
Read only permission in that
same space.
387
00:11:20,879 --> 00:11:23,559
Microsoft's guidance on all
three is to use them only when
388
00:11:23,559 --> 00:11:24,919
nothing smaller will do.
389
00:11:24,919 --> 00:11:26,039
A narrower option exists for
390
00:11:26,039 --> 00:11:27,279
some situations, and it deserves
391
00:11:27,279 --> 00:11:28,240
a name.
392
00:11:28,240 --> 00:11:31,120
Resource specific consent grants
an app access to one instance of
393
00:11:31,120 --> 00:11:33,840
a resource, like a single team
or a single chat, instead of
394
00:11:33,840 --> 00:11:35,120
every instance in the tenant.
395
00:11:35,120 --> 00:11:36,519
It's supported for a subset of
396
00:11:36,519 --> 00:11:38,059
features such as teams, chats,
397
00:11:38,059 --> 00:11:39,360
and messages, and it's the
398
00:11:39,360 --> 00:11:40,720
closest thing to a scalpel in a
399
00:11:40,720 --> 00:11:41,960
model that often feels like a
400
00:11:41,960 --> 00:11:42,480
hammer.
401
00:11:42,480 --> 00:11:44,639
Scale brings its own pushback
because graph slows you down
402
00:11:44,639 --> 00:11:45,759
when you ask to fast.
403
00:11:45,759 --> 00:11:48,519
When an app exceeds the limits,
graph returns a throttling error
404
00:11:48,519 --> 00:11:51,179
instead of the data, and the
global ceiling is one hundred
405
00:11:51,179 --> 00:11:54,480
and thirty thousand requests per
10s per app across all tenants
406
00:11:54,480 --> 00:11:57,460
with tighter limits underneath
for individual services.
407
00:11:57,460 --> 00:11:58,720
The fix is to read the retry
408
00:11:58,720 --> 00:12:00,100
after header, wait the amount of
409
00:12:00,100 --> 00:12:01,779
time it names and slow down
410
00:12:01,779 --> 00:12:02,740
rather than hammering the
411
00:12:02,740 --> 00:12:03,460
endpoint.
412
00:12:03,460 --> 00:12:04,580
The newest wrinkle points in a
413
00:12:04,580 --> 00:12:05,779
promising direction for
414
00:12:05,779 --> 00:12:07,580
Microsoft Entra Agent ID some
415
00:12:07,580 --> 00:12:09,019
high risk graph permissions are
416
00:12:09,019 --> 00:12:10,580
blocked outright and can't be
417
00:12:10,580 --> 00:12:12,019
granted to agent identities at
418
00:12:12,019 --> 00:12:13,139
all, which tells you the
419
00:12:13,139 --> 00:12:14,320
platform is moving toward
420
00:12:14,320 --> 00:12:15,620
tighter defaults rather than
421
00:12:15,620 --> 00:12:16,940
looser ones.
422
00:12:16,940 --> 00:12:18,340
None of these limits are reasons
423
00:12:18,340 --> 00:12:19,740
to avoid graph, and they're the
424
00:12:19,740 --> 00:12:20,899
reasons so much of this gets
425
00:12:20,899 --> 00:12:21,919
documented rather than
426
00:12:21,919 --> 00:12:23,299
discovered the hard way the
427
00:12:23,299 --> 00:12:24,340
system tells you when it
428
00:12:24,340 --> 00:12:25,700
throttles, it documents its
429
00:12:25,700 --> 00:12:27,220
privilege rankings, and it flags
430
00:12:27,220 --> 00:12:28,379
the permissions it considers
431
00:12:28,379 --> 00:12:28,899
risky.
432
00:12:28,899 --> 00:12:30,779
So most of the surprises are
avoidable.
433
00:12:30,779 --> 00:12:33,179
If you read first how this fits
434
00:12:33,179 --> 00:12:34,379
into your Microsoft three
435
00:12:34,379 --> 00:12:35,700
hundred sixty five and Azure
436
00:12:35,700 --> 00:12:36,379
World.
437
00:12:36,379 --> 00:12:39,740
All of this lives in a place you
may already recognize.
438
00:12:39,740 --> 00:12:42,820
The app itself is registered in
Microsoft Entra ID, and the
439
00:12:42,820 --> 00:12:45,100
consent it received is recorded
there as a grant.
440
00:12:45,100 --> 00:12:46,820
While the mail files and team's
441
00:12:46,820 --> 00:12:48,659
data sit behind the door in the
442
00:12:48,659 --> 00:12:49,820
Microsoft three hundred sixty
443
00:12:49,820 --> 00:12:51,460
five and Azure services you use
444
00:12:51,460 --> 00:12:52,419
every day.
445
00:12:52,419 --> 00:12:53,740
When someone asks who approved
446
00:12:53,740 --> 00:12:55,164
an app, entra ID holds the
447
00:12:55,164 --> 00:12:56,590
answer with that picture in
448
00:12:56,590 --> 00:12:57,149
place.
449
00:12:57,149 --> 00:12:59,990
A few habits turn the theory
into something workable.
450
00:12:59,990 --> 00:13:01,190
Keep user facing data on
451
00:13:01,190 --> 00:13:02,350
delegated permissions wherever
452
00:13:02,350 --> 00:13:03,149
you can.
453
00:13:03,149 --> 00:13:05,950
Reserve the app only model for
the jobs that genuinely run
454
00:13:05,950 --> 00:13:08,950
unattended, like a nightly sync
with nobody at the keyboard.
455
00:13:08,950 --> 00:13:11,429
Map out the permissions your
project needs before you build,
456
00:13:11,429 --> 00:13:14,029
because discovering them during
a security review is the slowest
457
00:13:14,029 --> 00:13:15,470
possible time to learn them.
458
00:13:15,470 --> 00:13:17,230
Staging helps to pilot with a
459
00:13:17,230 --> 00:13:18,629
small group of people first,
460
00:13:18,629 --> 00:13:19,909
show them what each permission
461
00:13:19,909 --> 00:13:21,169
does and what the app can never
462
00:13:21,169 --> 00:13:21,509
see.
463
00:13:21,509 --> 00:13:24,509
Then widen the audience once the
first group is comfortable.
464
00:13:24,509 --> 00:13:27,230
That approach builds advocates
instead of objections, and it
465
00:13:27,230 --> 00:13:29,629
gives you a chance to catch an
overbroad request while it's
466
00:13:29,629 --> 00:13:30,830
still cheap to change.
467
00:13:30,830 --> 00:13:32,070
Write down why each permission
468
00:13:32,070 --> 00:13:33,710
is required in one plain
469
00:13:33,710 --> 00:13:34,230
sentence.
470
00:13:34,230 --> 00:13:35,389
That short justification is
471
00:13:35,389 --> 00:13:36,669
often the difference between an
472
00:13:36,669 --> 00:13:38,110
approval that moves and one that
473
00:13:38,110 --> 00:13:38,750
sits.
474
00:13:38,750 --> 00:13:41,110
And it's also the thing you'll
want when the app gets reviewed
475
00:13:41,110 --> 00:13:42,190
six months later.
476
00:13:42,190 --> 00:13:44,470
The plumbing underneath is more
familiar than it sounds.
477
00:13:44,470 --> 00:13:47,070
The same permission model sits
under the Power Automate flows.
478
00:13:47,070 --> 00:13:49,509
You build the power apps
connectors you add, and the
479
00:13:49,509 --> 00:13:51,870
copilot agents you're starting
to spin up.
480
00:13:51,870 --> 00:13:53,029
So the habit travels with you
481
00:13:53,029 --> 00:13:54,309
across every tool in the
482
00:13:54,309 --> 00:13:55,370
platform.
483
00:13:55,370 --> 00:13:58,330
The order you do this in matters
more than the individual steps.
484
00:13:58,330 --> 00:14:01,210
Decide what the app needs, write
it down, get the approval
485
00:14:01,210 --> 00:14:04,169
conversation started, and only
then build the part that depends
486
00:14:04,169 --> 00:14:05,210
on the access.
487
00:14:05,210 --> 00:14:08,129
Teams that build first and ask
later spend their best weeks
488
00:14:08,129 --> 00:14:10,610
waiting on a consent screen
instead of shipping.
489
00:14:10,610 --> 00:14:11,730
Governance is what keeps the
490
00:14:11,730 --> 00:14:12,809
habit alive through a busy
491
00:14:12,809 --> 00:14:13,370
quarter.
492
00:14:13,370 --> 00:14:14,570
Pre-Approval workflows.
493
00:14:14,570 --> 00:14:15,809
Clear tags on each app.
494
00:14:15,809 --> 00:14:16,929
Audit logs that record who
495
00:14:16,929 --> 00:14:18,330
consented to what, and a
496
00:14:18,330 --> 00:14:19,570
periodic review of permissions
497
00:14:19,570 --> 00:14:20,929
that are no longer needed or
498
00:14:20,929 --> 00:14:21,850
keep an environment from
499
00:14:21,850 --> 00:14:23,230
drifting slowly into over
500
00:14:23,230 --> 00:14:24,289
permission.
501
00:14:24,289 --> 00:14:25,649
What to take away.
502
00:14:25,649 --> 00:14:26,570
That's the whole picture.
503
00:14:26,570 --> 00:14:28,450
In plain terms, a permission is
504
00:14:28,450 --> 00:14:29,970
the privilege Microsoft Graph
505
00:14:29,970 --> 00:14:31,409
demands before an app can touch
506
00:14:31,409 --> 00:14:32,370
your data.
507
00:14:32,370 --> 00:14:35,309
Delegated access acts as a
person, and application access
508
00:14:35,309 --> 00:14:36,929
acts as the app itself.
509
00:14:36,929 --> 00:14:39,289
The name on the permission tells
you exactly how far it can
510
00:14:39,289 --> 00:14:42,009
reach, and an administrator
holds the final yes.
511
00:14:42,009 --> 00:14:44,169
One question is worth sitting
with for a moment.
512
00:14:44,169 --> 00:14:45,409
If you opened your own tenant
513
00:14:45,409 --> 00:14:46,730
today, which apps permissions
514
00:14:46,730 --> 00:14:47,970
would you want to double check
515
00:14:47,970 --> 00:14:48,450
first?
516
00:14:48,450 --> 00:14:49,690
If this made the topic feel less
517
00:14:49,690 --> 00:14:51,929
intimidating, subscribe to M365
518
00:14:51,929 --> 00:14:53,690
FM to master the tools and the
519
00:14:53,690 --> 00:14:55,129
mindset shaping the future of
520
00:14:55,129 --> 00:14:55,730
work.
