{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"id":"microsoft/graph-api","name":"Microsoft Graph API access","vendor":"Microsoft","status":"researched","last_verified":null,"last_researched":"2026-10-25","summary":"Give an Entra app permission to call Microsoft Graph (Microsoft 365 mail, calendar, files, Teams, users and more). The gates are choosing least-privilege permissions, getting user or admin consent in every tenant that uses the app, and, for a few metered APIs, linking an Azure subscription.","account_model":{"summary":"Graph access belongs to an Entra app registration in your tenant. Each customer tenant that uses the app gets its own service principal and its own consent record, granted by its own users or admins. Delegated permissions act as the signed-in user; application permissions act as the app across the whole tenant.","accounts":[{"name":"Your Entra tenant and app registration","kind":"project","owned_by":"you","required":true,"note":"See microsoft/entra-app-registration."},{"name":"Customer tenant service principal","kind":"other","owned_by":"each customer organisation","note":"Created on first consent; the customer's admin controls consent, user assignment and removal."},{"name":"Azure subscription linked to the app","kind":"billing","owned_by":"you","required":false,"note":"Only for metered APIs (currently the SharePoint/OneDrive assignSensitivityLabel API)."}],"notes":["Personal Microsoft accounts can use only some delegated permissions, and apps that allow personal accounts can request at most 30 permissions."]},"prerequisites":[{"entry":"microsoft/entra-app-registration"},{"entry":"microsoft/publisher-verification","note":"Strongly advised for multitenant apps used by other organisations; otherwise their users may not be able to consent."}],"identity_requires":[],"have_ready":[{"kind":"other","description":"A list of the exact Graph operations your app calls, mapped to the least-privileged permission for each","why":"Microsoft's API terms forbid requesting more than the minimum permissions; over-asking also makes users and admins refuse consent.","needed_for":["choose-permissions"],"auto_check":"none","source_url":"https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use"},{"kind":"app_privacy_policy_url","description":"A public privacy statement that explains your data use and links to https://myapps.microsoft.com and/or https://account.live.com/consent/Manage for revoking consent","why":"Required by the Microsoft APIs Terms of Use when users sign in with Microsoft accounts outside a Microsoft-provided sign-in UI.","needed_for":["customer-consent"],"auto_check":"website_live","source_url":"https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use"},{"kind":"other","description":"A contact at each customer organisation who holds an admin role that can consent (Privileged Role Administrator for Graph application permissions)","why":"Application permissions and many sensitive delegated permissions can only be granted by an admin.","needed_for":["customer-consent"],"auto_check":"none","source_url":"https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent"}],"steps":[{"id":"choose-permissions","title":"Choose delegated or application permissions, least privilege first","summary":"Use delegated permissions when a user is signed in (the app can never exceed what that user can do). Use application permissions only for background services; they reach all matching data in the tenant. Pick the least-privileged permission listed on each API's reference page and avoid Directory.AccessAsUser.All, Directory.ReadWrite.All and similar broad permissions.","route":"guided","gate":"none","human_only":false,"gate_label":null,"depends_on":[],"optional":false,"url":"https://learn.microsoft.com/en-us/graph/permissions-reference","lead_time":null,"preflight":[],"captures":null},{"id":"add-permissions","title":"Add Microsoft Graph permissions to the app","summary":"In App registrations > your app > API permissions > Add a permission > Microsoft Graph, add the delegated and/or application permissions you chose.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["choose-permissions"],"optional":false,"url":"https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade","lead_time":null,"preflight":[],"captures":null},{"id":"admin-consent","title":"Grant consent in your own tenant","summary":"Select Grant admin consent on the API permissions page. A Privileged Role Administrator can grant any permission; a Cloud Application, Application or AI Administrator can grant everything except Graph application permissions. Granting tenant-wide consent can revoke earlier tenant-wide grants.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["add-permissions"],"optional":false,"url":"https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade","lead_time":null,"preflight":[],"captures":null},{"id":"customer-consent","title":"Get consent in each customer tenant (multitenant apps)","summary":"Customers' users consent at first sign-in where their tenant policy allows. For application permissions, send the customer's admin to https://login.microsoftonline.com/{tenant}/adminconsent?client_id={client-id}. Unverified multitenant apps may be blocked by risk-based step-up consent.","route":"guided","gate":"third_party_review","human_only":true,"gate_label":"The provider reviews it","depends_on":["admin-consent"],"optional":true,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"metered-billing","title":"Link an Azure subscription (metered APIs only)","summary":"Only needed for metered APIs, currently SharePoint/OneDrive assignSensitivityLabel. Teams APIs stopped being metered on 25 August 2025 and need no billing setup. Some metered APIs are protected and need a request to Microsoft before use.","route":"guided","gate":"human_payment","human_only":true,"gate_label":"You add payment details","depends_on":["admin-consent"],"optional":true,"url":"https://learn.microsoft.com/en-us/graph/metered-api-setup","lead_time":null,"preflight":[],"captures":null},{"id":"test","title":"Test calls and handle throttling","summary":"Try your calls in Graph Explorer, then in code. When throttled, Graph returns 429 with a Retry-After header; wait that long before retrying. Use delta queries and change notifications instead of polling, and Microsoft Graph Data Connect for bulk extraction.","route":"guided","gate":"human_login","human_only":true,"gate_label":"You sign in","depends_on":["admin-consent"],"optional":false,"url":"https://developer.microsoft.com/graph/graph-explorer","lead_time":null,"preflight":[],"captures":null}],"gates":[{"step":"add-permissions","gate":"human_submit","label":"You press submit"},{"step":"admin-consent","gate":"human_submit","label":"You press submit"},{"step":"customer-consent","gate":"third_party_review","label":"The provider reviews it"},{"step":"metered-billing","gate":"human_payment","label":"You add payment details"},{"step":"test","gate":"human_login","label":"You sign in"}],"lead_times":[],"outputs":[],"renewals":[],"estimated_minutes":null,"guide_url":"https://verapli.com/guides/microsoft/graph-api"}