No advertising use of Graph data
You may not use or transfer data from Microsoft APIs, including aggregated, anonymised or derived data, for advertising or marketing (targeting or serving ads). [7]
Guides · productivity · Verification-gated
Microsoft Graph API access
Give an Entra app permission to call Microsoft Graph (Microsoft 365 mail, calendar, files, Teams, users and more). The gates are choosing least-privilege permissions, getting user or admin consent in every tenant that uses the app, and, for a few metered APIs, linking an Azure subscription.
Researched · not yet run liveLast researched 25 October 2026 · Microsoft · provider site
Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Who owns what
Graph access belongs to an Entra app registration in your tenant. Each customer tenant that uses the app gets its own service principal and its own consent record, granted by its own users or admins. Delegated permissions act as the signed-in user; application permissions act as the app across the whole tenant.
- Your Entra tenant and app registration project owned by youSee microsoft/entra-app-registration.
- Customer tenant service principal other owned by each customer organisationCreated on first consent; the customer's admin controls consent, user assignment and removal.
- Azure subscription linked to the app billingoptional owned by youOnly for metered APIs (currently the SharePoint/OneDrive assignSensitivityLabel API).
Personal Microsoft accounts can use only some delegated permissions, and apps that allow personal accounts can request at most 30 permissions.
Have ready
- microsoft/entra-app-registration
- microsoft/publisher-verification: Strongly advised for multitenant apps used by other organisations; otherwise their users may not be able to consent.
- A list of the exact Graph operations your app calls, mapped to the least-privileged permission for each · Microsoft's API terms forbid requesting more than the minimum permissions; over-asking also makes users and admins refuse consent. [7]Needed for: Choose delegated or application permissions, least privilege first
- A public privacy statement that explains your data use and links to https://myapps.microsoft.com and/or https://account.live.com/consent/Manage for revoking consent · Required by the Microsoft APIs Terms of Use when users sign in with Microsoft accounts outside a Microsoft-provided sign-in UI. [7]Needed for: Get consent in each customer tenant (multitenant apps)
- A contact at each customer organisation who holds an admin role that can consent (Privileged Role Administrator for Graph application permissions) · Application permissions and many sensitive delegated permissions can only be granted by an admin. [2]Needed for: Get consent in each customer tenant (multitenant apps)
Steps
Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.
Choose delegated or application permissions, least privilege first
Use delegated permissions when a user is signed in (the app can never exceed what that user can do). Use application permissions only for background services; they reach all matching data in the tenant. Pick the least-privileged permission listed on each API's reference page and avoid Directory.AccessAsUser.All, Directory.ReadWrite.All and similar broad permissions.
Where: https://learn.microsoft.com/en-us/graph/permissions-reference
Add Microsoft Graph permissions to the app
In App registrations > your app > API permissions > Add a permission > Microsoft Graph, add the delegated and/or application permissions you chose.
Where: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade
Grant consent in your own tenant
Select Grant admin consent on the API permissions page. A Privileged Role Administrator can grant any permission; a Cloud Application, Application or AI Administrator can grant everything except Graph application permissions. Granting tenant-wide consent can revoke earlier tenant-wide grants.
If something goes wrong (2)
- The Grant admin consent button is greyed out.: You do not hold a role that can consent. Ask a Privileged Role Administrator (needed for Graph application permissions). [2]
- Calls return objects with only id and type filled in.: Your app can see the container but not that member type. Add the least-privileged read permission for that type (for example User.ReadBasic.All). [1]
Where: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade
Get consent in each customer tenant (multitenant apps)optional
Customers' users consent at first sign-in where their tenant policy allows. For application permissions, send the customer's admin to https://login.microsoftonline.com/{tenant}/adminconsent?client_id={client-id}. Unverified multitenant apps may be blocked by risk-based step-up consent.
If something goes wrong (5)
- "Administrator consent is required." (
AADSTS90094): The customer's admin must grant consent through the admin consent URL or Enterprise apps. [5] - "The user or administrator hasn't consented to use the application." (
AADSTS65001): Trigger an interactive sign-in so the user can consent, or ask the admin to grant tenant-wide consent. [5] - The user declined consent. (
AADSTS65004): Ask the user to retry and accept, and explain why each permission is needed. [5] - "The app needs access to a service that your organization hasn't subscribed to or enabled." (
AADSTS650052): The customer tenant lacks the Microsoft 365 service behind that permission; their admin must enable or license it. [5] - Consent screen warns the app is from an unverified publisher and users cannot continue.: Complete publisher verification for the app. [6]
- "Administrator consent is required." (
Link an Azure subscription (metered APIs only)optional
Only needed for metered APIs, currently SharePoint/OneDrive assignSensitivityLabel. Teams APIs stopped being metered on 25 August 2025 and need no billing setup. Some metered APIs are protected and need a request to Microsoft before use.
Where: https://learn.microsoft.com/en-us/graph/metered-api-setup
Test calls and handle throttling
Try your calls in Graph Explorer, then in code. When throttled, Graph returns 429 with a Retry-After header; wait that long before retrying. Use delta queries and change notifications instead of polling, and Microsoft Graph Data Connect for bulk extraction.
If something goes wrong (1)
- Requests fail with 429 Too Many Requests. (
429): Wait for the Retry-After seconds (or back off exponentially if absent), then retry; retry failed requests from JSON batches yourself. [3]
Where: https://developer.microsoft.com/graph/graph-explorer
- Requests fail with 429 Too Many Requests. (
Terms and gotchas
Plain-English summary, not legal advice. Each card links its source.
Do not scrape, over-collect or get around limits
You may not scrape or build databases of API data beyond your app's intended scenario, request more than the minimum data or permissions, circumvent Microsoft's limits, or resell or sublicense API data. Violations can lead to suspension or termination. [7]
Mail APIs are for sync and backup
Unless customers expressly grant more, Outlook/Exchange mail APIs (including Graph mail) may only be used to sync or back up mail, calendar and contacts. [7]
Data deletion and privacy duties
Get consent before processing, keep stored data current, delete all data when a user leaves or uninstalls your app, and publish a privacy statement at least as protective as Microsoft's. [7]
Breach reporting and audits
Report vulnerabilities and data breaches involving the APIs to secure@microsoft.com, make no public statement without Microsoft's permission, and give Microsoft audit access (up to two full-featured instances) on request or risk losing access. [7]
Application permissions are tenant-wide
An app with an application permission such as Files.Read.All can read every matching item in the organisation; admins will scrutinise these requests. [1]
Teams protected-API form retired
Older guides send you to a Teams "protected API" request form. People report Microsoft retired that form and manual approval on 18 May 2023 [to verify for any API you plan to use]. [9]
Pricing
- Costs: Metered APIs bill the linked Azure subscription; assignSensitivityLabel costs USD 0.00185 per call. Teams APIs are no longer metered (from 25 August 2025).
- The API list on the metered page is short; other Graph APIs are not on it [to verify per API you use].
Source [4]
For agents
The same entry as JSON: /api/v1/entries/microsoft/graph-api · requirements /api/v1/requirements/microsoft/graph-api · terms /api/v1/terms/microsoft/graph-api.
Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp
> "What do I need for Microsoft Graph API access, and how long will it take?"
→ tools/call requirements { "provider_id": "microsoft/graph-api" }Sources
- Overview of Microsoft Graph permissions Delegated vs application permissions; only admins consent to application permissions (Privileged Role Administrator or Global Administrator); user consent depends on tenant policy; least-privilege guidance; high-privilege permissions to avoid; limits of 400 permissions (work/school) or 30 (personal accounts); limited data for inaccessible member objects. · accessed 25 October 2026 · official
- Grant tenant-wide admin consent to an application Roles that can grant consent; admin consent URL format; granting tenant-wide consent may revoke previously granted tenant-wide permissions; programmatic grants take effect immediately. · accessed 25 October 2026 · official
- Microsoft Graph throttling guidance 429 Too Many Requests with Retry-After; best practices; Data Connect for bulk extraction; throttled requests inside batches are not retried automatically. · accessed 25 October 2026 · official
- Metered APIs and services in Microsoft Graph Teams APIs no longer metered from 25 August 2025; metered APIs need an active Azure subscription associated with the app; some metered APIs are protected and need a request; assignSensitivityLabel costs USD 0.00185 per call. · accessed 25 October 2026 · official
- Microsoft Entra authentication and authorization error codes AADSTS65001, AADSTS65004, AADSTS90094, AADSTS650052 meanings. · accessed 25 October 2026 · official
- Publisher verification overview Users may be unable to consent to unverified multitenant apps registered after 8 November 2020 under risk-based step-up consent. · accessed 25 October 2026 · official
- Terms of Use - Microsoft APIs Graph is covered; prohibited uses (scraping/building databases beyond need, more than minimum permissions, circumventing limits, advertising use of API data, reselling data, migrating customers away without approval); email APIs limited to sync/backup unless customers grant more; privacy statement requirements; security breach reporting; audit rights; suspension at any time. · accessed 25 October 2026 · official
- Announcing general availability of Microsoft Graph Export API for Microsoft Teams messages (Microsoft 365 Developer Blog) Historic requirement (2021) that Teams export "protected APIs" needed a request form beyond permissions and consent. · accessed 25 October 2026 · official
- VB365 protected Teams API call process changes (Veeam community) People report Microsoft retired the Teams protected-API request form and manual approval on 18 May 2023. · accessed 25 October 2026 · community
Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. Microsoft is not affiliated with verapli.