Extra Permissions for Custom Microsoft Teams Application in Admin Center

Question

There are additional application/delegated permissions appearing for a self-developed Microsoft Teams application in the Teams Admin Center. The selected permissions for Microsoft Graph are:

1. AppCatalog.Read.All
2. Group.ReadWrite.All
3. offline_access
4. openid
5. User.Read
6. User.Read.All

Is there a reason why other permissions are showing up, and are there default permissions for all Teams applications? I was only expecting the selected permissions for Microsoft Graph to appear.

Answer 1

Your app’s Teams app manifest may declare capabilities (like groupchat, personal, team, or meeting) that imply certain permissions. Teams Admin Center may reflect those implied scopes.

If your app requests additional permissions during runtime (e.g., via scopes in the Microsoft Teams JavaScript SDK), those permissions may appear in the Teams Admin Center after admin consent is granted.

Answer 2

Hi @Min Soh , 

Thank you for posting your question in the Microsoft Q&A forum. 

Based on the information you have provided, looks like there are more permissions than you are expecting. 

From my knowledge about permission, here are my thoughts:  

• When you create a Team, you also create a M365 group in the background. And when the group is created, the child objects are also created such as a mailbox, a calendar, a SharePoint team site, a OneNote notebook, …  You can read more at Overview of Microsoft 365 Groups for administrators - Microsoft 365 admin | Microsoft Learn 
• Group.ReadWrite.All permission grants full control over the group objects, so it also grants control over its smaller components. This is why you see permissions like Sites.ReadWrite.All (for the SharePoint site) and Notes.ReadWrite.All (for the OneNote notebook) appear as required permissions. Because they are all parts of M365 group.  
• It's the same with other permissions that you selected. For example, User.Read.All grants User.ReadBasic.All permission.  You can find more details at Microsoft Graph permissions reference - Microsoft Graph | Microsoft Learn 

Please correct me if my understanding is wrong. Feel free to reach out if you have any questions. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread