Application Policy.Read.All Permission to Retrieve Service Principal Custom Claims Policy

Hello @Ruslan Guk (rguk),

Thank you for posting your query on Microsoft Q&A.

Based on your description, I understand that you are testing the GET /servicePrincipals/{servicePrincipalId}/claimsPolicy request and have noticed that the response can be retrieved using the Policy.Read.All permission, rather than the Policy.Read.ApplicationConfiguration or Policy.ReadWrite.ApplicationConfiguration permissions mentioned in the documentation.

This behavior is expected and by design. The Policy.Read.All scope provides read access to all policies in Entra ID. For instance, with this scope, you can call the following policies:

• GET /identity/conditionalAccess/policies
• GET /policies/authenticationMethodsPolicy
• GET /identityGovernance/accessReviews/policy
• GET /policies/appManagementPolicies
• GET /policies/authenticationStrengthPolicies
• GET /policies/claimsMappingPolicies
• GET /policies/mobileDeviceManagementPolicies, and more.

In contrast, the Policy.Read.ApplicationConfiguration scope is limited to application configuration-related requests, such as:

• GET /policies/appManagementPolicies
• GET /policies/claimsMappingPolicies/{id}
• GET /policies/homeRealmDiscoveryPolicies
• GET /policies/tokenLifetimePolicies

As for why the documentation does not mention Policy.Read.All, it is because the focus is on the specific request being discussed, and the least privileged and most relevant permissions for application configuration are highlighted.

The Policy.Read.All scope provides broader access to all policies within Entra ID, while the Policy.Read.ApplicationConfiguration scope is intentionally limited to a specific subset of application configuration-related requests.

For more details on the supported requests for each permission, please refer to the following resources:

• Policy.Read.All Permissions
• Policy.Read.ApplicationConfiguration Permissions

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.