How to allow application to read users and group memberships with limited permissions

Question

I have a background service that needs to get all of the user profiles and the groups they belong to. I'm assuming that I will call the memberOf endpoint for each userid in order to get their groups. The problem is that this endpoint seems to require Directory.Read.All permissions, and that provides way more access to information than I need.

https://learn.microsoft.com/en-us/graph/api/user-list-memberof?view=graph-rest-1.0&tabs=http

Is there a way to get a list of groups that a user belongs to and the group names without enabling the entire Directory.Read.All permission?

Answer 1

Have you looked at:

https://learn.microsoft.com/en-us/graph/permissions-reference#group-permissions

Answer 2

Hi @Jason Lines

Try granting User.Read.All application permission to your app to list user sets. You only need to expand the /memberOf endpoint when listing user sets to list all groups that all users belong to, you don't need to grant additional permissions for this.

https://graph.microsoft.com/v1.0/users?$expand=memberOf

Note that the values of directory-level attributes will not be returned.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Answer 3

How about just sending a group claim, which ensures the app will get only the groups list.