Microsoft Graph API Provider calendar persmission

Mishra, Dolly 41

Under Microsoft Graph Permissions i have added just one permission ' calendar. readwrite' which is needed in my app.

However it ask for so many permission which my app has not asked for. Can you please help, how should i restrict ? Please refer screenshot. How can i remove these?? where to setup

1 answer

soumi-MSFT 11,776 Reputation points Microsoft Employee

2020-07-28T07:38:46.81+00:00
@Mishra, Dolly , Thank you for reaching out. The reason you see so may permissions listed on the consent page, though you have just added a single permission is because all these permissions are stacked up in the hierarchy from the least to most privilege permissions. For eg:

User.Read ---> Would only allow you to read the user's profile

User.ReadWrite ---> Would allow you to read as well as write in the user's profile

Hence in your case also, as you are using calendar.readwrite would this permission would include the least privilege permissions also.

Hope this helps.

Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as Answer; if the above response helped in answering your query.
Please sign in to rate this answer.
Mishra, Dolly 41 Reputation points

2020-07-28T08:05:00.427+00:00

But why these send mail as you, read mail... these are coming, These are not required,
my app only requires to read public calendar of users. Is there way to remove these added permission?

I really want to remove these all mail related permission

soumi-MSFT 11,776 Reputation points Microsoft Employee

2020-07-28T09:37:49.33+00:00

@MishraDolly-9847, Can you share the access-token that you are using to call this API with? I would like to take a look at the scopes inside that access-token. You can use the tool JWT.ms to decode the JWT and share the decoded JWT with us here. make sure you hide the information like UPN, Email address, TenantID/TenantName from that decoded token before sharing that out here with us.

Do share this details so that we can help you sooner.

soumi-MSFT 11,776 Reputation points Microsoft Employee

2020-07-28T09:51:22.933+00:00

@MishraDolly-9847, One more thing that I guess might have happened is, the mail.send and mail.read permissions might be still available or stuck with the service principal of this application somehow. Though you have deleted the permission from the App Permission section, still in the backend these permissions still remain and hence when you are making a call to AAD to get the token, you access-token is getting issued by the old permissions like mail.send and mail.old along with your new ones. This issue usually happens when we keep modifying the permissions during the testing phase.

The easy fix for this would be to delete the service principal object of you app from Enterprise Registration and then recreate back.

soumi-MSFT 11,776 Reputation points Microsoft Employee

2020-07-29T08:11:54.61+00:00

@Mishra, Dolly , Just wanted to check if the above response helped in answering your query. Do let me know if there are any more queries around this so that we can help you further.

soumi-MSFT 11,776 Reputation points Microsoft Employee

2020-07-30T05:53:00.327+00:00

@Mishra, Dolly , Just wanted to check if the above response helped in answering your query. Do let me know if there are any more queries around this so that we can help you further.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Microsoft Graph API Provider calendar persmission

1 answer

Your answer