This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 80%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPS%3C/text%3E%3C/svg%3E)
Hello.
For MS Graph permissions reference we use https://learn.microsoft.com/en-us/graph/permissions-reference on daily basis.
Is something similar available for Azure AD permissions ? Honestly - can't find similar reference.
The goal is to map Azure AD Graph permissions toward Microsoft Graph permissions for our developers, or at least verify what we can consent prior Azure AD Graph endpoint disablement.
I can fetch existing appRoles / scopes from Azure backend - but this will be just short description, like e.g.
Application.Read.All - Allows the app to read applications and service principals without a signed-in user.
Is there documentation on MS end, which gives more details about Azure AD Graph permissions ?
A cloud-based identity and access management service for securing user authentication and resource access
@Piotr Stepien
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
----------
Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
Well, found below links - very useful:
https://learn.microsoft.com/en-us/previous-versions/azure/ad/graph/api/api-catalog
https://learn.microsoft.com/en-us/previous-versions/azure/ad/graph/howto/azure-ad-graph-api-permission-scopes
Please close the question.
Hi @Piotr Stepien • Thank you for reaching out.
Like MSAL uses Microsoft Graph, ADAL used to use Azure AD Graph. In order to migrate to Microsoft Graph from Azure AD Graph, can refer to the Migration guide here: Migrate Azure AD Graph apps to Microsoft Graph. The guide includes reviewing the differences between the APIs, examining API use, reviewing app details, and finally deploying, testing, & extending your app, as shown in the below snip:
-----------------------------------------------------------------------------------------------------------
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Hello.
This is great answer. But ... I visited above link, and potentially dozen of others, but information I'm looking for is simply not there.
As an example - delegated (scope) for MS Graph + read all groups:
Group.Read.All
*Allows the app to list groups, and to read their properties and all group memberships on behalf of the signed-in user. Also allows the app to read calendar, conversations, files, and other group content for all groups the signed-in user can access. *
Which means that Microsoft Graph Group.Read.All gives a lot more than Azure AD Graph Group.Read.All. But this is just assumption as I can't find definition what Azure AD Graph Group.Read.All does / gives / permits.
To be on a safe side, all Azure AD Group.Read.All calls should be replaced with NOT Group.Read.All but with GroupMember.Read.All. But I can't confirm this with Azure AD graph permissions reference/definition/view/list/guidance - whatever is possible. As it is missing ?
And this is VERY important due to legal / security / multiple other aspects, which we have to cover PRIOR consenting MS Graph permissions.
Hi @Piotr Stepien · I agree that there is no document that differentiates and compares Azure AD Graph and Microsoft Graph permissions. However, if you check the below section in App migration planning checklist, it talks about the differences between the APIs and if there were any changes in the permissions, it must have been documented here.
I will also reach out to the Graph product team to get a confirmation on this and post a comment here once I have the update on this.