User Permission AzureAD

Question

1. What is the requirement for this *.Read.All AD permission, specific to our needed functionality?

So for fetching the user from azure-ad we are giving the permission User.Read.all but in user-details we only required few amount of data like we can only 2-3 fields(name, email). So can we give the permission only for that 2 fields or can we apply some check over their? so by doing this we only get these 2 field in api response not more than that.

2. Can this AD Permission be limited in Azure to a small subset of applications/users/directories based on criteria that WE define? How?

Answer 1

Hi @webkorps ,

Thanks for reaching out and apologies for delay in response.

I understand that you are looking to retrieve limited properties of user details rather that full profile of signed-in-user.

User.Read.All permission allows you to read full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.

If you want to get selected properties of user in your response, you can achieve that using $select query to retrieve required properties.
https://graph.microsoft.com/v1.0/users?$select=displayName,mail

If there is a requirement to read only basic profile of the user. Then Azure AD provides User.ReadBasic.All permission as well to constrains app access to a limited set of properties known as the basic profile. This is because the full profile might contain sensitive directory information. The basic profile includes the following properties:
displayName
givenName
mail
photo
surname

Hope this will help.

Thanks,
Shweta

-----------------------------------------

Please remember to "Accept Answer" if answer helped you.