Microsoft Graph Permissions
These are assigned to App 2 (Data) as Application permissions, and admin-consented separately in each customer tenant during onboarding.
| Capability | Permission(s) | Why it's needed |
|---|---|---|
| Users (read + disable/enable) | User.Read.All, User.ReadWrite.All | Powers user search and the account enable/disable actions. |
| Reset access (Temporary Access Pass) | UserAuthenticationMethod.ReadWrite.All | Issues a TAP so a user can regain access without you ever handling their real password. |
| Device management (read + actions) | DeviceManagementManagedDevices.Read.All, DeviceManagementManagedDevices.PrivilegedOperations.All | Device inventory, plus sync/retire/wipe actions. |
| Configuration profiles / compliance | DeviceManagementConfiguration.Read.All | Configuration profile and compliance policy views. |
| Intune service config / Autopilot / Apple tokens | DeviceManagementServiceConfig.Read.All | Autopilot identities, and the certificate/token Expiry Alerts (APNs certificate, VPP tokens, DEP/ABM tokens). |
| Application catalog / deployment | DeviceManagementApps.Read.All (add DeviceManagementApps.ReadWrite.All to deploy apps) | Powers the Apps page and app-catalog deployment. |
| Assignment targets | Group.Read.All (or Directory.Read.All) | Populates the group picker when assigning an app. |
| BitLocker / LAPS | BitLockerKey.Read.All, DeviceLocalCredential.Read.All | Reveals BitLocker recovery keys and LAPS passwords — every reveal is audited server-side. |
:::info Grant least-privilege
Only grant the permissions the features you're actually enabling need. If write actions are disabled
for a customer, the write-capable scopes (…ReadWrite.All, …PrivilegedOperations.All) can be omitted
entirely.
:::
Directory roles — the part that's easy to miss
Microsoft Graph classifies some writes as "sensitive actions." For these, holding the Graph permission is not enough — the calling application's service principal must also hold a specific directory role in that tenant. This is a Microsoft Graph platform rule, not a CET2-specific one.
| Action | Graph permission | Directory role also required |
|---|---|---|
| Disable / enable a user | User.ReadWrite.All | User Administrator |
| Issue a Temporary Access Pass | UserAuthenticationMethod.ReadWrite.All | Authentication Administrator |
Without the directory role, these calls fail with 403 Authorization_RequestDenied: Insufficient privileges — even though the Graph permission is correctly consented. See
Tenant Onboarding for how to assign these.
Note: Neither role lets CET2 disable or otherwise act against a user who themselves holds an admin directory role — Entra blocks that by design, and CET2 surfaces this in the UI before attempting the action, rather than letting it fail opaquely at Graph.
Continue to Server Installation.