On Demand Recovery Current - User Guide

AdministrativeUnit.ReadWrite.All

Allows the app to create, read, update, and delete administrative units and manage administrative unit membership without a signed-in user.

Application.ReadWrite.All

Allows the app to create groups, read all group properties and memberships, update group properties and memberships, and delete groups. Also allows the app to read and write group calendar and conversations. All of these operations can be performed by the app without a signed-in user.

AppRoleAssignment.ReadWrite.All

Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.

Device.ReadWrite.All

Allows the app to read and write all device properties without a signed in user. Does not allow device creation or update of device alternative security identifiers.

Directory.ReadWrite.All

Allows the app to read and write data in your organization's directory, such as other users, groups. It does not allow the app to delete users or groups, or reset user passwords.

Group.ReadWrite.All

Allows the app to create groups, read all group properties and memberships, update group properties and memberships, and delete groups. Also allows the app to read and write group calendar and conversations. All of these operations can be performed by the app without a signed-in user.

Policy.Read.All

Allows the app to read all your organization's policies without a signed in user.

Policy.ReadWrite.Authorization

Allows the app to read and write your organization's authorization policy without a signed in user. For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default.

Policy.ReadWrite.AuthenticationFlows

Allows the app to read and write all authentication flow policies for the tenant, without a signed-in user.

Policy.ReadWrite.ConditionalAccess

Allows the app to read and write your organization's conditional access policies on behalf of the signed-in user.

Policy.ReadWrite.ExternalIdentities

Allows the application to read and update the organization's external identities policy without a signed-in user. For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave.

RoleManagement.ReadWrite.Directory

Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, without a signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.

UserAuthenticationMethod.ReadWrite.All

Allows the application to read and write authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user's phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.

User.ManageIdentities.All

Allows the app to read, update and delete identities that are associated with a user's account that the signed-in user has access to. This controls the identities users can sign-in with.

User.ReadWrite.All

Allows the app to read and write the full set of profile properties, group membership, reports and managers of other users in your organization, without a signed-in user. Also allows the app to create and delete non-administrative users. Does not allow reset of user passwords.

Directory.AccessAsUser.All

Allows the app to have the same access to information in your work or school directory as you do.