MS Graph Permissions Requirements for Automations
Overview
The table below gives an overview of all the MS Graph permissions required by each Automation.
Table of Permissions Required
| Package | Scope | Minimum Required MS Graph Permissions |
|---|---|---|
| Account Locked Out | Cloud Hybrid | GroupMember.Read.All, User.Read.All |
| Account Locked Out | Cloud Only | User.Read.All, User.ManageIdentities.All, GroupMember.Read.All |
| Add Remove User from Groups | Cloud Hybrid | Directory.Read.All, GroupMember.ReadWrite.All, User.ReadWrite.All |
| Add Remove User from Groups | Cloud Only | Directory.Read.All, GroupMember.ReadWrite.All, User.ReadWrite.All |
| Bulk Add Remove Contacts to Group | GroupMember.Read.All | |
| Bulk Add Remove Users to Group | GroupMember.ReadWrite.All, User.ReadWrite.All | |
| Bulk Update User Details | Cloud Hybrid | GroupMember.Read.All, User.Read.All |
| Bulk Update User Details | Cloud Only | GroupMember.Read.All, User.ManageIdentities.All, User.ReadWrite.All |
| Change User Details | Cloud Hybrid | Directory.Read.All |
| Change User Details | Cloud Only | User.ManageIdentities.All, User.ReadWrite.All, Directory.Read.All |
| Computer Performance Report | GroupMember.Read.All, User.Read.All | |
| Create Shared Mailbox | Cloud Hybrid | User.Read.All, User.ManageIdentities.All |
| Create Shared Mailbox | Cloud Only | User.Read.All, User.ManageIdentities.All |
| Deploy SonicWall VPN | GroupMember.Read.All, User.Read.All | |
| Get User Account Details | Cloud Hybrid | GroupMember.Read.All, User.Read.All |
| Get User Account Details | Cloud Only | GroupMember.Read.All, User.Read.All |
| Install Uninstall Reinstall Software | GroupMember.Read.All, User.Read.All | |
| Manage User Licenses | Cloud Hybrid | DeviceManagementServiceConfig.Read.All, Organization.Read.All, User.ManageIdentities.All, User.ReadWrite.All, Mail.Send |
| Manage User Licenses | Cloud Only | DeviceManagementServiceConfig.Read.All, Organization.Read.All, User.ManageIdentities.All, User.ReadWrite.All, Mail.Send |
| Map Network Drive Package | GroupMember.Read.All, User.Read.All | |
| Modify Distribution Group Settings | Cloud Hybrid | GroupMember.Read.All, DeviceManagementServiceConfig.Read.All, User.Read.All |
| Modify Distribution Group Settings | Cloud Only | GroupMember.Read.All, DeviceManagementServiceConfig.Read.All, User.Read.All |
| Network Drive Troubleshooting | GroupMember.Read.All, User.Read.All | |
| Outlook Mail Flow Troubleshooting | Cloud Hybrid | GroupMember.Read.All, User.Read.All, ServiceHealth.Read.All |
| Outlook Mail Flow Troubleshooting | Cloud Only | GroupMember.Read.All, User.Read.All, ServiceHealth.Read.All |
| Printer Troubleshooting Package Extended | GroupMember.Read.All, User.Read.All | |
| Re-allocate User License | Cloud Hybrid | DeviceManagementServiceConfig.Read.All, Organization.Read.All, User.ManageIdentities.All, User.ReadWrite.All, Mail.Send |
| Re-allocate User License | Cloud-Only | DeviceManagementServiceConfig.Read.All, Organization.Read.All, User.ManageIdentities.All, User.ReadWrite.All |
| Recover Lost Folder in Outlook | GroupMember.Read.All, User.Read.All | |
| Re-enable Terminated Account | Cloud Hybrid | Directory.Read.All, GroupMember.ReadWrite.All, User.ReadWrite.All, DeviceManagementServiceConfig.Read.All, Organization.Read.All, User.ManageIdentities.All |
| Re-enable Terminated Account | Cloud Only | UserAuthenticationMethod.ReadWrite.All, Directory.Read.All, GroupMember.ReadWrite.All, User.ReadWrite.All, DeviceManagementServiceConfig.Read.All, Organization.Read.All, User.ManageIdentities.All |
| Remote Desktop Setup | GroupMember.ReadWrite.All, User.ReadWrite.All, Mail.Send | |
| Remote Desktop Troubleshooting | GroupMember.ReadWrite.All, User.ReadWrite.All | |
| Reset Network Password | Cloud Hybrid | GroupMember.Read.All, User.Read.All |
| Reset Network Password | Cloud Only | User.Read.All, UserAuthenticationMethod.ReadWrite.All, User.ManageIdentities.All |
| Reset Network Password | Semi-Hybrid | UserAuthenticationMethod.ReadWrite.All, User.Read.All, User.ManageIdentities.All, GroupMember.Read.All |
| Setup Mail Forwarding | Cloud Hybrid | GroupMember.Read.All, User.Read.All, Mail.Send |
| Setup Mail Forwarding | Cloud Only | GroupMember.Read.All, User.Read.All, Mail.Send |
| Staff Offboarding | Cloud Hybrid | UserAuthenticationMethod.ReadWrite.All, GroupMember.ReadWrite.All, User.ReadWrite.All, User.ManageIdentities.All, Directory.Read.All, Mail.Send |
| Staff Offboarding | Cloud Only | UserAuthenticationMethod.ReadWrite.All, GroupMember.ReadWrite.All, User.ReadWrite.All, User.ManageIdentities.All, Directory.Read.All, Mail.Send |
| Staff Offboarding | Prem Only | User.Read.All, Mail.Send |
| Staff Onboarding | Cloud Hybrid | Directory.Read.All, GroupMember.ReadWrite.All, User.ReadWrite.All, DeviceManagementServiceConfig.Read.All, Organization.Read.All, User.ManageIdentities.All, Mail.Send |
| Troubleshoot Windows VPN Configuration | GroupMember.ReadWrite.All, User.ReadWrite.All, User.ManageIdentities.All | |
| Upload Staff Photo | Cloud Hybrid | GroupMember.Read.All, User.Read.All |
| Upload Staff Photo | Cloud Only | GroupMember.Read.All, User.Read.All |
| User Onboarding | Cloud Only | Directory.Read.All, GroupMember.ReadWrite.All, User.ReadWrite.All, DeviceManagementServiceConfig.Read.All, Organization.Read.All, User.ManageIdentities.All, Mail.Send |
| User Onboarding | On Prem Only | User.Read.All, Mail.Send |
| User Onboarding | Semi-Hybrid | Directory.Read.All, GroupMember.ReadWrite.All, User.ReadWrite.All, DeviceManagementServiceConfig.Read.All, Organization.Read.All, User.ManageIdentities.All, Mail.Send |
| VPN Setup | Cloud Hybrid | GroupMember.Read.All, User.Read.All, Mail.Send |
| VPN Setup | Cloud Only | GroupMember.ReadWrite.All, User.ReadWrite.All, Mail.Send |
| Win10 Install Network Printer | GroupMember.Read.All, User.Read.All | |
| Win10 Outlook Package | GroupMember.Read.All, User.Read.All | |
| Win10 Printer Troubleshooting Package | GroupMember.Read.All, User.Read.All |