Microsoft 365 (Microsoft Graph) permissions,
in plain English.
When you connect a Microsoft 365 account, Microsoft shows a sign-in screen that lists the permissions the app is asking for. There are two kinds. Delegated permissions let the app act as you while it is connected, and it can never reach anything you could not reach yourself. Application permissions let the app work with nobody signed in, and they reach data across your whole organization, such as every mailbox or every file. Only a Global Administrator or Privileged Role Administrator can approve application permissions, either when the app is added or in the Microsoft Entra admin center. The same name, like Mail.ReadWrite, can appear in both kinds, so check which kind you are approving.
- Read your email (Mail.Read, delegated)
It can open and read every email in your mailbox, including the full message and attachments. It acts as you, so it only sees your own mailbox. - Read, change, and delete your email (Mail.ReadWrite, delegated)
It can read, create, change, and delete email in your mailbox. It cannot send email with this permission alone. - Send email as you (Mail.Send, delegated)
It can send email from your address. People who get it will see it as coming from you. - Read, change, and delete email in every mailbox (Mail.ReadWrite, application)
This is the company-wide version. It lets the app read, create, change, and delete email in every mailbox in your organization, with nobody signed in. It is not limited to your inbox or to what you can see. - Send email as anyone in your company (Mail.Send, application)
This is the company-wide version. It can send email as any person in your organization, with nobody signed in. Recipients will see it as coming from that person. - Change your mailbox settings and inbox rules (MailboxSettings.ReadWrite, delegated)
It can change how your mailbox behaves. That includes your automatic out-of-office reply and inbox rules, such as a rule that forwards incoming mail to another address. - Full access to your calendar (Calendars.ReadWrite, delegated)
It can see your calendar and add, change, or delete events on it. When it creates a meeting with attendees, they get an invitation from you. - Full access to your contacts (Contacts.ReadWrite, delegated)
It can read your Outlook contacts and add, change, or delete them. - Full access to your own files (Files.ReadWrite, delegated)
It can open, add, change, and delete the files in your own OneDrive. - Full access to every file you can reach (Files.ReadWrite.All, delegated)
It can open, add, change, and delete every file you can reach. That includes your OneDrive, files others shared with you, and files you can access through a team or group. - Full access to every file in your company (Files.ReadWrite.All, application)
This is the company-wide version. It can read, create, change, and delete files in every SharePoint site collection in your organization, with nobody signed in. It is not limited to files you can see. - Edit or delete items on SharePoint sites you can reach (Sites.ReadWrite.All, delegated)
It can read, edit, and delete documents and list items on SharePoint sites, acting as you. It is limited to what you are allowed to see and change. - Read and write your Teams chats (Chat.ReadWrite, delegated)
It can read your one-on-one and group chats in Microsoft Teams and write in them, including posting messages as you. - Send Teams chat messages as you (ChatMessage.Send, delegated)
It can send one-on-one and group chat messages in Microsoft Teams as you. - Post in Teams channels as you (ChannelMessage.Send, delegated)
It can post messages in Microsoft Teams channels as you. - Keep access while you are away (offline_access)
It lets the app keep using the other permissions you approved even when you are not using it. It does not add any new powers on its own.
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.