What can an AI agent do with
Full access to every file in your company (Files.ReadWrite.All, application)?
This is the company-wide version. It can read, create, change, and delete files in every SharePoint site collection in your organization, with nobody signed in. It is not limited to files you can see.
How to spot it
On a Microsoft 365 (Microsoft Graph) connection or settings screen, this is Files.ReadWrite.All. The consent screen words it as Read and write files in all site collections
With it, an agent can
- Read any file stored across your organization's site collections
- Create, edit, and delete files across all of them
- Work at any hour with nobody signed in
It cannot, on its own
- Be approved by a regular user; only a Global Administrator or Privileged Role Administrator can approve it
What a bad day looks like
If the app's own credentials leak, someone could download or delete every file stored in your company's SharePoint sites.
Set it up safer
- Ask for Sites.Selected instead, so your admin picks exactly which sites the app can use.
- Use the delegated Files.ReadWrite.All, which stays within what the signed-in person can open.
- If it only reads, ask for Files.Read.All. In this company-wide form it still reads every file, so Sites.Selected is the real limit.
Narrower permissions on Microsoft 365 (Microsoft Graph):
- Full access to every file in your company (Files.ReadWrite.All, application)
Files.ReadWrite.All
Ask the company selling the agent
- Why do you need every file in my company instead of specific sites?
- Can the agent work with Sites.Selected so I choose the sites?
- Where are the app's credentials kept, and who can use them?
Source
Checked against Microsoft 365 (Microsoft Graph) documentation on 2026-09-28. All Microsoft 365 (Microsoft Graph) permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.