Find the scope.
Grant less.

Least-privilege workflow

Choose permissions from the operation backward

A permission name is only useful when it is matched to the exact Microsoft Graph request. Begin with the resource and HTTP operation, then determine whether the application acts for a signed-in user or as an unattended workload. That distinction separates delegated permissions from application permissions and changes both the consent path and the security impact.

Search by permission, Graph resource, or administrator task. Each record summarizes supported access modes, consent requirements, common uses, and boundaries that are easy to miss when similarly named scopes exist. Treat the result as a shortlist: the permissions table for the target endpoint remains authoritative.

Before granting consent

• Confirm the exact endpoint, HTTP method, and version being called
• Prefer resource-specific read access over directory-wide or write access
• Separate interactive delegated use from background application access
• Document who approved the scope, why it is required, and when it will be reviewed

Test with the narrowest viable permission in a non-production context. If the request fails, inspect the token audience and claims before broadening access; a wrong resource, missing role assignment, or stale token can look like an insufficient-permission problem.