-
Notifications
You must be signed in to change notification settings - Fork 0
Permissions
Nemu-x edited this page Jul 15, 2026
·
3 revisions
SwissKnife only does what your app registration is allowed to do. Grant Application permissions for app-only mode (and Grant admin consent), or the matching Delegated permissions for device-code mode. Add only what you use — the app can hide tabs you have no access to (Settings → Check access → Hide unavailable).
Enough for the dashboard, users, groups, teams, files, and audit:
-
Organization.Read.All— org info on connect User.Read.AllDirectory.Read.AllGroup.ReadWrite.AllTeam.ReadWrite.AllFiles.ReadWrite.AllSites.ReadWrite.AllAuditLog.Read.All
| Feature | Microsoft Graph permission(s) |
|---|---|
| Connect / Dashboard |
Organization.Read.All, Directory.Read.All
|
| Users — read / snapshot | User.Read.All |
| Users — block, reset password, revoke sessions, create/update/delete, manager, usageLocation |
User.ReadWrite.All, Directory.ReadWrite.All
|
| Deleted users — list / restore |
User.DeleteRestore.All (or Directory.ReadWrite.All) |
| Reset MFA / auth methods | UserAuthenticationMethod.ReadWrite.All |
| Admin roles — list / assign / remove | RoleManagement.ReadWrite.Directory |
| Licensing — SKUs, assign/remove |
Directory.Read.All, User.ReadWrite.All
|
| Groups — read, create, membership |
Group.ReadWrite.All, Directory.Read.All
|
| Teamify (group → team) |
Team.Create, Group.ReadWrite.All
|
| Teams & channels — read/manage |
Team.ReadWrite.All, Channel.Create, ChannelMember.ReadWrite.All, TeamMember.ReadWrite.All
|
| Chats — list, messages, members |
Chat.Read.All, Chat.ReadWrite.All, ChatMember.ReadWrite.All
|
| Mail — read / send as user |
Mail.Read, Mail.Send
|
| Calendar — read / create events | Calendars.ReadWrite |
| OneDrive / SharePoint — browse, up/download, delete, links, Offboarding, Cleanup |
Files.ReadWrite.All, Sites.ReadWrite.All
|
| Intune — devices, wipe/retire/lock |
DeviceManagementManagedDevices.Read.All, DeviceManagementManagedDevices.PrivilegedOperations.All
|
| Entra devices — enable/disable/delete |
Device.Read.All, Directory.ReadWrite.All
|
| BitLocker recovery keys | BitlockerKey.Read.All |
| App registrations — list + expiry | Application.Read.All |
| Usage reports (CSV) | Reports.Read.All |
| Service health / message center | ServiceHealth.Read.All |
| Audit — sign-in / directory logs | AuditLog.Read.All |
| Playbooks (onboard/offboard) | union of the permissions for the steps you enable |
| Bulk / CSV runner | union of the permissions for the chosen operation (create users / licensing / groups) |
| Temporary Access Pass (TAP) | UserAuthenticationMethod.ReadWrite.All |
| Guest invitations (B2B) |
User.Invite.All (or Directory.ReadWrite.All) |
| App secret rotation | Application.ReadWrite.All |
| Security review — CA policies + app consents |
Policy.Read.All, Application.Read.All
|
| Offboarding extras — auto-reply (OOF), mail forwarding rule, hide from GAL, calendar share, remove from all groups |
MailboxSettings.ReadWrite, Mail.ReadWrite, User.ReadWrite.All, Calendars.ReadWrite, GroupMember.ReadWrite.All (covered by Group.ReadWrite.All if you already grant it) |
| Raw Graph playground | whatever the request you send requires |
- Application vs Delegated: app-only acts tenant-wide as the app; delegated (device code) acts as the signed-in user and is bounded by their own rights. Pick per your needs — see Connecting.
-
Sign-in logs (
AuditLog.Read.All) also require Entra ID P1/P2 on the tenant. - After adding Application permissions you must click Grant admin consent — otherwise every call returns 403 (SwissKnife shows a hint telling you a permission is missing).