Forum Discussion

JeremyTBradshaw's avatar
JeremyTBradshaw
Iron Contributor
Apr 11, 2022
Solved

Delegated Permission option for Mail.ReadBasic.All

I'm hoping to get some help with understanding why a permission like Mail.ReadBasic.All is not made available as a Delegated Permission.  The use case in my head is that of administrators.  For examp...
exchange online
Microsoft Graph
powershell
  • JeremyTBradshaw's avatar
    JeremyTBradshaw
    Apr 20, 2022

    I believe I may have come up with the reason why it was chosen to NOT offer Mail.ReadBasic.All as a Delegated Permission. It may not be possible to supply the requesting user with the equivalent permission via RBAC role. The closest thing I can think of that would accomplish it would be the ApplicationImpersonation role in Exchange, which would be more permissions than we want in this scenario (re: Mail.ReadBasic.All).

    It makes me think that however the Effective Permissions are made possible for Application Permissions, that same capability could stand to be available for some special case Delegated Permissions (like Mail.ReadBasic.All).

JeremyTBradshaw's avatar
JeremyTBradshaw
Iron Contributor
Apr 20, 2022

I believe I may have come up with the reason why it was chosen to NOT offer Mail.ReadBasic.All as a Delegated Permission. It may not be possible to supply the requesting user with the equivalent permission via RBAC role. The closest thing I can think of that would accomplish it would be the ApplicationImpersonation role in Exchange, which would be more permissions than we want in this scenario (re: Mail.ReadBasic.All).

It makes me think that however the Effective Permissions are made possible for Application Permissions, that same capability could stand to be available for some special case Delegated Permissions (like Mail.ReadBasic.All).

Resources