Changing settings for a single O365 Group via Graph needs Directory.Read.Write.All

%3CLINGO-SUB%20id%3D%22lingo-sub-1382911%22%20slang%3D%22en-US%22%3ERe%3A%20Changing%20settings%20for%20a%20single%20O365%20Group%20via%20Graph%20needs%20Directory.Read.Write.All%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1382911%22%20slang%3D%22en-US%22%3E%3CP%3EUse%20the%20feedback%20controls%20under%20each%20documentation%20article%20to%20leave%20such%20feedback%2C%20or%20post%20it%20on%20the%20Graph%20UserVoice.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1381772%22%20slang%3D%22en-US%22%3EChanging%20settings%20for%20a%20single%20O365%20Group%20via%20Graph%20needs%20Directory.Read.Write.All%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1381772%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20everyone%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'd%20like%20to%20discuss%20the%20fact%20that%20setting%20group%20settings%20%3CSTRONG%3Efor%20a%20single%20O365%20group%3C%2FSTRONG%3E%20via%20MS%20Graph%20needs%26nbsp%3B%3C%2FP%3E%3CDIV%20class%3D%22table-scroll-wrapper%22%3E%3CTABLE%3E%3CTBODY%3E%3CTR%3E%3CTD%3EDirectory.ReadWrite.All%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3C%2FDIV%3E%3CP%3Epermissions.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESee%20this%20article%20for%20details%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fgroupsetting-update%3Fview%3Dgraph-rest-1.0%26amp%3Btabs%3Dcsharp%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fgroupsetting-update%3Fview%3Dgraph-rest-1.0%26amp%3Btabs%3Dcsharp%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EChanging%20the%20settings%20of%20a%20group%20is%20a%20very%20common%20task%20and%20important%20settings%20like%20setting%20access%20for%20external%20are%20included%20there.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20should%20not%20be%20blocked%20behind%20such%20a%20%22%3CEM%3E%3CSTRONG%3Edangerous%3C%2FSTRONG%3E%3C%2FEM%3E%22%20permission%20level%20as%20%3CSTRONG%3EDirectory.ReadWrite.All%3C%2FSTRONG%3E.%20Instead%20it%20should%20use%20%3CSTRONG%3EGroup.ReadWrite.All%3C%2FSTRONG%3E.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20don't%20care%20what%20goes%20on%20behind%20the%20scenes%20(creating%20a%20new%20local%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fgroupsetting-post-groupsettings%3Fview%3Dgraph-rest-1.0%26amp%3Btabs%3Dhttp%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EGroupSettingTemplate%3C%2FA%3E%26nbsp%3Beverytime%20for%20the%20group%20etc%20which%20is%20a%20huge%20overhead%20for%2099%25%20of%20the%20cases).%20I%20just%20want%20to%20ensure%20that%20we%20can%20change%20settings%20for%20single%20groups.%20%3CSPAN%3EThese%20are%20local%20settings%20only%20and%20should%20behave%20the%20same%20as%20changing%20settings%20for%20a%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fde-de%2Fgraph%2Fapi%2Fteam-update%3Fview%3Dgraph-rest-1.0%26amp%3Btabs%3Dhttp%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3Esingle%20team%3C%2FA%3E%3CSPAN%3E.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20I%20know%20this%20is%20an%20azure%20ad%20topic%20therefore%20the%20chances%20that%20there%20will%20be%20any%20feedback%20from%20the%20Microsoft%20side%20(in%20comparison%20to%20Teams%20or%20SharePoint%20topics)%20are%20near%200.%20%3A(%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1381772%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EGraph%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EGroups%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EO365%20groups%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1385405%22%20slang%3D%22en-US%22%3ERe%3A%20Changing%20settings%20for%20a%20single%20O365%20Group%20via%20Graph%20needs%20Directory.Read.Write.All%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1385405%22%20slang%3D%22en-US%22%3EThanks.%20I'll%20try%20my%20luck%20on%20GitHub.%20The%20dozens%20of%20input%20sources%20for%20feedback%20don't%20make%20it%20easy%20to%20deal%20with%20these%20kind%20of%20topics.%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hello everyone,

 

I'd like to discuss the fact that setting group settings for a single O365 group via MS Graph needs 

Directory.ReadWrite.All

permissions.

 

See this article for details:

https://docs.microsoft.com/en-us/graph/api/groupsetting-update?view=graph-rest-1.0&tabs=csharp

 

Changing the settings of a group is a very common task and important settings like setting access for external are included there.

 

This should not be blocked behind such a "dangerous" permission level as Directory.ReadWrite.All. Instead it should use Group.ReadWrite.All.

 

I don't care what goes on behind the scenes (creating a new local GroupSettingTemplate everytime for the group etc which is a huge overhead for 99% of the cases). I just want to ensure that we can change settings for single groups. These are local settings only and should behave the same as changing settings for a single team.

 

And I know this is an azure ad topic therefore the chances that there will be any feedback from the Microsoft side (in comparison to Teams or SharePoint topics) are near 0. :(

2 Replies
Highlighted

Use the feedback controls under each documentation article to leave such feedback, or post it on the Graph UserVoice. 

Highlighted
Thanks. I'll try my luck on GitHub. The dozens of input sources for feedback don't make it easy to deal with these kind of topics.