Azure AD Graph Explorer - Read all groups permission

1
votes

If I use "Graph Explorer" (https://developer.microsoft.com/en-us/graph/graph-explorer) with a normal user, I can't read all groups ("Insufficient privileges to complete the operation."). That's the behavior I want.

But if I use "Azure AD Graph Explorer" (https://graphexplorer.azurewebsites.net) with the same user, I can read all groups.

Why ?


UPDATE

With my normal user, I can also create a group: User in AD

Group creation: Azure AD Graph Explorer group creation

1
azureazure-active-directorymicrosoft-graph-api
In the first link, try to modify permissions in the left of it. - Joy Wang-MSFT
The first uses MS Graph API and the second Azure AD Graph API. Maybe there is a difference between required permissions? And as Joy mentioned, check which permissions are being required by the MS Graph API explorer. - juunas
The behavior of "Microsoft Graph" is correct for me. A normal user should not have access to all groups. If he wants access, he has to ask an administrator. - Tovich

1 Answers

0
votes

In the Azure AD Graph Explorer, default access for the user includes Read all directory objects, that's why the normal user can read all groups in Azure AD Graph Explorer. enter image description here For the details, you can read the Azure AD Graph API permission scope.