Application.Read.All alongside the write scope. Sites.Selected does not apply.
Minimal scopes per action
Each Microsoft Entra connection also requests
openid, offline_access, and User.Read. These connection scopes apply in addition to the action scopes in the table.| Action | Description | Minimum scopes |
|---|---|---|
| Add client secret | Adds a client secret to an application registration. | Application.ReadWrite.All |
| Add redirect URI | Adds a redirect URI to an application registration. | Application.ReadWrite.All |
| Assign app role | Assigns an application permission (app role) to an application or service principal. | AppRoleAssignment.ReadWrite.AllApplication.Read.All |
| Create permission grant | Creates a delegated OAuth permission grant for a service principal. | DelegatedPermissionGrant.ReadWrite.AllApplication.Read.All |
| Delete permission grant | Deletes a delegated OAuth permission grant. | DelegatedPermissionGrant.ReadWrite.AllApplication.Read.All |
| Get application | Gets an application registration, including credentials and API permissions. | Application.Read.All |
| Get manager | Gets the direct manager of a user. | User.Read.All |
| Get permission grant | Gets a delegated OAuth permission grant by ID. | Directory.Read.All |
| List app role assignments | Lists application permissions granted to an application or service principal. | Application.Read.All |
| List expiring credentials | Lists application secrets and certificates that are expired or expiring soon. | Application.Read.All |
| List permission grants | Lists delegated OAuth permission grants for an application or service principal. | Directory.Read.AllApplication.Read.All |
| Remove app role | Removes an application permission from an application or service principal. | AppRoleAssignment.ReadWrite.AllApplication.Read.All |
| Remove client secret | Removes a client secret from an application registration. | Application.ReadWrite.All |
| Remove redirect URI | Removes a redirect URI from an application registration. | Application.ReadWrite.All |
| Resolve application | Resolves an application registration by ID or name. | Application.Read.All |
| Resolve group | Resolves a group in the directory. | GroupMember.Read.All |
| Search applications | Searches application registrations. | Application.Read.All |
| Search group members | Lists user members of a group, including profile fields and optional manager. | GroupMember.Read.AllUser.Read.All |
| Search groups | Searches groups in the directory. | GroupMember.Read.All |
| Search users | Searches users in the directory. | User.Read.All |
| Update permission grant | Updates scopes on an existing delegated OAuth permission grant. | DelegatedPermissionGrant.ReadWrite.AllApplication.Read.All |