Multi-tenant app — confirming whether our registration requests delegated or application permissions, and why a Global Admin consent was required

akash srivastava 0 Reputation points
2026-09-16T05:02:42.7833333+00:00

Hello,

We publish a multi-tenant SaaS scheduling product ("Arrange") that integrates with Microsoft 365 calendars via Microsoft Graph.

  • Application (client) ID: [Moderator note: Personally Identifiable Information removed]

Context.

A user at one of our customers — a healthcare organization — connected her work Microsoft 365 account to our product. Her IT administrator reports two things that we would like your help interpreting precisely:

  1. A Global Administrator had to authorize the connection; the user could not consent for herself.
  2. The resulting grant appears to him to apply organization-wide, rather than only to the user who connected.

He has read this as evidence that our application is requesting application-type Graph permissions (tenant-wide, app-acting-as-itself), including broad mail access.

What our code does.

Our backend only ever performs the delegated authorization-code flow. Every authorization request goes to https://login.microsoftonline.com/common/oauth2/v2.0/authorize with response_type=code and this exact scope string:

openid profile offline_access User.Read Mail.ReadWrite Calendars.ReadWrite

Token exchange and refresh use grant_type=authorization_code and grant_type=refresh_token against /common/oauth2/v2.0/token.

All Graph calls target the /me/ endpoints.

We have verified that our codebase contains no client_credentials grant, no https://graph.microsoft.com/.default scope, no /adminconsent endpoint usage, and no .All permission.

Our questions.

  1. Can you inspect the API permissions currently configured on the app registration above and confirm, for each, the permission type (Delegated vs Application)?

This is the core question — we want an authoritative list from your side rather than relying solely on our own portal reading, and we need to be certain nothing of application type is configured that our runtime never requests.

  1. Can an application that requests only delegated permissions still require Global Administrator approval?

Our understanding is yes — if the customer tenant's user consent setting is "Do not allow user consent", every third-party application requires admin approval regardless of permission type. Please confirm or correct.

  1. When a Global Administrator grants consent for delegated permissions, the resulting Oauth2PermissionGrant has consentType = AllPrincipals, and the UI describes this as consent "on behalf of your organization."

Can you confirm that such a grant does not permit the application to access any user's mailbox or calendar without that specific user signing in — i.e. that it removes the per-user consent prompt but does not widen the data the access token can reach?

We want to state this to the customer's IT team correctly and would like it confirmed by Microsoft.

  1. If an app registration has application permissions configured but the runtime only ever requests specific delegated scopes via the scope parameter on the v2.0 endpoint, what does the tenant administrator see on the consent screen, and what is actually granted if they approve from the Enterprise Applications blade rather than through our sign-in flow?

We want to understand whether a registration-level permission that we never request at runtime can nevertheless be consented to and appear in the customer's tenant.

  1. What is the exact guidance we should give a customer administrator who wants to audit precisely what our application has been granted in their tenant — which blade, which tab, and which audit-log event type distinguishes a user consent from an admin consent?
  2. Publisher verification: we are not currently publisher-verified. Please confirm the process and whether it changes the consent-screen experience for administrators evaluating our app.

Being able to give this healthcare customer a precise, Microsoft-confirmed answer matters to us — we would rather correct our configuration than explain it away.

Thank you.

Microsoft 365 and Office | Development | Other
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest
  1. Teddie Dang 1,270 Reputation points Independent Advisor
    2026-09-16T06:31:03.3833333+00:00

    Hi @akash srivastava

    I cannot directly inspect the current API permission configuration of application ID from Microsoft's internal tenant data. That information is stored within the application's registration and the customer's tenant, and requires authenticated administrative access to verify.

    Based on the authorization flow and scopes you described, User.Read, Mail.ReadWrite, and Calendars.ReadWrite are being requested as delegated Microsoft Graph permissions. The use of the authorization-code flow together with /me endpoints is also consistent with delegated access rather than app-only access. A Global Administrator may still be required to approve an application that requests only delegated permissions if the organization's user-consent settings restrict or disable user consent. Therefore, the fact that administrator approval was required does not, by itself, indicate that application permissions were requested or granted.

    You can read more at Overview of user and admin consent - Microsoft Entra ID | Microsoft Learn.

    Similarly, an oAuth2PermissionGrant with consentType = AllPrincipals represents administrator consent granted on behalf of all users for delegated permissions. It does not convert delegated permissions into application permissions. Delegated permissions continue to operate in the context of a signed-in user, whereas application permissions can operate without a signed-in user.

    You can read more at Create oAuth2PermissionGrant (a delegated permission grant) - Microsoft Graph v1.0 | Microsoft Learn.

    For an authoritative verification of what has actually been granted in the customer tenant, an administrator can go to Microsoft Entra admin center > Enterprise apps > All applications, search for the application's enterprise application, select it, and then select Permissions under Security. The Admin consent and User consent tabs show the permissions granted at those scopes.

    Please refer to Review permissions granted to enterprise applications - Microsoft Entra ID | Microsoft Learn.

    Because your question specifically requires confirmation of the permissions currently configured on the application registration and the consent grants present in the customer's tenant, you may need to contact Microsoft Support and provide both the Application (client) ID and the affected tenant ID. Microsoft Support may be able to assist with reviewing tenant-specific consent records and configuration details that are not accessible from the community forum or escalate the case to the appropriate team if further investigation is required.

    For further instructions, you can follow this guide: Get support - Microsoft 365 admin | Microsoft Learn.   

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.