[What and why]
We are correcting the behavior of the Microsoft Graph delegated and app-only permission User.ReadBasic.All. This permission is intended to provide access only to a limited set of basic user profile properties. However, it currently also allows access to user app role assignments and license details.
To address a security vulnerability, we are removing access to user app role assignments and license details from User.ReadBasic.All and aligning the permission with its intended scope. This is not a breaking change for applications that use User.ReadBasic.All only for its intended purpose of accessing basic user profile information.
Applications that rely on this unintended access should be updated with the appropriate least-privileged permissions before rollout is complete.
[Rollout schedule]
- General Availability (Worldwide): Beginning in mid-September 2026 and expected to complete by late September 2026
[Impact on your organization]
Who is affected
Organizations are affected if their applications use the Microsoft Graph delegated or app-only permission User.ReadBasic.All to read:
- User app role assignments
- User license details
Developers, application owners, and administrators responsible for managing application permissions in Microsoft Entra ID should review this change.
Platforms and services
- Microsoft Graph
- Microsoft Entra ID
- Applications using Microsoft Graph permissions
What will happen
- Applications granted only User.ReadBasic.All will no longer be able to read user app role assignments or user license details.
- Applications that access only basic user properties, such as display name, email address, and department, will continue to function without changes.
- Affected applications may experience failures or permission-related errors after the change is applied.
- Users may experience application disruptions if an application has only User.ReadBasic.All but attempts to access user app role assignments or license details.
[Action required and recommendations]
Action is required if you have applications that use User.ReadBasic.All to access user app role assignments or license details.
Recommended actions:
- Review applications granted User.ReadBasic.All in the Microsoft Entra admin center under Enterprise applications > Permissions or in your internal application catalog.
- Identify applications that use this permission to read user app role assignments or user license details.
- Update affected applications to use the appropriate least-privileged permissions:
- To read user app role assignments: User.Read.All
- To read user license details: LicenseAssignment.Read.All
- To read both: User.Read.All
- Obtain administrator consent for the new permissions, update application configurations, redeploy affected applications, and test impacted scenarios.
- Notify developers and application owners of the upcoming permission changes and rollout schedule.
- Monitor application logs and Microsoft Graph API responses for permission-related errors after rollout.
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.