Microsoft Graph: User.ReadBasic.All will no longer allow reading user app role assignments and license details

User.ReadBasic.All will no longer provide access to user app role assignments and license details starting mid-September 2026 to fix a security issue. Applications needing this data must switch to User.Read.All or LicenseAssignment.Read.All permissions and update accordingly to avoid disruptions. We are correcting the behavior of the Microsoft Graph delegated and app-only permission User.ReadBasic.All. This permission is intended to provide access only to a limited set of basic user profile properties. However, it currently also allows access to user app role assignments and license details. To address a security vulnerability, we are removing access to user app role assignments and license details from User.ReadBasic.All and aligning the permission with its intended scope. This is not a breaking change for applications that use User.ReadBasic.All only for its intended purpose of accessing basic user profile information. Applications that rely on this unintended access should be updated with the appropriate least-privileged permissions before rollout is complete. Rollout schedule General Availability (Worldwide): Beginning in mid-September 2026 and expected to complete by late September 2026 Impact on your organization Who is affected Organizations are affected if their applications use the Microsoft Graph delegated or app-only permission User.ReadBasic.All to read: User app role assignments User license details Developers, application owners, and administrators responsible for managing application permissions in Microsoft Entra ID should review this change. Platforms and services Microsoft Graph Microsoft Entra ID Applications using Microsoft Graph permissions What will happen Applications granted only User.ReadBasic.All will no longer be able to read user app role assignments or user license details. Applications that access only basic user properties, such as display name, email address, and department, will continue to function without changes. Affected applications may experience failures or permission-related errors after the change is applied. Users may experience application disruptions if an application has only User.ReadBasic.All but attempts to access user app role assignments or license details. Action required and recommendations Action is required if you have applications that use User.ReadBasic.All to access user app role assignments or license details. Recommended actions: Review applications granted User.ReadBasic.All in the Microsoft Entra admin center under Enterprise applications > Permissions or […]

The post Microsoft Graph: User.ReadBasic.All will no longer allow reading user app role assignments and license details appeared first on M365 Admin.