<h3 id="accessreviewreadall">AccessReview.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>d07a8cc0-3d51-4b77-b3b0-32704d1f69fa</td>

<td>ebfcd32b-babb-40f4-a14b-42706e83bd28</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read all access reviews</td>

<td>Read all access reviews that user can access</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read access reviews, reviewers, decisions and settings in the organization, without a signed-in user.</td>

<td>Allows the app to read access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="accessreviewreadwriteall">AccessReview.ReadWrite.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>ef5f7d5c-338f-44b0-86c3-351f46c8bb5f</td>

<td>e4aa47b9-9a69-4109-82ed-36ec70d85ff1</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Manage all access reviews</td>

<td>Manage all access reviews that user can access</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization, without a signed-in user.</td>

<td>Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="accessreviewreadwritemembership">AccessReview.ReadWrite.Membership</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>18228521-a591-40f1-b215-5fad4488c117</td>

<td>5af8c3f5-baca-439a-97b0-ea58a435e269</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Manage access reviews for group and app memberships</td>

<td>Manage access reviews for group and app memberships</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization for group and app memberships, without a signed-in user.</td>

<td>Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings for group and app memberships that the signed-in user has access to in the organization.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="acronymreadall">Acronym.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>8c0aed2c-0c61-433d-b63c-6370ddc73248</td>

<td>9084c10f-a2d6-4713-8732-348def50fe02</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read all acronyms</td>

<td>Read all acronyms that the user can access</td>

</tr>

<tr>

<td>Description</td>

<td>Allows an app to read all acronyms without a signed-in user.</td>

<td>Allows an app to read all acronyms that the signed-in user can access.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>No</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="administrativeunitreadall">AdministrativeUnit.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>134fd756-38ce-4afd-ba33-e9623dbe66c2</td>

<td>3361d15d-be43-4de6-b441-3c746d05163d</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read all administrative units</td>

<td>Read administrative units</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read administrative units and administrative unit membership without a signed-in user.</td>

<td>Allows the app to read administrative units and administrative unit membership on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="administrativeunitreadwriteall">AdministrativeUnit.ReadWrite.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>5eb59dd3-1da2-4329-8733-9dabdc435916</td>

<td>7b8a2d34-6b3f-4542-a343-54651608ad81</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read and write all administrative units</td>

<td>Read and write administrative units</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to create, read, update, and delete administrative units and manage administrative unit membership without a signed-in user.</td>

<td>Allows the app to create, read, update, and delete administrative units and manage administrative unit membership on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="agreementreadall">Agreement.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>2f3e6f8c-093b-4c57-a58b-ba5ce494a169</td>

<td>af2819c9-df71-4dd3-ade7-4d7c9dc653b7</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read all terms of use agreements</td>

<td>Read all terms of use agreements</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read terms of use agreements, without a signed in user.</td>

<td>Allows the app to read terms of use agreements on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="agreementreadwriteall">Agreement.ReadWrite.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>c9090d00-6101-42f0-a729-c41074260d47</td>

<td>ef4b5d93-3104-4664-9053-a5c49ab44218</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read and write all terms of use agreements</td>

<td>Read and write all terms of use agreements</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read and write terms of use agreements, without a signed in user.</td>

<td>Allows the app to read and write terms of use agreements on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="agreementacceptanceread">AgreementAcceptance.Read</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>-</td>

<td>0b7643bb-5336-476f-80b5-18fbfbc91806</td>

</tr>

<tr>

<td>DisplayText</td>

<td>-</td>

<td>Read user terms of use acceptance statuses</td>

</tr>

<tr>

<td>Description</td>

<td>-</td>

<td>Allows the app to read terms of use acceptance statuses on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>-</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="agreementacceptancereadall">AgreementAcceptance.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>d8e4ec18-f6c0-4620-8122-c8b1f2bf400e</td>

<td>a66a5341-e66e-4897-9d52-c2df58c2bfb9</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read all terms of use acceptance statuses</td>

<td>Read terms of use acceptance statuses that user can access</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read terms of use acceptance statuses, without a signed in user.</td>

<td>Allows the app to read terms of use acceptance statuses on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="analyticsread">Analytics.Read</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>-</td>

<td>e03cf23f-8056-446a-8994-7d93dfc8b50e</td>

</tr>

<tr>

<td>DisplayText</td>

<td>-</td>

<td>Read user activity statistics</td>

</tr>

<tr>

<td>Description</td>

<td>-</td>

<td>Allows the app to read the signed-in user's activity statistics, such as how much time the user has spent on emails, in meetings, or in chat sessions.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>-</td>

<td>No</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="apiconnectorsreadall">APIConnectors.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>b86848a7-d5b1-41eb-a9b4-54a4e6306e97</td>

<td>1b6ff35f-31df-4332-8571-d31ea5a4893f</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read API connectors for authentication flows</td>

<td>Read API connectors for authentication flows</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read the API connectors used in user authentication flows, without a signed-in user.</td>

<td>Allows the app to read the API connectors used in user authentication flows, on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="apiconnectorsreadwriteall">APIConnectors.ReadWrite.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>1dfe531a-24a6-4f1b-80f4-7a0dc5a0a171</td>

<td>c67b52c5-7c69-48b6-9d48-7b3af3ded914</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read and write API connectors for authentication flows</td>

<td>Read and write API connectors for authentication flows</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read, create and manage the API connectors used in user authentication flows, without a signed-in user.</td>

<td>Allows the app to read, create and manage the API connectors used in user authentication flows, on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="appcatalogreadall">AppCatalog.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>e12dae10-5a57-4817-b79d-dfbec5348930</td>

<td>88e58d74-d3df-44f3-ad47-e89edf4472e4</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read all app catalogs</td>

<td>Read all app catalogs</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read apps in the app catalogs without a signed-in user.</td>

<td>Allows the app to read the apps in the app catalogs.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>No</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="appcatalogreadwriteall">AppCatalog.ReadWrite.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>dc149144-f292-421e-b185-5953f2e98d7f</td>

<td>1ca167d5-1655-44a1-8adf-1414072e1ef9</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read and write to all app catalogs</td>

<td>Read and write to all app catalogs</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to create, read, update, and delete apps in the app catalogs without a signed-in user.</td>

<td>Allows the app to create, read, update, and delete apps in the app catalogs.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="appcatalogsubmit">AppCatalog.Submit</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>-</td>

<td>3db89e36-7fa6-4012-b281-85f3d9d9fd2e</td>

</tr>

<tr>

<td>DisplayText</td>

<td>-</td>

<td>Submit application packages to the catalog and cancel pending submissions</td>

</tr>

<tr>

<td>Description</td>

<td>-</td>

<td>Allows the app to submit application packages to the catalog and cancel submissions that are pending review on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>-</td>

<td>No</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="appcerttrustconfigurationreadall">AppCertTrustConfiguration.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>-</td>

<td>af281d3a-030d-4122-886e-146fb30a0413</td>

</tr>

<tr>

<td>DisplayText</td>

<td>-</td>

<td>Read the trusted certificate authority configuration for applications</td>

</tr>

<tr>

<td>Description</td>

<td>-</td>

<td>Allows the app to read the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>-</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="appcerttrustconfigurationreadwriteall">AppCertTrustConfiguration.ReadWrite.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>-</td>

<td>4bae2ed4-473e-4841-a493-9829cfd51d48</td>

</tr>

<tr>

<td>DisplayText</td>

<td>-</td>

<td>Read and write the trusted certificate authority configuration for applications</td>

</tr>

<tr>

<td>Description</td>

<td>-</td>

<td>Allows the app to create, read, update and delete the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>-</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="applicationreadall">Application.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>9a5d68dd-52b0-4cc2-bd40-abcf44ac3a30</td>

<td>c79f8feb-a9db-4090-85f9-90d820caa0eb</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read all applications</td>

<td>Read applications</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read all applications and service principals without a signed-in user.</td>

<td>Allows the app to read applications and service principals on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<p><img src="images/permissions-reference/msa.svg" alt="personal Microsoft accounts" title="personal Microsoft accounts (MSA)" data-linktype="relative-path"/> The <em>Application.Read.All</em> delegated permission is available for consent in personal Microsoft accounts.</p>

<hr/>

<h3 id="applicationreadwriteall">Application.ReadWrite.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9</td>

<td>bdfbf15f-ee85-4955-8675-146e8e5296b5</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read and write all applications</td>

<td>Read and write all applications</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to create, read, update and delete applications and service principals without a signed-in user. Does not allow management of consent grants.</td>

<td>Allows the app to create, read, update and delete applications and service principals on behalf of the signed-in user. Does not allow management of consent grants.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<p><img src="images/permissions-reference/msa.svg" alt="personal Microsoft accounts" title="personal Microsoft accounts (MSA)" data-linktype="relative-path"/> The <em>Application.ReadWrite.All</em> delegated permission is available for consent in personal Microsoft accounts.</p>

<!-- markdownlint-disable MD002 MD041 -->

<p>Permissions that allow managing credentials, such as <em>Application.ReadWrite.All</em>, allow an application to act as other entities, and use the privileges they were granted. Use caution when granting any of these permissions.</p>

<hr/>

<h3 id="applicationreadwriteownedby">Application.ReadWrite.OwnedBy</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>18a4783c-866b-4cc7-a460-3d5e5662c884</td>

<td>-</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Manage apps that this app creates or owns</td>

<td>-</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to create other applications, and fully manage those applications (read, update, update application secrets and delete), without a signed-in user.  It cannot update any apps that it is not an owner of.</td>

<td>-</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>-</td>

</tr>

</tbody>

</table>

<!-- markdownlint-disable MD002 MD041 -->

<p>The <em>Application.ReadWrite.OwnedBy</em> permission allows the same operations as <em>Application.ReadWrite.All</em> but only on applications and service principals that the calling app is an owner of.</p>

<p>The <em>Application.ReadWrite.OwnedBy</em> permission allows an app to call <code>GET /applications</code> and <code>GET /servicePrincipals</code> endpoints to list all applications and service principals in the tenant. This scope of access has been allowed for the permission.</p>

<hr/>

<h3 id="application-remotedesktopconfigreadwriteall">Application-RemoteDesktopConfig.ReadWrite.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>3be0012a-cc4e-426b-895b-f9c836bf6381</td>

<td>ffa91d43-2ad8-45cc-b592-09caddeb24bb</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read and write the remote desktop security configuration for all apps</td>

<td>Read and write the remote desktop security configuration for apps</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read and write the remote desktop security configuration for all apps in your organization, without a signed-in user.</td>

<td>Allows the app to read and write other apps' remote desktop security configuration, on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="approleassignmentreadwriteall">AppRoleAssignment.ReadWrite.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>06b708a9-e830-4db3-a914-8e69da51d44f</td>

<td>84bccea3-f856-4a8a-967b-dbe0a3d53a64</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Manage app permission grants and app role assignments</td>

<td>Manage app permission grants and app role assignments</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.</td>

<td>Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<!-- markdownlint-disable MD002 MD041 -->

<p>Permissions that allow granting authorization, such as <em>AppRoleAssignment.ReadWrite.All</em>, allow an application to grant additional privileges to itself, other applications, or any user. Use caution when granting any of these permissions.</p>

<hr/>

<h3 id="attacksimulationreadall">AttackSimulation.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>93283d0a-6322-4fa8-966b-8c121624760d</td>

<td>104a7a4b-ca76-4677-b7e7-2f4bc482f381</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read attack simulation data of an organization</td>

<td>Read attack simulation data of an organization</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read attack simulation and training data for an organization without a signed-in user.</td>

<td>Allows the app to read attack simulation and training data for an organization for the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="attacksimulationreadwriteall">AttackSimulation.ReadWrite.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>e125258e-8c8a-42a8-8f55-ab502afa52f3</td>

<td>27608d7c-2c66-4cad-a657-951d575f5a60</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read, create, and update all attack simulation data of an organization</td>

<td>Read, create, and update attack simulation data of an organization</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read, create, and update attack simulation and training data for an organization without a signed-in user.</td>

<td>Allows the app to read, create, and update attack simulation and training data for an organization for the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>No</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="auditlogreadall">AuditLog.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>b0afded3-3588-46d8-8b3d-9842eff778da</td>

<td>e4c9e354-4dc5-45b8-9e7c-e1393b0b1a20</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read all audit log data</td>

<td>Read audit log data</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read and query your audit log activities, without a signed-in user.</td>

<td>Allows the app to read and query your audit log activities, on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="auditlogsqueryreadall">AuditLogsQuery.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>5e1e9171-754d-478c-812c-f1755a9a4c2d</td>

<td>1d9e7ac3-0eca-442c-82f9-e92625af6e6d</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read audit logs data from all services</td>

<td>Read audit logs data from all services</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read and query audit logs from all services.</td>

<td>Allows the app to read and query audit logs from all services, on behalf of a signed-in user</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="auditlogsquery-crmreadall">AuditLogsQuery-CRM.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>20e6f8e4-ffac-4cf7-82f7-70ddb7564318</td>

<td>ba78b16f-1e01-41b6-89ca-73e0a32b304c</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read audit logs data from Dynamics CRM workload</td>

<td>Read audit logs data from Dynamics CRM workload</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read and query audit logs from Dynamics CRM workload, without a signed-in user</td>

<td>Allows the app to read and query audit logs from Dynamics CRM workload, on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="auditlogsquery-endpointreadall">AuditLogsQuery-Endpoint.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>0bc85aed-7b0b-437a-bac8-3b29a1b84c99</td>

<td>ee3409fe-617f-43cf-bd1e-fc8b38049e69</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read audit logs data from Endpoint Data Loss Prevention workload</td>

<td>Read audit logs data from Endpoint Data Loss Prevention workload</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, without a signed-in user</td>

<td>Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="auditlogsquery-entrareadall">AuditLogsQuery-Entra.Read.All</h3>

<table>

<thead>

<tr>

<th>Category</th>

<th>Application</th>

<th>Delegated</th>

</tr>

</thead>

<tbody>

<tr>

<td>Identifier</td>

<td>7276d950-48fc-4269-8348-f22f2bb296d0</td>

<td>5ff2f415-e0f1-4d11-bfd0-6d87c0f667fd</td>

</tr>

<tr>

<td>DisplayText</td>

<td>Read audit logs data from Entra (Azure AD) workload</td>

<td>Read audit logs data from Entra (Azure AD) workload</td>

</tr>

<tr>

<td>Description</td>

<td>Allows the app to read and query audit logs from Entra (Azure AD) workload, without a signed-in user</td>

<td>Allows the app to read and query audit logs from Entra (Azure AD) workload, on behalf of the signed-in user.</td>

</tr>

<tr>

<td>AdminConsentRequired</td>

<td>Yes</td>

<td>Yes</td>

</tr>

</tbody>

</table>

<hr/>

<h3 id="auditlogsquery-exchangereadall">AuditLogsQuery-Exchange.Read.All</h3>