MC1470871 Medium
Microsoft Graph: User.ReadBasic.All will no longer allow reading user app role assignments and license details
Summary AI-generated
User.ReadBasic.All in Microsoft Graph will be limited to basic profile data and lose access to user app role assignments/license details to address a security issue.
Suggested actions AI-generated
- Review applications using User.ReadBasic.All
- Identify apps needing user app role/license data
- Update those apps to User.Read.All and/or LicenseAssignment.Read.All
- Obtain admin consent for new permissions
- Update/redeploy affected applications
- Notify developers and app owners
- Monitor applications for permission errors
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1479503 (Updated) Microsoft Defender for Cloud Apps: Permission changes for select App Governance Entra roles
- MC1462464 Microsoft Defender for Cloud Apps: App Governance support for the Cloud Application Administrator role is being retired
- MC1520706 Power Platform – Update for read access to custom connector definitions for Basic User role
- MC1506728 Microsoft Entra: Changes to AgentIdentity.CreateAsManager permission for agent identities
- MC1199765 (Updated) Microsoft Purview: Role management update
- MC1409305 Microsoft Entra: Blocking new assignments to partner tier support roles
Original post from Microsoft
[What and why]
We are correcting the behavior of the Microsoft Graph delegated and app-only permission User.ReadBasic.All. This permission is intended to provide access only to a limited set of basic user profile properties. However, it currently also allows access to user app role assignments and license details.
To address a security vulnerability, we are removing access to user app role assignments and license details from User.ReadBasic.All and aligning the permission with its intended scope. This is not a breaking change for applications that use User.ReadBasic.All only for its intended purpose of accessing basic user profile information.
Applications that rely on this unintended access should be updated with the appropriate least-privileged permissions before rollout is complete.
[Rollout schedule]
- General Availability (Worldwide): Beginning in mid-September 2026 and expected to complete by late September 2026
[Impact on your organization]
Who is affected
Organizations are affected if their applications use the Microsoft Graph delegated or app-only permission User.ReadBasic.All to read:
- User app role assignments
- User license details
Developers, application owners, and administrators responsible for managing application permissions in Microsoft Entra ID should review this change.
Platforms and services
- Microsoft Graph
- Microsoft Entra ID
- Applications using Microsoft Graph permissions
What will happen
- Applications granted only User.ReadBasic.All will no longer be able to read user app role assignments or user license details.
- Applications that access only basic user properties, such as display name, email address, and department, will continue to function without changes.
- Affected applications may experience failures or permission-related errors after the change is applied.
- Users may experience application disruptions if an application has only User.ReadBasic.All but attempts to access user app role assignments or license details.
[Action required and recommendations]
Action is required if you have applications that use User.ReadBasic.All to access user app role assignments or license details.
Recommended actions:
- Review applications granted User.ReadBasic.All in the Microsoft Entra admin center under Enterprise applications > Permissions or in your internal application catalog.
- Identify applications that use this permission to read user app role assignments or user license details.
- Update affected applications to use the appropriate least-privileged permissions:
- To read user app role assignments: User.Read.All
- To read user license details: LicenseAssignment.Read.All
- To read both: User.Read.All
- Obtain administrator consent for the new permissions, update application configurations, redeploy affected applications, and test impacted scenarios.
- Notify developers and application owners of the upcoming permission changes and rollout schedule.
- Monitor application logs and Microsoft Graph API responses for permission-related errors after rollout.
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
Additional details from Microsoft
- Summary
- User.ReadBasic.All will no longer provide access to user app role assignments and license details starting mid-September 2026 to fix a security issue. Applications needing this data must switch to User.Read.All or LicenseAssignment.Read.All permissions and update accordingly to avoid disruptions.