Understanding Delegated vs Application Permissions in MS Graph API

Introduction

As someone who's worked extensively with Microsoft Graph API integrations, I've learned that understanding the difference between delegated and application permissions is crucial for building secure and effective applications. These two permission types serve different purposes and have distinct use cases that can make or break your integration strategy.

In this post, I'll share my understanding of these permission types using MS Entra ID as our Identity Provider, complete with Python examples and practical scenarios.

What Are Permissions in MS Graph API?

Before diving into the differences, let's establish what permissions are. In the context of MS Graph API, permissions are the authorizations that allow your application to access specific resources and perform certain operations on behalf of users or as the application itself.

With MS Entra ID as your identity provider, there are two fundamental permission types:

1. Delegated Permissions (also called Scopes)

2. Application Permissions (also called App Roles)

Delegated Permissions: Acting on Behalf of Users

What Are Delegated Permissions?

Delegated permissions allow your application to act on behalf of a signed-in user. Think of it as your app borrowing the user's identity and permissions to access resources. The key principle here is that your application can never access more than what the user themselves can access.

Key Characteristics:

• Requires a user to be signed in

• Application acts "on behalf of" the user

• Limited by the user's own permissions

• Uses OAuth 2.0 authorization code flow

• Can be consented by users (for basic permissions) or administrators

Real-World Scenario:

Imagine building a productivity app that helps users manage their Outlook calendar. When a user signs into your app, you request delegated permissions to read their calendar events. Your app can only see the events that the user has access to - nothing more, nothing less.

Python Example with Delegated Permissions:

import msal
import requests
from flask import Flask, session, request, redirect, url_for
import json

app = Flask(__name__)
app.secret_key = 'your-secret-key'

# Configuration
CLIENT_ID = 'your-client-id'
CLIENT_SECRET = 'your-client-secret'
AUTHORITY = 'https://login.microsoftonline.com/your-tenant-id'
REDIRECT_PATH = '/getAToken'
SCOPE = ['https://graph.microsoft.com/Calendars.Read']

@app.route('/')
def index():
    if not session.get('user'):
        return redirect(url_for('login'))
    return f"Hello {session['user']['name']}"

@app.route('/login')
def login():
    # Create MSAL instance
    msal_app = msal.ConfidentialClientApplication(
        CLIENT_ID,
        authority=AUTHORITY,
        client_credential=CLIENT_SECRET
    )
    
    # Generate auth URL
    auth_url = msal_app.get_authorization_request_url(
        SCOPE,
        redirect_uri=url_for('authorized', _external=True)
    )
    
    return redirect(auth_url)

@app.route('/getAToken')
def authorized():
    # Handle the authorization response
    msal_app = msal.ConfidentialClientApplication(
        CLIENT_ID,
        authority=AUTHORITY,
        client_credential=CLIENT_SECRET
    )
    
    # Get token using authorization code
    result = msal_app.acquire_token_by_authorization_code(
        request.args['code'],
        scopes=SCOPE,
        redirect_uri=url_for('authorized', _external=True)
    )
    
    if 'error' in result:
        return f"Error: {result['error']}"
    
    # Store token and user info
    session['access_token'] = result['access_token']
    
    # Call Microsoft Graph to get user info
    headers = {'Authorization': f"Bearer {result['access_token']}"}
    user_response = requests.get('https://graph.microsoft.com/v1.0/me', headers=headers)
    session['user'] = user_response.json()
    
    return redirect(url_for('get_calendar_events'))

@app.route('/calendar')
def get_calendar_events():
    if 'access_token' not in session:
        return redirect(url_for('login'))
    
    # Call Microsoft Graph to get calendar events
    headers = {'Authorization': f"Bearer {session['access_token']}"}
    response = requests.get('https://graph.microsoft.com/v1.0/me/events', headers=headers)
    
    if response.status_code == 200:
        events = response.json()
        return f"<h1>Your Calendar Events</h1><pre>{json.dumps(events, indent=2)}</pre>"
    else:
        return f"Error accessing calendar: {response.status_code}"

if __name__ == '__main__':
    app.run(debug=True)

Application Permissions: Acting as the Application

What Are Application Permissions?

Application permissions allow your application to access resources using its own identity, without any user being signed in. This is also known as "app-only" access. The application acts on its own behalf and can access any data that the permission allows within the tenant.

Key Characteristics:

• No user sign-in required

• Application acts with its own identity

• Can access data across the entire tenant

• Uses OAuth 2.0 client credentials flow

• Only administrators can consent to these permissions

• Commonly used for background services, automation, and data processing

Real-World Scenario:

Consider building a backup service that runs nightly to archive all emails from your organization for compliance purposes. This service needs to access all mailboxes in the tenant without any user interaction. Application permissions are perfect for this scenario.

Python Example with Application Permissions:

import msal
import requests
import json
from datetime import datetime

# Configuration
CLIENT_ID = 'your-client-id'
CLIENT_SECRET = 'your-client-secret'
TENANT_ID = 'your-tenant-id'
AUTHORITY = f'https://login.microsoftonline.com/{TENANT_ID}'
SCOPE = ['https://graph.microsoft.com/.default']

class GraphAPIClient:
    def __init__(self):
        self.access_token = None
        self.msal_app = msal.ConfidentialClientApplication(
            CLIENT_ID,
            authority=AUTHORITY,
            client_credential=CLIENT_SECRET
        )
    
    def get_access_token(self):
        """Get access token using client credentials flow"""
        result = self.msal_app.acquire_token_for_client(scopes=SCOPE)
        
        if "access_token" in result:
            self.access_token = result['access_token']
            print("Access token acquired successfully")
            return True
        else:
            print(f"Error acquiring token: {result.get('error')}")
            print(f"Error description: {result.get('error_description')}")
            return False
    
    def get_all_users(self):
        """Get all users in the tenant - requires User.Read.All application permission"""
        if not self.access_token:
            if not self.get_access_token():
                return None
        
        headers = {
            'Authorization': f'Bearer {self.access_token}',
            'Content-Type': 'application/json'
        }
        
        response = requests.get('https://graph.microsoft.com/v1.0/users', headers=headers)
        
        if response.status_code == 200:
            return response.json()
        else:
            print(f"Error getting users: {response.status_code}")
            print(f"Response: {response.text}")
            return None
    
    def backup_user_emails(self, user_id):
        """Backup emails for a specific user - requires Mail.Read application permission"""
        if not self.access_token:
            if not self.get_access_token():
                return None
        
        headers = {
            'Authorization': f'Bearer {self.access_token}',
            'Content-Type': 'application/json'
        }
        
        # Get user's messages
        url = f'https://graph.microsoft.com/v1.0/users/{user_id}/messages'
        response = requests.get(url, headers=headers)
        
        if response.status_code == 200:
            messages = response.json()
            print(f"Found {len(messages.get('value', []))} messages for user {user_id}")
            return messages
        else:
            print(f"Error getting messages for {user_id}: {response.status_code}")
            return None

def main():
    """Main backup process"""
    print("Starting automated backup process...")
    client = GraphAPIClient()
    
    # Get all users in the tenant
    users_response = client.get_all_users()
    if not users_response:
        print("Failed to get users")
        return
    
    users = users_response.get('value', [])
    print(f"Found {len(users)} users in tenant")
    
    # Backup emails for each user
    for user in users:
        user_id = user['id']
        display_name = user.get('displayName', 'Unknown')
        print(f"Backing up emails for: {display_name}")
        
        messages = client.backup_user_emails(user_id)
        if messages:
            # Here you would save the messages to your backup storage
            print(f"Backup completed for {display_name}")
        else:
            print(f"Backup failed for {display_name}")

if __name__ == '__main__':
    main()

Visual Comparison: Sequence Diagrams

Delegated Permissions Flow

Application Permissions Flow

Key Differences at a Glance

Aspect	Delegated Permissions	Application Permissions
User Context	Requires signed-in user	No user required
Access Scope	Limited to user's permissions	Tenant-wide access
Consent	User or Admin	Admin only
Use Cases	Interactive applications	Background services, automation
OAuth Flow	Authorization Code	Client Credentials
Security Model	User + App permissions	App permissions only
Examples	Web apps, mobile apps	Daemon services, backup tools

Best Practices from My Experience

When to Use Delegated Permissions:

1. Interactive Applications: Web apps, mobile apps, SPAs where users actively interact

2. User-Specific Data: When you need data specific to the signed-in user

3. User Consent Scenarios: When users should control what data they share

4. Personal Productivity Tools: Calendar managers, email clients, document editors

When to Use Application Permissions:

1. Background Services: Automated reporting, data synchronization, backup services

2. Administrative Tools: User provisioning, compliance auditing, tenant management

3. Data Processing: ETL processes, analytics engines, migration tools

4. System Integration: Service-to-service communication without user interaction

Security Considerations:

1. Principle of Least Privilege: Always request the minimum permissions needed

2. Regular Audits: Periodically review and remove unused permissions

3. Monitor Usage: Implement logging to track permission usage

4. Secure Storage: Protect client secrets and access tokens appropriately

Common Pitfalls I've Encountered

1. Over-Requesting Permissions: Asking for more permissions than needed can raise security concerns

2. Mixing Permission Types: Don't try to use both delegated and application permissions in the same flow

3. Ignoring Consent Requirements: Application permissions always require admin consent - plan accordingly

4. Token Lifetime Confusion: Application tokens typically last longer than delegated tokens

Conclusion

Understanding the difference between delegated and application permissions is fundamental to building effective Microsoft Graph integrations. Delegated permissions are perfect when you're building user-facing applications that need to act on behalf of users, while application permissions are ideal for background services and administrative tools.

The choice between these permission types should be driven by your application's architecture, user experience requirements, and security considerations. By choosing the right permission type and following best practices, you can build secure, efficient, and compliant applications that work seamlessly with the Microsoft ecosystem.

Remember: with great permissions come great responsibility. Always follow the principle of least privilege and regularly audit your application's permission usage to maintain a secure and trustworthy system.

Additional Resources

• Microsoft Graph permissions reference

• Microsoft identity platform documentation

• MSAL Python documentation

• Microsoft Graph SDK for Python