Microsoft Graph: User.ReadBasic.All will no longer allow reading user app role assignments and license details

🚨 The Signal: Microsoft Graph's User.ReadBasic.All permission will no longer grant access to user app role assignments or license details. This change corrects an over-privileged permission, enhancing security by enforcing least privilege and reducing data exposure.

The Impact

Developers and application owners are affected; applications using User.ReadBasic.All for license or role data will fail, posing an operational risk.

• Developers: Must update applications to use correct, least-privileged Graph permissions.
• Application Owners: Applications may cease functioning if not updated, impacting business processes.
• Security Teams: Review application permissions to ensure least privilege is maintained post-change.
• Administrators: Identify and remediate applications relying on the old permission behavior.

The Action

1. Identify applications using User.ReadBasic.All via Microsoft Entra admin center > Identity > Applications > App registrations > Permissions > API permissions.
2. For identified applications, review their code to determine if they access user app role assignments or license details.
3. If access is required, update application code to request and use the appropriate least-privileged Microsoft Graph permissions (e.g., User.Read.All, Organization.Read.All, Directory.Read.All).
4. Grant the newly required permissions to the application in Microsoft Entra ID.
5. Test updated applications thoroughly to ensure continued functionality before the September 2026 rollout.

Domain: Entra · Impact: high · Workload: Entra ID · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898