Microsoft Graph permissions

If Graph permissions are too broad, one mis-scoped app permission can let AI surface files, spreadsheets and client data that users could not normally access. Copilot treated as a high-privilege app needs least-privilege scopes. · From the episode: Secure and Govern Microsoft 365 Copilot

The episode explains that Conditional Access alone does not protect agents. Agents running with human identities and oversized Graph permissions need their own ownership, scoping and lifecycle controls. · From the episode: Secure AI Agents and Shadow IT in Microsoft 365

Agents may run with human identities and broad Microsoft Graph permissions. If they are also unowned and never reviewed, they can access far more data than intended. · From the episode: Secure AI Agents and Shadow IT in Microsoft 365

Only the smallest set that matches how the app really runs. Asking for minimum scopes keeps the app safer and makes consent easier, and it helps to document why each scope is required. · From the episode: Microsoft Graph Permissions and Consent Models…

Some permissions, notably application permissions, require an admin to approve them before they work. Plan for this approval early, since it protects important company data and can otherwise delay a rollout. · From the episode: Microsoft Graph Permissions and Consent Models…