Share via

In a web api app registration, should I add the web api "app service" scope in "API permissions"?

Ernesto 61 Reputation points
2024-05-14T17:49:25.2+00:00

Web Api App registration has a configured scope in "Expose an API" section

User's image

should I add the web api scope in "API permissions" also? what Microsoft Graph permissions should I add?

User's image

Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
7,052 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bruce (SqlWork.com) 58,206 Reputation points
    2024-05-14T17:56:44.58+00:00

    you should only add the permissions you want the api access token to have. a user can easily get the token and make their own api calls with it. graph user.read is pretty safe, as the user can only get their own profile.