A delegated permission grant authorizes a client service principal (representing a client application) to access a resource service principal (representing an API), on behalf of a signed-in user, for the level of access limited by the delegated permissions which were granted.
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.
Permission type
Least privileged permissions
Higher privileged permissions
Delegated (work or school account)
DelegatedPermissionGrant.ReadWrite.All
Directory.ReadWrite.All
Delegated (personal Microsoft account)
Not supported.
Not supported.
Application
DelegatedPermissionGrant.ReadWrite.All
Directory.ReadWrite.All
HTTP request
POST /oauth2PermissionGrants
Request headers
Name
Type
Description
Authorization
string
Bearer {token}. Required.
Request body
In the request body, supply a JSON representation of an oAuth2PermissionGrant object.
Response
If successful, this method returns a 200-series response code and a new oAuth2PermissionGrant object in the response body. The following table lists the properties that are required when you create the oAuth2PermissionGrant.
Property
Type
Description
clientId
String
The object id (notappId) of the client service principal for the application which is authorized to act on behalf of a signed-in user when accessing an API. Required.
consentType
String
Indicates whether authorization is granted for the client application to impersonate all users or only a specific user. AllPrincipals indicates authorization to impersonate all users. Principal indicates authorization to impersonate a specific user. Consent on behalf of all users can be granted by an administrator. Non-admin users may be authorized to consent on behalf of themselves in some cases, for some delegated permissions. Required.
principalId
String
The id of the user on behalf of whom the client is authorized to access the resource, when consentType is Principal. If consentType is AllPrincipals this value is null. Required when consentType is Principal.
resourceId
String
The id of the resource service principal to which access is authorized. This identifies the API which the client is authorized to attempt to call on behalf of a signed-in user.
scope
String
A space-separated list of the claim values for delegated permissions which should be included in access tokens for the resource application (the API). For example, openid User.Read GroupMember.Read.All. Each claim value should match the value field of one of the delegated permissions defined by the API, listed in the oauth2PermissionScopes property of the resource service principal. Must not exceed 3850 characters in length.
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Models;
var requestBody = new OAuth2PermissionGrant
{
ClientId = "ef969797-201d-4f6b-960c-e9ed5f31dab5",
ConsentType = "AllPrincipals",
ResourceId = "943603e4-e787-4fe9-93d1-e30f749aae39",
Scope = "DelegatedPermissionGrant.ReadWrite.All",
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Oauth2PermissionGrants.PostAsync(requestBody);
// THE CLI IS IN PREVIEW. NON-PRODUCTION USE ONLY
mgc oauth2-permission-grants create --body '{\
"clientId": "ef969797-201d-4f6b-960c-e9ed5f31dab5",\
"consentType": "AllPrincipals",\
"resourceId": "943603e4-e787-4fe9-93d1-e30f749aae39",\
"scope": "DelegatedPermissionGrant.ReadWrite.All"\
}\
'
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
OAuth2PermissionGrant oAuth2PermissionGrant = new OAuth2PermissionGrant();
oAuth2PermissionGrant.setClientId("ef969797-201d-4f6b-960c-e9ed5f31dab5");
oAuth2PermissionGrant.setConsentType("AllPrincipals");
oAuth2PermissionGrant.setResourceId("943603e4-e787-4fe9-93d1-e30f749aae39");
oAuth2PermissionGrant.setScope("DelegatedPermissionGrant.ReadWrite.All");
OAuth2PermissionGrant result = graphClient.oauth2PermissionGrants().post(oAuth2PermissionGrant);
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.