A dune-grass nursery portal reads the signed-in grower’s profile wi…

Question

A dune-grass nursery portal reads the signed-in grower’s profile with User.Read, while a nightly job must read every grower as the app itself with User.Read.All. How should the developer map those permission types on the identity platform?

Accepted Answer

User.Read as a delegated permission (scp claim) for the signed-in grower, and User.Read.All as an application permission (roles claim) for the nightly job — Signed-in grower? That’s delegated—permissions ride along as scopes. Nightly job with no user? That’s application permissions showing up as roles.

Answer

Both calls use application permissions, and User.Read is renamed at runtime for the portal

Answer

User.Read.All as a delegated scope for both callers so admin consent covers the portal too

Answer

Neither permission—issue shared access signatures against Microsoft Graph instead

A dune-grass nursery portal reads the signed-in grower’s profile with User.Read, while a nightly job must read every grower as the app itself with User.Read.All. How should the developer map those permission types on the identity platform?

Short Explanation

Full Explanation