Directory.AccessAsUser.All
Export JSON
Export CSV
Copy URL
Print
Delegated
Read
All Resources
Allows the app to have the same access to information in the directory as the signed-in user.
Delegated Access
App-Only Access
Permission Details
Delegated Permission
Admin consent required
Access directory as the signed in user
Allows the app to have the same access to information in the directory as the signed-in user.
User sees: Allows the app to have the same access to information in your work or school directory as you do.
Permission ID:
0e263e50-5827-48a4-b97c-d940288653c7
Properties
| Property | Type | Description |
|---|---|---|
id |
string |
The unique identifier for an entity. Read-only. |
contactInsights |
object |
Contains the properties that are configured by an administrator as a tenant-level privacy control whether to identify duplicate contacts among a user's contacts list and suggest the user to merge those contacts to have a cleaner contacts list. List contactInsights returns the settings to display or return contact insights in an organization. |
microsoftApplicationDataAccess |
object |
|
peopleInsights |
object |
Contains the properties that are configured by an administrator for the visibility of a list of people relevant and working with a user in Microsoft 365. List peopleInsights returns the settings to display or return people insights in an organization. |
itemInsights |
object |
Contains the properties that are configured by an administrator for the visibility of Microsoft Graph-derived insights, between a user and other items in Microsoft 365, such as documents or sites. List itemInsights returns the settings to display or return item insights in an organization. |
Relationships
| Relationship | Type | Description |
|---|---|---|
administrativeUnits |
administrativeUnit collection |
Conceptual container for user and group directory objects. |
attributeSets |
attributeSet collection |
Group of related custom security attribute definitions. |
customSecurityAttributeDefinitions |
customSecurityAttributeDefinition collection |
Schema of a custom security attribute. |
deletedItems |
directoryObject collection |
Recently deleted items. Read-only. Nullable. |
federationConfigurations |
identityProviderBase collection |
Configure domain federation with organizations whose identity provider (IdP) supports either the SAML or WS-Fed protocol. |
onPremisesSynchronization |
onPremisesDirectorySynchronization collection |
A container for on-premises directory synchronization functionalities. |
Graph Methods
Delegated access
App-only access
Code Examples
C# / .NET SDK
// Install: dotnet add package Microsoft.Graph
// Install: dotnet add package Azure.Identity
using Microsoft.Graph;
using Azure.Identity;
// Delegated permissions - interactive user sign-in
var scopes = new[] { "Directory.AccessAsUser.All" };
var options = new InteractiveBrowserCredentialOptions
{
ClientId = "YOUR_CLIENT_ID",
TenantId = "YOUR_TENANT_ID",
RedirectUri = new Uri("http://localhost")
};
var credential = new InteractiveBrowserCredential(options);
var graphClient = new GraphServiceClient(credential, scopes);
// Example: GET /me
var result = await graphClient.Me.GetAsync();
Console.WriteLine($"User: {result?.DisplayName}");
JavaScript / TypeScript
// npm install @azure/msal-browser @microsoft/microsoft-graph-client
import { PublicClientApplication } from "@azure/msal-browser";
import { Client } from "@microsoft/microsoft-graph-client";
import { AuthCodeMSALBrowserAuthenticationProvider } from
"@microsoft/microsoft-graph-client/authProviders/authCodeMsalBrowser";
const msalConfig = {
auth: {
clientId: "YOUR_CLIENT_ID",
authority: "https://login.microsoftonline.com/YOUR_TENANT_ID"
}
};
const pca = new PublicClientApplication(msalConfig);
await pca.initialize();
// Delegated: Login with required scope
const loginResponse = await pca.loginPopup({
scopes: ["Directory.AccessAsUser.All"]
});
const authProvider = new AuthCodeMSALBrowserAuthenticationProvider(pca, {
account: loginResponse.account,
scopes: ["Directory.AccessAsUser.All"],
interactionType: "popup"
});
const graphClient = Client.initWithMiddleware({ authProvider });
// Example: GET /me
const result = await graphClient.api("/me").get();
console.log(result);
PowerShell
# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser
# Delegated access - interactive sign-in
Connect-MgGraph -Scopes "Directory.AccessAsUser.All"
# Verify connection
Get-MgContext | Select-Object Account, TenantId, Scopes
# Example: GET /me
$result = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/me"
$result | ConvertTo-Json -Depth 5
# Always disconnect when done
Disconnect-MgGraph
Python
# pip install msgraph-sdk azure-identity
from azure.identity import InteractiveBrowserCredential, ClientSecretCredential
from msgraph import GraphServiceClient
import asyncio
# Delegated permissions - interactive browser sign-in
credential = InteractiveBrowserCredential(
client_id="YOUR_CLIENT_ID",
tenant_id="YOUR_TENANT_ID"
)
scopes = ["Directory.AccessAsUser.All"]
client = GraphServiceClient(credential, scopes)
async def get_data():
# Example: GET /me
result = await client.me.get()
print(f"User: {result.display_name}")
return result
asyncio.run(get_data())
App Registration
1
Navigate to Azure Portal
Go to App registrations in Microsoft Entra admin center
2
Add API Permission
Select your app → API permissions → Add a permission → Microsoft Graph
3
Select Permission Type
Choose Delegated permissions and search for Directory.AccessAsUser.All
4
Grant Admin Consent
This permission requires admin consent. Grant consent in the Azure portal.