ProgramControl.ReadWrite.All | Graph Permissions

Permission Details

Application Permission

Manage all programs

Allows the app to read, update, delete and perform actions on programs and program controls in the organization, without a signed-in user.

Permission ID: 60a901ed-09f7-4aa5-a16e-7dd3d6f9de36

Delegated Permission

Manage all programs that user can access

Allows the app to read, update, delete and perform actions on programs and program controls that the signed-in user has access to in the organization.

Permission ID: 50fd364f-9d93-4ae1-b170-300e87cccf84

Properties

Microsoft Graph beta exact-category-docs

Properties is shown from beta metadata because a stable v1.0 schema is not available for this resource mapping.

Property	Type	Description
`id`	`String`	The feature-assigned identifier of the link between program and control.
`programId`	`String`	The programId of the program this control is a part of. Required on create.
`controlId`	`String`	The controlId of the control, in particular the identifier of an access review. Required on create.
`controlTypeId`	`String`	The programControlType identifies the type of program control - for example, a control linking to guest access reviews. Required on create.
`displayName`	`String`Nullable	The name of the control.
`status`	`String`Nullable	The life cycle status of the control.
`createdDateTime`	`DateTimeOffset`	The creation date and time of the program control.
`owner`	`userIdentity`	The user who created the program control.
`resource`	`programResource`	The resource, a group or an app, targeted by this program control's access review.
`program`	`object`	The program this control is part of.

JSON Representation

Microsoft Graph beta exact-category-docs

JSON representation is shown from beta metadata because a stable v1.0 schema is not available for this resource mapping.

JSON representation

{
  "id": "string (identifier)",
  "programId": "string (identifier)",
  "controlId": "string (identifier)",
  "controlTypeId": "string (identifier)",
  "displayName": "string",
  "status": "string",
  "createdDateTime": "string (timestamp)",
  "owner": {
    "@odata.type": "microsoft.graph.userIdentity"
  },
  "resource": {
    "@odata.type": "microsoft.graph.programResource"
  }
}

Relationships

Microsoft Graph beta exact-category-docs

Relationships is shown from beta metadata because a stable v1.0 schema is not available for this resource mapping.

Relationship	Type	Description
`program`	`program`	The program this control is part of.
`owner`	`object`	The user who created the program control.

Graph Methods

Delegated access App-only access

Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

No API methods available for this version.

Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET `/programControls`
GET `/programControlTypes`
GET `/programs`
GET `/programs/{programId}/controls`
POST `/programControls`
POST `/programs`
PATCH `/programs/{programId}`
DELETE `/programControls/{id}`
DELETE `/programs/{id}`

Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

No deterministic PowerShell command map is available for this permission.

Browse PowerShell docs

Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
`Get-MgBetaProgram` /programs List programs (deprecated)
`Get-MgBetaProgramControl` /programControls List programControls (deprecated)
`Get-MgBetaProgramControlType` /programControlTypes List programControlTypes (deprecated)
`New-MgBetaProgram` /programs Create program (deprecated)
`New-MgBetaProgramControl` /programControls Create programControl (deprecated)
`Remove-MgBetaProgram` /programs/{id} Delete program (deprecated)
`Remove-MgBetaProgramControl` /programControls/{id} Delete programControl (deprecated)
`Update-MgBetaProgram` /programs/{programId} Update program (deprecated)

Code Examples

C# / .NET SDK

Create program (deprecated)

View official example on Microsoft Learn

// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Beta.Models;

var requestBody = new Program
{
	DisplayName = "testprogram3",
	Description = "test description",
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Programs.PostAsync(requestBody);

JavaScript

Create program (deprecated)

View official example on Microsoft Learn

const options = {
	authProvider,
};

const client = Client.init(options);

const program = {
    displayName: 'testprogram3',
    description: 'test description'
};

await client.api('/programs')
	.version('beta')
	.post(program);

PowerShell

Create program (deprecated)

View official example on Microsoft Learn

Import-Module Microsoft.Graph.Beta.Identity.Governance

$params = @{
	displayName = "testprogram3"
	description = "test description"
}

New-MgBetaProgram -BodyParameter $params

Python

Create program (deprecated)

View official example on Microsoft Learn

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.program import Program
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Program(
	display_name = "testprogram3",
	description = "test description",
)

result = await graph_client.programs.post(request_body)

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or delegated permissions and search for ProgramControl.ReadWrite.All

4

Grant Admin Consent

Application permissions always require admin consent.

Frequently asked questions

What is the ProgramControl.ReadWrite.All Microsoft Graph permission?

ProgramControl.ReadWrite.All is available as both an application permission and a delegated permission in the Microsoft Graph API, grouped under the ProgramControl category. Allows the app to read, update, delete and perform actions on programs and program controls in the organization, without a signed-in user. It grants read and write access to resources. Application permissions always require admin consent. It is mapped to the Microsoft Graph programcontrol resource type. 9 documented Microsoft Graph REST methods require it. 8 Microsoft Graph PowerShell commands are documented for it.

Is ProgramControl.ReadWrite.All an application or a delegated permission?

ProgramControl.ReadWrite.All is available as both an application permission (app-only access, no signed-in user) and a delegated permission (access on behalf of a signed-in user).

Does ProgramControl.ReadWrite.All require admin consent?

Application permissions always require admin consent.

What is the permission ID (GUID) for ProgramControl.ReadWrite.All?

For ProgramControl.ReadWrite.All, the application (app role) ID is 60a901ed-09f7-4aa5-a16e-7dd3d6f9de36, and the delegated (OAuth2 scope) ID is 50fd364f-9d93-4ae1-b170-300e87cccf84. These are the real Microsoft Graph identifiers and can be used directly in an app registration manifest.