Subscription.Read.All
Export JSON
Export CSV
Copy URL
Print
Delegated
Read
All Resources
Allows the app to read all webhook subscriptions on behalf of the signed-in user.
Delegated Access
App-Only Access
Permission Details
Delegated Permission
Admin consent required
Read all webhook subscriptions
Allows the app to read all webhook subscriptions on behalf of the signed-in user.
User sees: Allows the app to read all webhook subscriptions on your behalf.
Permission ID:
5f88184c-80bb-4d52-9ff2-757288b2e9b7
Properties
| Property | Type | Description |
|---|---|---|
id |
string |
The unique identifier for an entity. Read-only. |
expirationDateTime |
date-time |
Required. Specifies the date and time when the webhook subscription expires. The time is in UTC, and can be an amount of time from subscription creation that varies for the resource subscribed to. Any value under 45 minutes after the time of the request is automatically set to 45 minutes after the request time. For the maximum supported subscription length of time, see Subscription lifetime. |
notificationContentType |
stringNullable |
Optional. Desired content-type for Microsoft Graph change notifications for supported resource types. The default content-type is application/json. |
notificationQueryOptions |
stringNullable |
Optional. OData query options for specifying the value for the targeting resource. Clients receive notifications when the resource reaches the state matching the query options provided here. With this new property in the subscription creation payload along with all existing properties, Webhooks deliver notifications whenever a resource reaches the desired state mentioned in the notificationQueryOptions property. For example, when the print job is completed or when a print job resource isFetchable property value becomes true etc. Supported only for Universal Print Service. For more information, see Subscribe to change notifications from cloud printing APIs using Microsoft Graph. |
notificationUrlAppId |
stringNullable |
Optional. The app ID that the subscription service can use to generate the validation token. The value allows the client to validate the authenticity of the notification received. |
lifecycleNotificationUrl |
stringNullable |
Required for Teams resources if the expirationDateTime value is more than 1 hour from now; optional otherwise. The URL of the endpoint that receives lifecycle notifications, including subscriptionRemoved, reauthorizationRequired, and missed notifications. This URL must make use of the HTTPS protocol. For more information, see Reduce missing subscriptions and change notifications. |
applicationId |
stringNullable |
Optional. Identifier of the application used to create the subscription. Read-only. |
latestSupportedTlsVersion |
stringNullable |
Optional. Specifies the latest version of Transport Layer Security (TLS) that the notification endpoint, specified by notificationUrl, supports. The possible values are: v10, v11, v12, v13. For subscribers whose notification endpoint supports a version lower than the currently recommended version (TLS 1.2), specifying this property by a set timeline allows them to temporarily use their deprecated version of TLS before completing their upgrade to TLS 1.2. For these subscribers, not setting this property per the timeline would result in subscription operations failing. For subscribers whose notification endpoint already supports TLS 1.2, setting this property is optional. In such cases, Microsoft Graph defaults the property to v1_2. |
encryptionCertificate |
stringNullable |
Optional. A base64-encoded representation of a certificate with a public key used to encrypt resource data in change notifications. Optional but required when includeResourceData is true. |
resource |
string |
Required. Specifies the resource that is monitored for changes. Don't include the base URL (https://graph.microsoft.com/beta/). See the possible resource path values for each supported resource. |
changeType |
string |
Required. Indicates the type of change in the subscribed resource that raises a change notification. The supported values are: created, updated, deleted. Multiple values can be combined using a comma-separated list. Note: Drive root item and list change notifications support only the updated changeType. User and group change notifications support updated and deleted changeType. Use updated to receive notifications when user or group is created, updated, or soft deleted. Use deleted to receive notifications when user or group is permanently deleted. |
creatorId |
stringNullable |
Optional. Identifier of the user or service principal that created the subscription. If the app used delegated permissions to create the subscription, this field contains the ID of the signed-in user the app called on behalf of. If the app used application permissions, this field contains the ID of the service principal corresponding to the app. Read-only. |
notificationUrl |
string |
Required. The URL of the endpoint that receives the change notifications. This URL must make use of the HTTPS protocol. Any query string parameter included in the notificationUrl property is included in the HTTP POST request when Microsoft Graph sends the change notifications. |
includeResourceData |
booleanNullable |
Optional. When set to true, change notifications include resource data (such as content of a chat message). |
encryptionCertificateId |
stringNullable |
Optional. A custom app-provided identifier to help identify the certificate needed to decrypt resource data. Required when includeResourceData is true. |
Showing 15 of 16 properties. View all on Microsoft Learn →
JSON Representation
JSON representation
{
"id": "String",
"expirationDateTime": "String",
"notificationContentType": "String",
"notificationQueryOptions": "String",
"notificationUrlAppId": "String",
"lifecycleNotificationUrl": "String",
"applicationId": "String",
"latestSupportedTlsVersion": "String",
"encryptionCertificate": "String",
"resource": "String",
"changeType": "String",
"creatorId": "String",
"notificationUrl": "String",
"includeResourceData": "Boolean",
"encryptionCertificateId": "String",
"clientState": "String"
}
Graph Methods
Code Examples
C# / .NET SDK
// Install: dotnet add package Microsoft.Graph
// Install: dotnet add package Azure.Identity
using Microsoft.Graph;
using Azure.Identity;
// Delegated permissions - interactive user sign-in
var scopes = new[] { "Subscription.Read.All" };
var options = new InteractiveBrowserCredentialOptions
{
ClientId = "YOUR_CLIENT_ID",
TenantId = "YOUR_TENANT_ID",
RedirectUri = new Uri("http://localhost")
};
var credential = new InteractiveBrowserCredential(options);
var graphClient = new GraphServiceClient(credential, scopes);
// Example: GET /me
var result = await graphClient.Me.GetAsync();
Console.WriteLine($"User: {result?.DisplayName}");
JavaScript / TypeScript
// npm install @azure/msal-browser @microsoft/microsoft-graph-client
import { PublicClientApplication } from "@azure/msal-browser";
import { Client } from "@microsoft/microsoft-graph-client";
import { AuthCodeMSALBrowserAuthenticationProvider } from
"@microsoft/microsoft-graph-client/authProviders/authCodeMsalBrowser";
const msalConfig = {
auth: {
clientId: "YOUR_CLIENT_ID",
authority: "https://login.microsoftonline.com/YOUR_TENANT_ID"
}
};
const pca = new PublicClientApplication(msalConfig);
await pca.initialize();
// Delegated: Login with required scope
const loginResponse = await pca.loginPopup({
scopes: ["Subscription.Read.All"]
});
const authProvider = new AuthCodeMSALBrowserAuthenticationProvider(pca, {
account: loginResponse.account,
scopes: ["Subscription.Read.All"],
interactionType: "popup"
});
const graphClient = Client.initWithMiddleware({ authProvider });
// Example: GET /me
const result = await graphClient.api("/me").get();
console.log(result);
PowerShell
# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser
# Delegated access - interactive sign-in
Connect-MgGraph -Scopes "Subscription.Read.All"
# Verify connection
Get-MgContext | Select-Object Account, TenantId, Scopes
# Example: GET /me
$result = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/me"
$result | ConvertTo-Json -Depth 5
# Always disconnect when done
Disconnect-MgGraph
Python
# pip install msgraph-sdk azure-identity
from azure.identity import InteractiveBrowserCredential, ClientSecretCredential
from msgraph import GraphServiceClient
import asyncio
# Delegated permissions - interactive browser sign-in
credential = InteractiveBrowserCredential(
client_id="YOUR_CLIENT_ID",
tenant_id="YOUR_TENANT_ID"
)
scopes = ["Subscription.Read.All"]
client = GraphServiceClient(credential, scopes)
async def get_data():
# Example: GET /me
result = await client.me.get()
print(f"User: {result.display_name}")
return result
asyncio.run(get_data())
App Registration
1
Navigate to Azure Portal
Go to App registrations in Microsoft Entra admin center
2
Add API Permission
Select your app → API permissions → Add a permission → Microsoft Graph
3
Select Permission Type
Choose Delegated permissions and search for Subscription.Read.All
4
Grant Admin Consent
This permission requires admin consent. Grant consent in the Azure portal.