User.Read
Export JSON
Export CSV
Copy URL
Print
Delegated
Read
User Scope
Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users.
Delegated Access
App-Only Access
Permission Details
Delegated Permission
User consent allowed
Sign in and read user profile
Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users.
User sees: Allows you to sign in to the app with your organizational account and let the app read your profile. It also allows the app to read basic company information.
Permission ID:
e1fe6dd8-ba31-4d61-89e7-88639da4683d
Properties
| Property | Type | Description |
|---|---|---|
id |
string |
The unique identifier for an entity. Read-only. |
lastModifiedDateTime |
date-timeNullable |
|
riskScore |
stringNullable |
|
vendorInformation |
object |
|
azureTenantId |
string |
|
tags |
array |
|
userPrincipalName |
stringNullable |
|
azureSubscriptionId |
stringNullable |
|
createdDateTime |
date-timeNullable |
|
accounts |
microsoft.graph.userAccount collection |
|
displayName |
stringNullable |
Relationships
| Relationship | Type | Description |
|---|---|---|
manager |
directoryObject |
The user's manager. Read-only. |
directReports |
directoryObject collection |
The users and contacts that report to the user. Read-only. Nullable. |
memberOf |
directoryObject collection |
The groups, directory roles, and administrative units that the user is a member of. Read-only. Nullable. |
ownedDevices |
directoryObject collection |
Devices owned by the user. Read-only. Nullable. |
registeredDevices |
directoryObject collection |
Devices registered for the user. Read-only. Nullable. |
drive |
drive |
The user's OneDrive. Read-only. |
drives |
drive collection |
A collection of drives available for this user. Read-only. |
calendar |
calendar |
The user's primary calendar. Read-only. |
calendars |
calendar collection |
The user's calendars. Read-only. Nullable. |
calendarGroups |
calendarGroup collection |
The user's calendar groups. Read-only. Nullable. |
calendarView |
event collection |
The calendar view for the calendar. Read-only. Nullable. |
events |
event collection |
The user's events. Default is to show events under the default calendar. Read-only. Nullable. |
mailFolders |
mailFolder collection |
The user's mail folders. Read-only. Nullable. |
messages |
message collection |
The messages in a mailbox or folder. Read-only. Nullable. |
contacts |
contact collection |
The user's contacts. Read-only. Nullable. |
contactFolders |
contactFolder collection |
The user's contacts folders. Read-only. Nullable. |
photos |
profilePhoto collection |
The collection of the user's profile photos in different sizes. Read-only. |
photo |
profilePhoto |
The user's profile photo. Read-only. |
onenote |
onenote |
The user's OneNote notebooks. Read-only. |
planner |
plannerUser |
Selective Planner services available to the user. Read-only. Nullable. |
Graph Methods
Delegated access
App-only access
Code Examples
C# / .NET SDK
// Install: dotnet add package Microsoft.Graph
// Install: dotnet add package Azure.Identity
using Microsoft.Graph;
using Azure.Identity;
// Delegated permissions - interactive user sign-in
var scopes = new[] { "User.Read" };
var options = new InteractiveBrowserCredentialOptions
{
ClientId = "YOUR_CLIENT_ID",
TenantId = "YOUR_TENANT_ID",
RedirectUri = new Uri("http://localhost")
};
var credential = new InteractiveBrowserCredential(options);
var graphClient = new GraphServiceClient(credential, scopes);
// Example: GET /me
var result = await graphClient.Me.GetAsync();
Console.WriteLine($"User: {result?.DisplayName}");
JavaScript / TypeScript
// npm install @azure/msal-browser @microsoft/microsoft-graph-client
import { PublicClientApplication } from "@azure/msal-browser";
import { Client } from "@microsoft/microsoft-graph-client";
import { AuthCodeMSALBrowserAuthenticationProvider } from
"@microsoft/microsoft-graph-client/authProviders/authCodeMsalBrowser";
const msalConfig = {
auth: {
clientId: "YOUR_CLIENT_ID",
authority: "https://login.microsoftonline.com/YOUR_TENANT_ID"
}
};
const pca = new PublicClientApplication(msalConfig);
await pca.initialize();
// Delegated: Login with required scope
const loginResponse = await pca.loginPopup({
scopes: ["User.Read"]
});
const authProvider = new AuthCodeMSALBrowserAuthenticationProvider(pca, {
account: loginResponse.account,
scopes: ["User.Read"],
interactionType: "popup"
});
const graphClient = Client.initWithMiddleware({ authProvider });
// Example: GET /me
const result = await graphClient.api("/me").get();
console.log(result);
PowerShell
# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser
# Delegated access - interactive sign-in
Connect-MgGraph -Scopes "User.Read"
# Verify connection
Get-MgContext | Select-Object Account, TenantId, Scopes
# Example: GET /me
$result = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/me"
$result | ConvertTo-Json -Depth 5
# Always disconnect when done
Disconnect-MgGraph
Python
# pip install msgraph-sdk azure-identity
from azure.identity import InteractiveBrowserCredential, ClientSecretCredential
from msgraph import GraphServiceClient
import asyncio
# Delegated permissions - interactive browser sign-in
credential = InteractiveBrowserCredential(
client_id="YOUR_CLIENT_ID",
tenant_id="YOUR_TENANT_ID"
)
scopes = ["User.Read"]
client = GraphServiceClient(credential, scopes)
async def get_data():
# Example: GET /me
result = await client.me.get()
print(f"User: {result.display_name}")
return result
asyncio.run(get_data())
App Registration
1
Navigate to Azure Portal
Go to App registrations in Microsoft Entra admin center
2
Add API Permission
Select your app → API permissions → Add a permission → Microsoft Graph
3
Select Permission Type
Choose Delegated permissions and search for User.Read
4
Grant Admin Consent
Users can consent to this permission themselves during sign-in.