ESC
Type to search...

User.ReadWrite.CrossCloud

Export JSON
Export CSV
Copy URL
Print
Application Read/Write User Scope

Allows the app to read and update external cloud user profiles without a signed in user.

Delegated Access App-Only Access

Permission Details

Application Permission

Read and write profiles of users that originate from an external cloud.

Allows the app to read and update external cloud user profiles without a signed in user.

Properties

Property Type Description
id string The unique identifier for an entity. Read-only.
lastModifiedDateTime date-timeNullable
riskScore stringNullable
vendorInformation object
azureTenantId string
tags array
userPrincipalName stringNullable
azureSubscriptionId stringNullable
createdDateTime date-timeNullable
accounts microsoft.graph.userAccount collection
displayName stringNullable

Relationships

Relationship Type Description
manager directoryObject The user's manager. Read-only.
directReports directoryObject collection The users and contacts that report to the user. Read-only. Nullable.
memberOf directoryObject collection The groups, directory roles, and administrative units that the user is a member of. Read-only. Nullable.
ownedDevices directoryObject collection Devices owned by the user. Read-only. Nullable.
registeredDevices directoryObject collection Devices registered for the user. Read-only. Nullable.
drive drive The user's OneDrive. Read-only.
drives drive collection A collection of drives available for this user. Read-only.
calendar calendar The user's primary calendar. Read-only.
calendars calendar collection The user's calendars. Read-only. Nullable.
calendarGroups calendarGroup collection The user's calendar groups. Read-only. Nullable.
calendarView event collection The calendar view for the calendar. Read-only. Nullable.
events event collection The user's events. Default is to show events under the default calendar. Read-only. Nullable.
mailFolders mailFolder collection The user's mail folders. Read-only. Nullable.
messages message collection The messages in a mailbox or folder. Read-only. Nullable.
contacts contact collection The user's contacts. Read-only. Nullable.
contactFolders contactFolder collection The user's contacts folders. Read-only. Nullable.
photos profilePhoto collection The collection of the user's profile photos in different sizes. Read-only.
photo profilePhoto The user's profile photo. Read-only.
onenote onenote The user's OneNote notebooks. Read-only.
planner plannerUser Selective Planner services available to the user. Read-only. Nullable.

Graph Methods

Delegated access App-only access

No API methods available for this version.

No API methods available for this version.

No PowerShell cmdlets found for this permission.

No PowerShell cmdlets found for this permission.

Code Examples

C# / .NET SDK
// Install: dotnet add package Microsoft.Graph
// Install: dotnet add package Azure.Identity
using Microsoft.Graph;
using Azure.Identity;



// Application permissions - daemon/service app
var tenantId = "YOUR_TENANT_ID";
var clientId = "YOUR_CLIENT_ID";
var clientSecret = "YOUR_CLIENT_SECRET";

var credential = new ClientSecretCredential(tenantId, clientId, clientSecret);
var graphClient = new GraphServiceClient(credential);

// Example: GET /users/{user-id}
var users = await graphClient.Users.GetAsync();
foreach (var user in users?.Value ?? [])
{
    Console.WriteLine($"User: {user.DisplayName}");
}
JavaScript / TypeScript
// npm install @azure/msal-browser @microsoft/microsoft-graph-client
import { PublicClientApplication } from "@azure/msal-browser";
import { Client } from "@microsoft/microsoft-graph-client";
import { AuthCodeMSALBrowserAuthenticationProvider } from 
    "@microsoft/microsoft-graph-client/authProviders/authCodeMsalBrowser";

const msalConfig = {
    auth: {
        clientId: "YOUR_CLIENT_ID",
        authority: "https://login.microsoftonline.com/YOUR_TENANT_ID"
    }
};

const pca = new PublicClientApplication(msalConfig);
await pca.initialize();



// Application: Use client credentials (Node.js backend only)
// npm install @azure/identity @microsoft/microsoft-graph-client
import { ClientSecretCredential } from "@azure/identity";
import { TokenCredentialAuthenticationProvider } from 
    "@microsoft/microsoft-graph-client/authProviders/azureTokenCredentials";

const credential = new ClientSecretCredential(
    "YOUR_TENANT_ID",
    "YOUR_CLIENT_ID", 
    "YOUR_CLIENT_SECRET"
);

const authProvider = new TokenCredentialAuthenticationProvider(credential, {
    scopes: ["https://graph.microsoft.com/.default"]
});

const graphClient = Client.initWithMiddleware({ authProvider });
const result = await graphClient.api("/users").get();
console.log(result);
PowerShell
# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser



# Application access with certificate
$params = @{
    ClientId = "YOUR_CLIENT_ID"
    TenantId = "YOUR_TENANT_ID"
    CertificateThumbprint = "YOUR_CERT_THUMBPRINT"
}
Connect-MgGraph @params

# Or with client secret (not recommended for production)
# Connect-MgGraph -ClientSecretCredential $credential

# Example: GET /users
$result = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/users"
$result | ConvertTo-Json -Depth 5

# Always disconnect when done
Disconnect-MgGraph
Python
# pip install msgraph-sdk azure-identity
from azure.identity import InteractiveBrowserCredential, ClientSecretCredential
from msgraph import GraphServiceClient
import asyncio



# Application permissions - client credentials
credential = ClientSecretCredential(
    tenant_id="YOUR_TENANT_ID",
    client_id="YOUR_CLIENT_ID",
    client_secret="YOUR_CLIENT_SECRET"
)
scopes = ["https://graph.microsoft.com/.default"]
client = GraphServiceClient(credential, scopes)

async def get_users():
    # Example: GET /users
    result = await client.users.get()
    for user in result.value:
        print(f"User: {user.display_name}")
    return result

asyncio.run(get_users())

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions and search for User.ReadWrite.CrossCloud

4

Grant Admin Consent

Application permissions always require admin consent. Click "Grant admin consent" in the Azure portal.