MC1470871 - Microsoft Graph: User.ReadBasic.All will no longer allow reading user app role assignments and license details

Microsoft 365 Message Center announcement MC1470871.

MS Message Center's Summary

Microsoft is updating the Microsoft Graph permission User Read Basic All starting mid September 2026 to remove access to user app role assignments and license details for security reasons. Applications relying on this unintended access must be updated to use User Read All or License Assignment Read All before rollout completes. Administrators should review application permissions and update affected integrations to prevent service disruptions.

Administrator impact
Administrators must identify and update applications relying on User Read Basic All for role or license data.
End user impact
Users may experience application failures if integrated tools attempt to read roles or licenses using restricted permissions.
Importance
7/10: This change modifies permission behaviors and can break dependent applications if not remediated before rollout.

Microsoft Summary

User.ReadBasic.All will no longer provide access to user app role assignments and license details starting mid-September 2026 to fix a security issue. Applications needing this data must switch to User.Read.All or LicenseAssignment.Read.All permissions and update accordingly to avoid disruptions.

Message Center ID
MC1470871
Category
prevent Or Fix Issue
Severity
normal
Services
Microsoft Entra
Tags
User impact, Admin impact
Published
2026-09-11
Last updated
2026-09-11
Expires
2026-10-30

[What and why] We are correcting the behavior of the Microsoft Graph delegated and app-only permission User.ReadBasic.All . This permission is intended to provide access only to a limited set of basic user profile properties. However, it currently also allows access to user app role assignments and license details. To address a security vulnerability, we are removing access to user app role assignments and license details from User.ReadBasic.All and aligning the permission with its intended scope. This is not a breaking change for applications that use User.ReadBasic.All only for its intended purpose of accessing basic user profile information. Applications that rely on this unintended access should be updated with the appropriate least-privileged permissions before rollout is complete. [Rollout schedule] General Availability (Worldwide): Beginning in mid-September 2026 and expected to complete by late September 2026 [Impact on your organization] Who is affected Organizations are affected if their applications use the Microsoft Graph delegated or app-only permission User.ReadBasic.All to read: User app role assignments User license details Developers, application owners, and administrators responsible for managing application permissions in Microsoft Entra ID should review this change. Platforms and services Microsoft Graph Microsoft Entra ID Applications using Microsoft Graph permissions What will happen Applications granted only User.ReadBasic.All will no longer be able to read user app role assignments or user license details. Applications that access only basic user properties, such as display name, email address, and department, will continue to function without changes. Affected applications may experience failures or permission-related errors after the change is applied. Users may experience application disruptions if an application has only User.ReadBasic.All but attempts to access user app role assignments or license details. [Action required and recommendations] Action is required if you have applications that use User.ReadBasic.All to access user app role assignments or license details. Recommended actions: Review applications granted User.ReadBasic.All in the Microsoft Entra admin center under Enterprise applications > Permissions or in your internal application catalog. Identify applications that use this permission to read user app role assignments or user license details. Update affected applications to use the appropriate least-privileged permissions: To read user app role assignments: User.Read.All To read user license details: LicenseAssignment.Read.All To read both: User.Read.All Obtain administrator consent for the new permissions, update application configurations, redeploy affected applications, and test impacted scenarios. Notify developers and application owners of the upcoming permission changes and rollout schedule. Monitor application logs and Microsoft Graph API responses for permission-related errors after rollout. [Compliance considerations] No compliance considerations identified. Review as appropriate for your organization.