microsoft graph
What it is
Microsoft Graph is a single API gateway to data and services across Microsoft cloud products, including Microsoft Entra and Microsoft 365. Applications call the https://graph.microsoft.com endpoint through REST APIs or supported SDKs.
Think of a reception desk for many office systems. A visitor can ask the desk for a permitted employee profile, calendar item, file, or team—but the desk checks the visitor’s identity and access before answering.
Why it exists
Without Graph, an application might need different interfaces for users, groups, mail, files, meetings, devices, and other Microsoft cloud data. Graph provides a common endpoint and resource model, while permissions still limit what each application can access.
Key ideas
- Graph exposes data and services such as users, groups, Teams, Outlook, OneDrive, SharePoint, Intune, and Microsoft Entra resources. Availability varies by resource and API version.
- An application obtains an access token through the Microsoft identity platform. Graph validates the token and the permissions granted to the caller.
- Delegated permissions let an application act for a signed-in user within the granted scope. Application permissions let a background application act without a signed-in user and need especially careful administrator approval.
- Consent is a permission decision, not a technical formality. Request the smallest set of permissions required and explain why the application needs them.
- Microsoft Graph returns data; it does not automatically grant a Northwind application permission to reveal that data to another user. The application still enforces its own business authorization and privacy rules.
Northwind example
Northwind’s internal scheduling tool lets a signed-in operations manager view their Microsoft 365 calendar availability before assigning a warehouse meeting. It requests the minimum delegated Graph permission needed for that feature. A background reporting service would need a separately reviewed application permission; it would not reuse a manager’s browser token or receive broad mailbox access merely because it can read one calendar.
Microsoft Graph versus Azure management
| Need | Start by considering |
|---|---|
| Work with Microsoft 365, Entra, and related Microsoft cloud data | Microsoft Graph |
| Create or configure Azure resources such as a storage account | Azure Resource Manager and its management APIs |
| Authorize an application’s business action | The application’s own authorization design |
Microsoft Graph can expose identity-related data, but it is not a replacement for Azure RBAC or the application’s authorization checks.
Common confusion
- A valid Microsoft Graph token does not grant every Graph permission. The token’s granted scopes or roles matter.
- An administrator’s consent does not remove privacy, retention, and data-minimization responsibilities.
- Graph and Microsoft Entra are related, but Graph is an API surface; Entra supplies identity and access capabilities.
Related
microsoft-identity-platform · entraid · api-access · managed-identity · service-principal · northwind-traders-case-study
Sources and re-audit
- Microsoft Learn — Microsoft Graph overview, checked 2026-09-16.