{"id":18492,"date":"2026-09-12T09:03:17","date_gmt":"2026-09-12T00:03:17","guid":{"rendered":"https:\/\/m365jp.net\/?p=18492"},"modified":"2026-09-12T09:06:43","modified_gmt":"2026-09-12T00:06:43","slug":"mc1470871-microsoft-graph-user-readbasic-all-will-no-longer-allow-reading-user-app-role-assignments-and-license-details","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2026-09-12-mc1470871-microsoft-graph-user-readbasic-all-will-no-longer-allow-reading-user-app-role-assignments-and-license-details","title":{"rendered":"MC1470871 | Microsoft Graph: User.ReadBasic.All will no longer allow reading user app role assignments and license details"},"content":{"rendered":"
\n
\n
\n\n\n\n
MC1470871 | Microsoft Graph: User.ReadBasic.All will no longer allow reading user app role assignments and license details<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n\n\n\n\n\n\n\n\n
Classification<\/th>\npreventOrFixIssue<\/td>\n<\/tr>\n
Last Updated<\/th>\n09\/11\/2026 23:08:45<\/td>\n<\/tr>\n
Start Time<\/th>\n09\/11\/2026 23:08:21<\/td>\n<\/tr>\n
End Time<\/th>\n10\/30\/2026 07:00:00<\/td>\n<\/tr>\n
Message Content<\/th>\n\n

[What and why]<\/b><\/p>\n

We are correcting the behavior of the Microsoft Graph delegated and app-only permission User.ReadBasic.All<\/b>. This permission is intended to provide access only to a limited set of basic user profile properties. However, it currently also allows access to user app role assignments and license details.<\/p>\n

To address a security vulnerability, we are removing access to user app role assignments and license details from User.ReadBasic.All<\/b> and aligning the permission with its intended scope. This is not a breaking change for applications that use User.ReadBasic.All <\/b>only for its intended purpose of accessing basic user profile information.<\/p>\n

Applications that rely on this unintended access should be updated with the appropriate least-privileged permissions before rollout is complete.<\/p>\n

[Rollout schedule]<\/b><\/p>\n

    \n
  • General Availability (Worldwide):<\/b> Beginning in mid-September 2026<\/b> and expected to complete by late September 2026<\/b><\/li>\n<\/ul>\n

    [Impact on your organization]<\/b><\/p>\n

    Who is affected<\/em><\/p>\n

    Organizations are affected if their applications use the Microsoft Graph delegated or app-only permission User.ReadBasic.All<\/b> to read:<\/p>\n

      \n
    • User app role assignments<\/li>\n
    • User license details<\/li>\n<\/ul>\n

      Developers, application owners, and administrators responsible for managing application permissions in Microsoft Entra ID<\/em> should review this change.<\/p>\n

      Platforms and services<\/em><\/p>\n

        \n
      • Microsoft Graph<\/li>\n
      • Microsoft Entra ID<\/li>\n
      • Applications using Microsoft Graph permissions<\/li>\n<\/ul>\n

        What will happen<\/em><\/p>\n

          \n
        • Applications granted only User.ReadBasic.All<\/b> will no longer be able to read user app role assignments or user license details.<\/li>\n
        • Applications that access only basic user properties, such as display name, email address, and department, will continue to function without changes.<\/li>\n
        • Affected applications may experience failures or permission-related errors after the change is applied.<\/li>\n
        • Users may experience application disruptions if an application has only User.ReadBasic.All<\/b> but attempts to access user app role assignments or license details.<\/li>\n<\/ul>\n

          [Action required and recommendations]<\/b><\/p>\n

          Action is required if you have applications that use User.ReadBasic.All<\/b> to access user app role assignments or license details.<\/p>\n

          Recommended actions:<\/p>\n

            \n
          • Review applications granted User.ReadBasic.All <\/b>in the Microsoft Entra admin center<\/em> under Enterprise applications > Permissions<\/em><\/b> or in your internal application catalog.<\/li>\n
          • Identify applications that use this permission to read user app role assignments or user license details.<\/li>\n
          • Update affected applications to use the appropriate least-privileged permissions:\n
              \n
            • To read user app role assignments: User.Read.All<\/b><\/li>\n
            • To read user license details: LicenseAssignment.Read.All<\/b><\/li>\n
            • To read both: User.Read.All<\/b><\/li>\n<\/ul>\n<\/li>\n
            • Obtain administrator consent for the new permissions, update application configurations, redeploy affected applications, and test impacted scenarios.<\/li>\n
            • Notify developers and application owners of the upcoming permission changes and rollout schedule.<\/li>\n
            • Monitor application logs and Microsoft Graph API responses for permission-related errors after rollout.<\/li>\n<\/ul>\n

              [Compliance considerations]<\/b><\/p>\n

              No compliance considerations identified. Review as appropriate for your organization.<\/p>\n<\/td>\n<\/tr>\n

Machine Translation<\/th>\n\n

[\u4f55\u3068\u306a\u305c]<\/b><\/p>\n

Microsoft Graph\u306e\u59d4\u4efb\u6a29\u9650\u304a\u3088\u3073\u30a2\u30d7\u30ea\u306e\u307f\u6a29\u9650\u3067\u3042\u308b User.ReadBasic.All<\/b>\u306e\u6319\u52d5\u3092\u4fee\u6b63\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u6a29\u9650\u306f\u3001\u57fa\u672c\u7684\u306a\u30e6\u30fc\u30b6\u30fc\u30d7\u30ed\u30d5\u30a1\u30a4\u30eb\u30d7\u30ed\u30d1\u30c6\u30a3\u306e\u9650\u3089\u308c\u305f\u30bb\u30c3\u30c8\u306e\u307f\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u63d0\u4f9b\u3059\u308b\u3053\u3068\u3092\u76ee\u7684\u3068\u3057\u3066\u3044\u307e\u3059\u3002\u3057\u304b\u3057\u73fe\u5728\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u30a2\u30d7\u30ea\u306e\u5f79\u5272\u5272\u308a\u5f53\u3066\u3084\u30e9\u30a4\u30bb\u30f3\u30b9\u8a73\u7d30\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3082\u8a31\u53ef\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n

\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u8106\u5f31\u6027\u306b\u5bfe\u51e6\u3059\u308b\u305f\u3081\u3001 User.ReadBasic.All<\/b> \u304b\u3089\u30e6\u30fc\u30b6\u30fc\u30a2\u30d7\u30ea\u306e\u5f79\u5272\u5272\u308a\u5f53\u3066\u3084\u30e9\u30a4\u30bb\u30f3\u30b9\u8a73\u7d30\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u524a\u9664\u3057\u3001\u6a29\u9650\u3092\u610f\u56f3\u306e\u7bc4\u56f2\u306b\u6574\u5408\u3055\u305b\u307e\u3059\u3002\u3053\u308c\u306f\u3001 User.ReadBasic.All <\/b>\u3092\u4f7f\u7528\u3059\u308b\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306b\u3068\u3063\u3066\u306f\u3001\u57fa\u672c\u7684\u306a\u30e6\u30fc\u30b6\u30fc\u30d7\u30ed\u30d5\u30a1\u30a4\u30eb\u60c5\u5831\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3068\u3044\u3046\u76ee\u7684\u3067\u306e\u307f\u554f\u984c\u3068\u306a\u308b\u5909\u66f4\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n

\u3053\u306e\u610f\u56f3\u3057\u306a\u3044\u30a2\u30af\u30bb\u30b9\u306b\u4f9d\u5b58\u3059\u308b\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306f\u3001\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u5b8c\u4e86\u524d\u306b\u9069\u5207\u306a\u6700\u5c0f\u6a29\u9650\u6a29\u9650\u3067\u66f4\u65b0\u3055\u308c\u308b\u3079\u304d\u3067\u3059\u3002<\/p>\n

[\u5c55\u958b\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb]<\/b><\/p>\n

    \n
  • \u4e00\u822c\u516c\u958b(\u4e16\u754c):<\/b>2026\u5e749\u6708\u4e2d\u65ec<\/b>\u304b\u3089\u958b\u59cb\u3055\u308c\u30012026\u5e749\u6708\u4e0b\u65ec<\/b>\u307e\u3067\u306b\u5b8c\u4e86\u4e88\u5b9a\u3067\u3059<\/li>\n<\/ul>\n

    [\u7d44\u7e54\u3078\u306e\u5f71\u97ff]<\/b><\/p>\n

    \u5f71\u97ff\u3092\u53d7\u3051\u308b\u4eba\u7269<\/em><\/p>\n

    \u7d44\u7e54\u306f\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304cMicrosoft Graph\u306e\u59d4\u4efb\u6a29\u9650\u307e\u305f\u306f\u30a2\u30d7\u30ea\u306e\u307f\u6a29\u9650\u3067\u3042\u308b User.ReadBasic.All<\/b> \u3092\u4f7f\u3063\u3066\u4ee5\u4e0b\u3092\u8aad\u3080\u5834\u5408\u306b\u5f71\u97ff\u3092\u53d7\u3051\u307e\u3059\u3002<\/p>\n

      \n
    • \u30e6\u30fc\u30b6\u30fc\u30a2\u30d7\u30ea\u306e\u5f79\u5272\u5272\u308a\u5f53\u3066<\/li>\n
    • \u30e6\u30fc\u30b6\u30fc\u30e9\u30a4\u30bb\u30f3\u30b9\u306e\u8a73\u7d30<\/li>\n<\/ul>\n

      Microsoft Entra ID<\/em>\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u6a29\u9650\u7ba1\u7406\u3092\u62c5\u5f53\u3059\u308b\u958b\u767a\u8005\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30aa\u30fc\u30ca\u30fc\u3001\u7ba1\u7406\u8005\u306f\u3053\u306e\u5909\u66f4\u3092\u691c\u8a0e\u3059\u3079\u304d\u3067\u3059\u3002<\/p>\n

      \u30db\u30fc\u30e0\u3068\u30b5\u30fc\u30d3\u30b9<\/em><\/p>\n

        \n
      • \u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8\u30b0\u30e9\u30d5<\/li>\n
      • Microsoft Entra ID<\/li>\n
      • Microsoft Graph\u6a29\u9650\u3092\u4f7f\u7528\u3059\u308b\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3<\/li>\n<\/ul>\n

        \u4f55\u304c\u8d77\u3053\u308b\u306e\u304b<\/em><\/p>\n

          \n
        • User.ReadBasic.All<\/b>\u306e\u307f\u304c\u4ed8\u4e0e\u3055\u308c\u305f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u30a2\u30d7\u30ea\u306e\u5f79\u5272\u5272\u308a\u5f53\u3066\u3084\u30e6\u30fc\u30b6\u30fc\u30e9\u30a4\u30bb\u30f3\u30b9\u306e\u8a73\u7d30\u3092\u8aad\u307f\u53d6\u308b\u3053\u3068\u304c\u3067\u304d\u306a\u304f\u306a\u308a\u307e\u3059\u3002<\/li>\n
        • \u8868\u793a\u540d\u3001\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3001\u90e8\u9580\u306a\u3069\u306e\u57fa\u672c\u7684\u306a\u30e6\u30fc\u30b6\u30fc\u30d7\u30ed\u30d1\u30c6\u30a3\u306e\u307f\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306f\u3001\u5909\u66f4\u306a\u3057\u3067\u52d5\u4f5c\u3092\u7d99\u7d9a\u3057\u307e\u3059\u3002<\/li>\n
        • \u5909\u66f4\u5f8c\u3001\u5f71\u97ff\u3092\u53d7\u3051\u305f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306f\u5931\u6557\u3084\u6a29\u9650\u95a2\u9023\u306e\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/li>\n
        • \u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u304c User.ReadBasic.All<\/b> \u306e\u307f\u3092\u6301\u3063\u3066\u3044\u308b\u5834\u5408\u3001\u30e6\u30fc\u30b6\u30fc\u306f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u5f79\u5272\u5272\u308a\u5f53\u3066\u3084\u30e9\u30a4\u30bb\u30f3\u30b9\u8a73\u7d30\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u8a66\u307f\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002<\/li>\n<\/ul>\n

          [\u884c\u52d5\u304c\u5fc5\u8981\u3068\u63d0\u8a00]<\/b><\/p>\n

          User.ReadBasic.All<\/b>\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067\u30e6\u30fc\u30b6\u30fc\u30a2\u30d7\u30ea\u306e\u5f79\u5272\u5272\u308a\u5f53\u3066\u3084\u30e9\u30a4\u30bb\u30f3\u30b9\u8a73\u7d30\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u5834\u5408\u306f\u3001\u30a2\u30af\u30b7\u30e7\u30f3\u304c\u5fc5\u8981\u3067\u3059\u3002<\/p>\n

          \u63a8\u5968\u3055\u308c\u308b\u884c\u52d5:<\/p>\n

            \n
          • Microsoft Entra\u7ba1\u7406\u30bb\u30f3\u30bf\u30fc<\/em>\u306e\u30a8\u30f3\u30bf\u30fc\u30d7\u30e9\u30a4\u30ba\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3>\u6a29\u9650<\/em><\/b>\u6b04\u3001\u307e\u305f\u306f\u793e\u5185\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30ab\u30bf\u30ed\u30b0\u3067User.ReadBasic.All<\/b>\u306b\u4ed8\u4e0e\u3055\u308c\u305f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/li>\n
          • \u3053\u306e\u6a29\u9650\u3092\u4f7f\u3063\u3066\u30e6\u30fc\u30b6\u30fc\u30a2\u30d7\u30ea\u306e\u5f79\u5272\u5272\u308a\u5f53\u3066\u3084\u30e6\u30fc\u30b6\u30fc\u30e9\u30a4\u30bb\u30f3\u30b9\u306e\u8a73\u7d30\u3092\u8aad\u307f\u53d6\u308b\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u7279\u5b9a\u3057\u307e\u3057\u3087\u3046\u3002<\/li>\n
          • \u5f71\u97ff\u3092\u53d7\u3051\u305f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306f\u3001\u9069\u5207\u306a\u6700\u5c0f\u6a29\u9650\u3092\u4f7f\u7528\u3059\u308b\u3088\u3046\u66f4\u65b0\u3057\u3066\u304f\u3060\u3055\u3044:\n
              \n
            • \u30e6\u30fc\u30b6\u30fc\u30a2\u30d7\u30ea\u306e\u5f79\u5272\u5272\u308a\u5f53\u3066\u3092\u8aad\u3080\u306b\u306f\u3001 User.Read.All<\/b><\/li>\n
            • \u30e6\u30fc\u30b6\u30fc\u30e9\u30a4\u30bb\u30f3\u30b9\u306e\u8a73\u7d30\u3092\u8aad\u3080\u306b\u306f\u3001LicenseAssignment.Read.All<\/b> \u3092\u3054\u89a7\u304f\u3060\u3055\u3044<\/li>\n
            • \u4e21\u65b9\u3092\u8aad\u3080\u306b\u306f\u3001User.Read.All<\/b> \u3092\u3054\u89a7\u304f\u3060\u3055\u3044<\/li>\n<\/ul>\n<\/li>\n
            • \u65b0\u3057\u3044\u6a29\u9650\u306e\u7ba1\u7406\u8005\u540c\u610f\u3092\u53d6\u5f97\u3057\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u8a2d\u5b9a\u3092\u66f4\u65b0\u3057\u3001\u5f71\u97ff\u3092\u53d7\u3051\u305f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u518d\u5c55\u958b\u3092\u884c\u3044\u3001\u5f71\u97ff\u3092\u53d7\u3051\u305f\u30b7\u30ca\u30ea\u30aa\u3092\u30c6\u30b9\u30c8\u3057\u307e\u3059\u3002<\/li>\n
            • \u958b\u767a\u8005\u3084\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u6240\u6709\u8005\u306b\u4eca\u5f8c\u306e\u6a29\u9650\u5909\u66f4\u3084\u5c55\u958b\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb\u3092\u901a\u77e5\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/li>\n
            • \u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u5f8c\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30ed\u30b0\u3084Microsoft Graph API\u306e\u5fdc\u7b54\u3092\u76e3\u8996\u3057\u3001\u6a29\u9650\u95a2\u9023\u306e\u30a8\u30e9\u30fc\u3092\u76e3\u8996\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/li>\n<\/ul>\n

              [\u30b3\u30f3\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u306e\u8003\u616e\u4e8b\u9805]<\/b><\/p>\n

              \u30b3\u30f3\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u4e0a\u306e\u8003\u616e\u4e8b\u9805\u306f\u7279\u5b9a\u3055\u308c\u3066\u3044\u307e\u305b\u3093\u3002\u7d44\u7e54\u306b\u5fdc\u3058\u305f\u9069\u5207\u306a\u30ec\u30d3\u30e5\u30fc\u3092\u884c\u3063\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

              MC1470871 | Microsoft Graph: User.ReadBasic.All will no longer allow reading user app role assignments and lic […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-18492","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/18492","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/comments?post=18492"}],"version-history":[{"count":0,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/18492\/revisions"}],"wp:attachment":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/media?parent=18492"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/categories?post=18492"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/tags?post=18492"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}