Decisions Microsoft Graph permissions explained

When you enable admin consent for the Decisions app, you are presented with a list of Microsoft Graph permissions. This article will help you better understand why Decisions requests them and how they are used.

Delegated Permissions

All permissions requested by Decisions are Delegated Permissions. Decisions acts on behalf of a user and is limited by both the application permissions and the end-user’s permissions. By using Delegated Permissions, users of Decisions will never get access to any resources they not already have access to in your organizations Office 365 tenant.

Microsoft Graph Permissions

The follow sections detail each Microsoft Graph permission scope and how Decisions uses it.

microsoft graph permissions

Read user mailbox settings

Used to identify a user’s language preferences. 

Read and write all groups

Used to create folder structures in the Office 365 Group’s SharePoint site for meeting agendas, related files and group conversations. 

Read and write access to user mail

Used to create draft emails to meeting attendees.

*OfficeJS does not currently allow Decisions to compose new email messages from the user as that API is still in preview. Once available from Microsoft, Decisions will no longer need to use permissions to send emails. 

Send mail as a user

Used to allow Decisions to send meeting participants notifications, such as agenda updates and links to the meeting for co-authors. Emails go to meeting participants or to the distribution list selected by the meeting owner. 

Have full access to user calendars

Used to read information from user’s calendar to enable features like dashboards and search. It also gives the user an option to delete specific meetings from the calendar, when the item is deleted from Decisions.

Have full access to user files

Used to provide users with support for personal file annotations. Annotated files are stored privately in the user’s OneDrive for Business. 

Read and write all OneNote notebooks that user can access

Used to set-up private notebooks for meetings to take notes and prepare remarks and questions. It also allows for group meeting minutes to be stored within their shared OneNote notebook, should the group opt to use OneNote. 

Create, read, update and delete user tasks and projects

Used to sync tasks and decisions to Microsoft Planner, from meetings held using the Decisions add-in. It also allows users to download tasks and decisions to Excel.

Read all users' basic profiles

Used to the display name, first and last name, photo and email address of group members and external participants.

Sign in and read user profile

Used for sign-in to Decisions.

Read directory data

Used to gather basic information about the Office 365 tenant when registered, such as tenant name and verified domains. It is necessary to verify group memberships.

Please refer to the Microsoft Graph Permissions reference for full details on what permission scopes grants access too.