Microsoft has updated the Microsoft-managed default app consent policy in Entra ID to align with the Secure Future Initiative and the Secure by Default principle. This update strengthens admin control over third-party app access to Exchange and Teams content.
Important:
This update only affects tenants using the Microsoft-managed user consent policy. Organizations using a custom or admin-defined policy are not affected.
Timeline
The rollout should be completed by late November 2025.
How does this affect your organisation?
In mid-August, Microsoft enabled the new Microsoft-managed app consent policy for organisations using the default Entra ID configuration.
The first four blocked permissions were:
- Microsoft Graph – Files.Read.All
- Microsoft Graph – Files.ReadWrite.All
- Microsoft Graph – Sites.Read.All
- Microsoft Graph – Sites.ReadWrite.All
In October, Microsoft informed that these four permissions would be extended to include additional permissions for apps accessing Exchange and Teams content. These new permissions are now rolling out and include 20 additional excluded permissions for Outlook Mailbox, Outlook Mail, Outlook Calendar, Teams Chat, and Teams Meetings.
- Organisations using custom user consent policies are not affected. Read my July post for step-by-step guidance on creating a custom app consent policy.
- Users who have already granted consent to an app can continue using it without interruption.
- New users or apps requesting new or broader permissions are blocked. Microsoft recommends configuring an admin consent workflow to manage these requests.
For example, Doodle uses the Calendars.ReadWrite permission, which is now one of the newly excluded permissions.
New users can no longer add the app.
I exported all excluded permissions from the Microsoft-managed app consent policy.
The following table lists the 24 permissions currently excluded by the Microsoft-managed app consent policy. The resource ID of Microsoft Graph is 00000003-0000-0000-c000-000000000000.
Permission exclusions for the Microsoft-managed default app consent policy.
Last updated: May 2026
Resource | PermissionType | Permission | ConsentDisplayName | ConsentDescription | Excluded |
|---|---|---|---|---|---|
Microsoft Graph | User | Contacts.ReadWrite | Have full access of your contacts | Allows the app to read, update, create and delete contacts in your contact folders. | June 2026 |
Microsoft Graph | User | Contacts.Read.Shared | Read your and shared contacts | Allows the app to read contacts you have permissions to access, including your own and shared contacts. | June 2026 |
Microsoft Graph | User | Contacts.ReadWrite.Shared | Read and write to your and shared contacts | Allows the app to read, update, create, and delete contacts you have permissions to access, including your own and shared contacts. | June 2026 |
Microsoft Graph | User | People.Read | Read your relevant people list | Allows the app to read a list of people in the order that's most relevant to you. This includes your local contacts, your contacts from social networking, people listed in your organization's directory, and people from recent communications. | June 2026 |
Microsoft Graph | User | Tasks.Read | Read your tasks and task lists | Allows the app to read your tasks and task lists, including any shared with you. Doesn't include permission to create, delete, or update anything. | June 2026 |
Microsoft Graph | User | Tasks.ReadWrite | Create, read, update, and delete your tasks and task lists | Allows the app to create, read, update, and delete your tasks and task lists, including any shared with you. | June 2026 |
Microsoft Graph | User | Tasks.Read.Shared | Read your and shared tasks | Allows the app to read tasks you have permissions to access, including your own and shared tasks. | June 2026 |
Microsoft Graph | User | Tasks.ReadWrite.Shared | Read and write to your and shared tasks | Allows the app to read, update, create, and delete tasks you have permissions to access, including your own and shared tasks. | June 2026 |
Office 365 Exchange Online | User | EAS.AccessAsUser.All | Access your mailboxes | Allows the app full access to your mailboxes on your behalf. | November 2025 |
Office 365 Exchange Online | User | EWS.AccessAsUser.All | Access your mailboxes | Allows the app full access to your mailboxes on your behalf. | November 2025 |
Office 365 Exchange Online | User | POP.AccessAsUser.All | Read and write access to your mail | Allows the app to read, update, create and delete email in your mailbox. Does not include permission to send mail. | November 2025 |
Office 365 Exchange Online | User | IMAP.AccessAsUser.All | Read and write access to your mail | Allows the app to read, update, create and delete email in your mailbox. Does not include permission to send mail. | November 2025 |
Microsoft Graph | User | Calendars.Read | Read your calendars | Allows the app to read events in your calendars. | November 2025 |
Microsoft Graph | User | Calendars.Read.Shared | Read calendars you can access | Allows the app to read events in all calendars that you can access, including delegate and shared calendars. | November 2025 |
Microsoft Graph | User | Calendars.ReadBasic | Read basic details of your calendars | Allows the app to read events in your calendars, except for properties such as body, attachments, and extensions. | November 2025 |
Microsoft Graph | User | Calendars.ReadWrite | Have full access to your calendars | Allows the app to read, update, create and delete events in your calendars. | November 2025 |
Microsoft Graph | User | Calendars.ReadWrite.Shared | Read and write to your and shared calendars | Allows the app to read, update, create and delete events in all calendars in your organization you have permissions to access. This includes delegate and shared calendars. | November 2025 |
Microsoft Graph | User | Chat.Read | Read your chat messages | Allows an app to read your 1 on 1 or group chat messages in Microsoft Teams, on your behalf. | November 2025 |
Microsoft Graph | User | Chat.ReadWrite | Read and write your chat messages | Allows an app to read and write your 1 on 1 or group chat messages in Microsoft Teams, on your behalf. | November 2025 |
Microsoft Graph | User | Mail.Read | Read your mail | Allows the app to read email in your mailbox. | November 2025 |
Microsoft Graph | User | Mail.Read.Shared | Read mail you can access | Allows the app to read mail you can access, including shared mail. | November 2025 |
Microsoft Graph | User | Mail.ReadBasic | Read user basic mail | Allows the app to read email in the signed-in user's mailbox except body, previewBody, attachments and any extended properties. | November 2025 |
Microsoft Graph | User | Mail.ReadBasic.Shared | Read basic mail you can access | Allows the app to read mail you can access, including shared mail except body, previewBody, uniqueBody, attachments, extensions, and any extended properties. | November 2025 |
Microsoft Graph | User | Mail.ReadWrite | Read and write access to your mail | Allows the app to read, update, create and delete email in your mailbox. Does not include permission to send mail. | November 2025 |
Microsoft Graph | User | Mail.ReadWrite.Shared | Read and write mail you can access | Allows the app to read, update, create, and delete mail you have permission to access, including your own and shared mail. Does not allow the app to send mail on your behalf. | November 2025 |
Microsoft Graph | User | MailboxFolder.Read | Read your mailbox folders | Allows the app to read your mailbox folders, on your behalf | November 2025 |
Microsoft Graph | User | MailboxFolder.ReadWrite | Read and write your mailbox folders | Allows the app to read and write your mailbox folders, on your behalf | November 2025 |
Microsoft Graph | User | MailboxItem.Read | Read your mailbox items | Allows the app to read your mailbox items, on your behalf | November 2025 |
Microsoft Graph | User | MailboxSettings.Read | Read your mailbox settings | Allows the app to read your mailbox settings. | November 2025 |
Microsoft Graph | User | MailboxSettings.ReadWrite | Read and write to your mailbox settings | Allows the app to read, update, create, and delete your mailbox settings. | November 2025 |
Microsoft Graph | User | OnlineMeetings.Read | Read your online meetings | Allows the app to read online meeting details on your behalf. | November 2025 |
Microsoft Graph | User | OnlineMeetings.ReadWrite | Read and create your online meetings | Allows the app to read and create online meetings on your behalf. | November 2025 |
Microsoft Graph | User | Files.Read.All | Read all files that you have access to | Allows the app to read all files you can access. | August 2025 |
Microsoft Graph | User | Files.ReadWrite.All | Have full access to all files you have access to | Allows the app to read, create, update and delete all files that you can access. | August 2025 |
Microsoft Graph | User | Sites.Read.All | Read items in all site collections | Allow the application to read documents and list items in all site collections on your behalf | August 2025 |
Microsoft Graph | User | Sites.ReadWrite.All | Edit or delete items in all site collections | Allow the application to edit or delete documents and list items in all site collections on your behalf. | August 2025 |
1 Comment