Microsoft Graph connector boundary

Evidence-backed facts

1. Microsoft Graph permission names distinguish operations such as Read or ReadBasic and constraints such as All, Selected, Shared, or OwnedBy. informative
2. ReadWrite permissions can authorize create, update, and delete operations and must not be substituted for a narrower read permission when writes are unnecessary. informative
3. Delegated permissions act on behalf of a signed-in user, while application permissions act without one and generally require administrator consent. informative
4. The connector must request the least privileged endpoint-specific permission and still respect the signed-in user, tenant, resource, and RBAC boundaries. informative

Primary sources