Graph is closing off license data: check your reports now

The Graph permission User.ReadBasic.All has granted more than its name promises. Beyond name, email address and profile photo, it has also been able to read two things that don't belong in a basic profile: user license details and app role assignments.

Microsoft is closing that now. Rollout began in mid-September 2026 and is expected to complete late in the month. The change applies to both delegated and app-only access.

An app holding only User.ReadBasic.All will no longer be able to read:

• •Per-user license details — GET /users/{id}/licenseDetails, or Get-MgUserLicenseDetail in PowerShell
• •App role assignments — GET /users/{id}/appRoleAssignments, or Get-MgUserAppRoleAssignment in PowerShell

If an app uses the permission only for what it was meant for, namely names, email addresses and photos in a people search or an intranet, nothing needs changing.

There are two very different questions you ask Graph about licenses, and they use different endpoints. The difference decides whether this touches you.

"How many licenses do we pay for, and how many are in use?" comes from /subscribedSkus. Those are the tenant totals: prepaidUnits.enabled against consumedUnits, bought against assigned. The endpoint needs LicenseAssignment.Read.All at minimum and works both delegated and app-only. The change doesn't touch it.

"Who holds which license?" comes from /users/{id}/licenseDetails. That's where User.ReadBasic.All has worked, and that's where it stops. Worth noting: that endpoint doesn't support app-only access at all. Delegated only, on behalf of a signed-in user.

In practice, the coarse count is safe, and the detailed lookup is what can stall. That's the annoying way round, because totals rarely save money. "We have 47 E3 licenses and 45 are assigned" leads to no action. "These eight users have E3 and haven't touched Teams or SharePoint in three months" does. The second kind of report is built on the per-user lookup.

Most smaller companies don't call Graph themselves. But something in your tenant almost certainly does, and it's rarely something you built.

The usual candidates are a third-party license optimization tool, a reporting portal at your IT provider, an HR or onboarding system that looks users up in Entra, or a PowerShell script somebody wrote two years ago and scheduled monthly.

You can look for yourself. In the Entra admin center under Identity → Applications → Enterprise applications, open an app and check its Permissions. If User.ReadBasic.All is among the consented ones and the app pulls license data, it's a candidate to break.

After the rollout there's one more place to look: service principal sign-in logs. A call that fails on missing permissions leaves a trace there, even when the tool's own interface stays quiet.

Microsoft points to three routes, depending on what the app actually needs:

The switch needs fresh administrator consent, and the app has to be redeployed and retested. It isn't much work, but it isn't work that happens on its own either.

One thing is worth holding on to along the way. The temptation, when a call suddenly fails, is to grant Directory.Read.All and move on. That permission opens the whole directory. If the app only reads licenses, LicenseAssignment.Read.All is the right call, and it's also the one Microsoft lists as least privileged on both license endpoints.

That is the point of the change, incidentally. User.ReadBasic.All got granted to apps because it sounded harmless, and license and role data came along with it that nobody had decided to share. Microsoft is closing the gap because the permission gave more than it promised.

If you don't have anyone working with Graph in-house, this is where you can act. Pass on three questions:

The third one matters most. A report that shows an error gets fixed next week. A report that shows zero assigned licenses without saying why gets taken at face value, and then somebody decides to cancel or downgrade on an empty dataset.

"We only use the totals" is a valid answer and good news. "Let us check" is fine too. "It usually works" is the one to follow up on before the end of September.

One more thing: this costs nothing and requires no particular plan. Graph permissions don't track your license level. Whether you run Business Basic or E5, the change is the same and so is the fix.

Sources: Microsoft Graph permissions reference (Microsoft Learn), List licenseDetails (Microsoft Learn), List subscribedSkus (Microsoft Learn), Cloud licensing API in Microsoft Graph, beta (Microsoft Learn) and Message Center post MC1470871, as reported by mwpro.co.uk and ourcloudnetwork.com.