Table of Contents

Agreement.ReadWrite.All

Allows the app to read and write terms of use agreements on behalf of the signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the Agreement.ReadWrite.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category Application Delegated
Identifier c9090d00-6101-42f0-a729-c41074260d47 ef4b5d93-3104-4664-9053-a5c49ab44218
DisplayText Read and write all terms of use agreements Read and write all terms of use agreements
Description Allows the app to read and write terms of use agreements, without a signed in user. Allows the app to read and write terms of use agreements on behalf of the signed-in user.
AdminConsentRequired Yes Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

Methods
DELETE /identityGovernance/termsOfUse/agreements/{id}
GET /agreements/{agreementsId}/file
GET /agreements/{agreementsId}/file/localizations
PATCH /identityGovernance/termsOfUse/agreements/{id}
POST /agreements/{agreementsId}/files
POST /identityGovernance/termsOfUse/agreements

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: agreement

Property Type Description
displayName String Display name of the agreement. The display name is used for internal tracking of the agreement but isn't shown to end users who view the agreement. Supports $filter (eq).
id String The identifier of the agreement. Read-only. Supports $filter (eq).
isPerDeviceAcceptanceRequired Boolean Indicates whether end users are required to accept this agreement on every device that they access it from. The end user is required to register their device in Microsoft Entra ID, if they haven't already done so. Supports $filter (eq).
isViewingBeforeAcceptanceRequired Boolean Indicates whether the user has to expand the agreement before accepting. Supports $filter (eq).
termsExpiration termsExpiration Expiration schedule and frequency of agreement for all users. Supports $filter (eq).
userReacceptRequiredFrequency Duration The duration after which the user must reaccept the terms of use. The value is represented in ISO 8601 format for durations. Supports $filter (eq).