Table of Contents

AuthenticationContext.ReadWrite.All

Allows the app to read and update all authentication context information in your organization on behalf of the signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the AuthenticationContext.ReadWrite.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category Application Delegated
Identifier a88eef72-fed0-4bf7-a2a9-f19df33f8b83 ba6d575a-1344-4516-b777-1404f5593057
DisplayText Read and write all authentication context information Read and write all authentication context information
Description Allows the app to read and update the authentication context information in your organization without a signed-in user. Allows the app to read and update all authentication context information in your organization on behalf of the signed-in user.
AdminConsentRequired Yes Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

Methods
DELETE /identity/conditionalAccess/authenticationContextClassReferences/{id}
GET /identity/conditionalAccess/authenticationContextClassReferences
GET /identity/conditionalAccess/authenticationContextClassReferences/{id}
PATCH /identity/conditionalAccess/authenticationContextClassReferences/{id}

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: authenticationContextClassReference

Property Type Description
description String A short explanation of the policies that are enforced by authenticationContextClassReference. This value should be used to provide secondary text to describe the authentication context class reference when building user-facing admin experiences. For example, a selection UX.
displayName String The display name is the friendly name of the authenticationContextClassReference object. This value should be used to identify the authentication context class reference when building user-facing admin experiences. For example, a selection UX.
id String Identifier used to reference the authentication context class. The ID is used to trigger step-up authentication for the referenced authentication requirements and is the value that will be issued in the acrs claim of an access token. This value in the claim is used to verify that the required authentication context has been satisfied. The allowed values are c1 through c25.
Supports $filter (eq).
isAvailable Boolean Indicates whether the authenticationContextClassReference has been published by the security admin and is ready for use by apps. When it's set to false, it shouldn't be shown in authentication context selection UX, or used to protect app resources. It's shown and available for Conditional Access policy authoring. The default value is false.
Supports $filter (eq).