Table of Contents

CrossTenantUserProfileSharing.ReadWrite

Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the CrossTenantUserProfileSharing.ReadWrite permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category Application Delegated
Identifier - eed0129d-dc60-4f30-8641-daf337a39ffd
DisplayText - Read shared cross-tenant user profile and export or delete data
Description - Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user.
AdminConsentRequired Yes Yes

Graph Methods

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: inboundSharedUserProfile

Property Type Description
displayName String The name displayed in the address book for the user at the time when the sharing record was created. Read-only.
homeTenantId String The home tenant id of the external user. Read-only.
userId String The object id of the external user. Read-only.
userPrincipalName String The user principal name (UPN) of the external user. Read-only.