EventListener.ReadWrite.All

Allows the app to read or write your organization's authentication event listeners on behalf of the signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the EventListener.ReadWrite.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	0edf5e9e-4ce8-468a-8432-d08631d18c43	d11625a6-fe21-4fc6-8d3d-063eba5525ad
DisplayText	Read and write all authentication event listeners	Read and write your organization's authentication event listeners
Description	Allows the app to read or write your organization's authentication event listeners without a signed-in user.	Allows the app to read or write your organization's authentication event listeners on behalf of the signed-in user.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /identity/authenticationEventListeners/{authenticationEventListenerId}
	DELETE /identity/authenticationEventsFlows/{authenticationEventsFlow-id}
	DELETE /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/conditions/applications/includeApplications/{appId}
	DELETE /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAttributeCollection/microsoft.graph.onAttributeCollectionExternalUsersSelfServiceSignUp/attributes/{attributeId}/$ref
	DELETE /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/{identityProviders-id}/$ref
	GET /identity/authenticationEventListeners
	GET /identity/authenticationEventListeners/{authenticationEventListenerId}
	GET /identity/authenticationEventsFlows
	GET /identity/authenticationEventsFlows/{authenticationEventsFlow-id}
	GET /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/conditions/applications/includeApplications/
	GET /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAttributeCollection/microsoft.graph.onAttributeCollectionExternalUsersSelfServiceSignUp/attributes/
	GET /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/identityProviders/
	PATCH /identity/authenticationEventListeners/{authenticationEventListenerId}
	PATCH /identity/authenticationEventsFlows/{authenticationEventsFlow-id}
	POST /identity/authenticationEventListeners
	POST /identity/authenticationEventsFlows
	POST /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/conditions/applications/includeApplications
	POST /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAttributeCollection/microsoft.graph.onAttributeCollectionExternalUsersSelfServiceSignUp/attributes/$ref
	POST /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/identityProviders/$ref

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /identity/authenticationEventListeners/{authenticationEventListenerId}
	DELETE /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/
	DELETE /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/conditions/applications/includeApplications/{appId}
	DELETE /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAttributeCollection/microsoft.graph.onAttributeCollectionExternalUsersSelfServiceSignUp/attributes/{attributeId}/$ref
	DELETE /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/identityProviders/$ref
	GET /identity/authenticationEventListeners
	GET /identity/authenticationEventListeners/{authenticationEventListenerId}
	GET /identity/authenticationEventListeners/{listenerId}/microsoft.graph.onAttributeCollectionStartListener/handler/microsoft.graph.onAttributeCollectionStartCustomExtensionHandler/customExtension
	GET /identity/authenticationEventListeners/{listenerId}/microsoft.graph.onAttributeCollectionSubmitListener/handler/microsoft.graph.onAttributeCollectionSubmitCustomExtensionHandler/customExtension
	GET /identity/authenticationEventsFlows
	GET /identity/authenticationEventsFlows/{authenticationEventsFlow-id}
	GET /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/conditions/applications/includeApplications/
	GET /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAttributeCollection/microsoft.graph.onAttributeCollectionExternalUsersSelfServiceSignUp/attributes/
	GET /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/identityProviders/
	PATCH /identity/authenticationEventListeners/{authenticationEventListenerId}
	PATCH /identity/authenticationEventsFlows/{authenticationEventsFlow-id}
	POST /identity/authenticationEventListeners
	POST /identity/authenticationEventsFlows
	POST /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/conditions/applications/includeApplications
	POST /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAttributeCollection/microsoft.graph.onAttributeCollectionExternalUsersSelfServiceSignUp/attributes/$ref
	POST /identity/authenticationEventsFlows/{authenticationEventsFlow-id}/microsoft.graph.externalUsersSelfServiceSignUpEventsFlow/onAuthenticationMethodLoadStart/microsoft.graph.onAuthenticationMethodLoadStartExternalUsersSelfServiceSignUp/identityProviders/$ref
	PUT /identity/authenticationEventListeners/{listenerId}/microsoft.graph.onAttributeCollectionStartListener/handler/microsoft.graph.onAttributeCollectionStartCustomExtensionHandler/customExtension/$ref
	PUT /identity/authenticationEventListeners/{listenerId}/microsoft.graph.onAttributeCollectionSubmitListener/handler/microsoft.graph.onAttributeCollectionSubmitCustomExtensionHandler/customExtension/$ref

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgIdentityAuthenticationEventFlow
	Get-MgIdentityAuthenticationEventFlowAsOnAttributeCollectionExternalUserSelfServiceSignUpAttribute
	Get-MgIdentityAuthenticationEventFlowAsOnAuthenticationMethodLoadStartExternalUserSelfServiceSignUpIdentityProvider
	Get-MgIdentityAuthenticationEventFlowIncludeApplication
	Get-MgIdentityAuthenticationEventListener
	New-MgBetaIdentityAuthenticationEventFlowAsOnAuthenticationMethodLoadStartExternalUserSelfServiceSignUpIdentityProviderByRef
	New-MgIdentityAuthenticationEventFlow
	New-MgIdentityAuthenticationEventFlowAsOnGraphAPretributeCollectionExternalUserSelfServiceSignUpAttributeByRef
	New-MgIdentityAuthenticationEventFlowIncludeApplication
	New-MgIdentityAuthenticationEventListener
	Remove-MgIdentityAuthenticationEventFlow
	Remove-MgIdentityAuthenticationEventFlowAsOnAuthenticationMethodLoadStartExternalUserSelfServiceSignUpIdentityProviderBaseByRef
	Remove-MgIdentityAuthenticationEventFlowAsOnGraphAPretributeCollectionExternalUserSelfServiceSignUpAttributeIdentityUserFlowAttributeByRef
	Remove-MgIdentityAuthenticationEventFlowIncludeApplication
	Remove-MgIdentityAuthenticationEventListener
	Update-MgIdentityAuthenticationEventFlow
	Update-MgIdentityAuthenticationEventListener

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaIdentityAuthenticationEventFlow
	Get-MgBetaIdentityAuthenticationEventFlowAsOnAttributeCollectionExternalUserSelfServiceSignUpAttribute
	Get-MgBetaIdentityAuthenticationEventFlowAsOnAuthenticationMethodLoadStartExternalUserSelfServiceSignUpIdentityProvider
	Get-MgBetaIdentityAuthenticationEventFlowIncludeApplication
	Get-MgBetaIdentityAuthenticationEventListener
	Get-MgBetaIdentityCustomAuthenticationExtension
	New-MgBetaIdentityAuthenticationEventFlow
	New-MgBetaIdentityAuthenticationEventFlowAsOnAuthenticationMethodLoadStartExternalUserSelfServiceSignUpIdentityProviderByRef
	New-MgBetaIdentityAuthenticationEventFlowAsOnGraphAPretributeCollectionExternalUserSelfServiceSignUpAttributeByRef
	New-MgBetaIdentityAuthenticationEventFlowIncludeApplication
	New-MgBetaIdentityAuthenticationEventListener
	Remove-MgBetaIdentityAuthenticationEventFlow
	Remove-MgBetaIdentityAuthenticationEventFlowAsOnAuthenticationMethodLoadStartExternalUserSelfServiceSignUpIdentityProviderBaseByRef
	Remove-MgBetaIdentityAuthenticationEventFlowAsOnGraphAPretributeCollectionExternalUserSelfServiceSignUpAttributeIdentityUserFlowAttributeByRef
	Remove-MgBetaIdentityAuthenticationEventFlowIncludeApplication
	Remove-MgBetaIdentityAuthenticationEventListener
	Update-MgBetaIdentityAuthenticationEventFlow
	Update-MgBetaIdentityAuthenticationEventListener

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: authenticationConditionApplication

Property	Type	Description
appId	String	The identifier for an application corresponding to a condition which will trigger an authenticationEventListener.

Property	Type	Description
applications	authenticationConditionsApplications	Applications which trigger a custom authentication extension.

Graph reference: authenticationEventListener

Property	Type	Description
conditions	authenticationConditions	The conditions on which this authenticationEventListener should trigger.
id	String	Identifier for this authenticationEventListener. Inherited from entity.
authenticationEventsFlowId	String	Indicates the authenticationEventListener is associated with an authenticationEventsFlow. Read-only.

Graph reference: authenticationEventsFlow

Property	Type	Description
id	String	The unique identifier for the entity. Read-only. Inherited from entity. Autogenerated.
displayName	String	Required. The display name for the events policy.
description	String	The description of the events policy.
conditions	authenticationConditions	The conditions representing the context of the authentication request that's used to decide whether the events policy is invoked. Supports `$filter` (`eq`). See support for filtering on user flows for syntax information.

Graph reference: customAuthenticationExtension

Property	Type	Description
authenticationConfiguration	customExtensionAuthenticationConfiguration	The authentication configuration for the customAuthenticationExtension. Inherited from customCalloutExtension.
clientConfiguration	customExtensionClientConfiguration	The connection settings for the customAuthenticationExtension. Inherited from customCalloutExtension.
description	String	The description of the customAuthenticationExtension. Inherited from customCalloutExtension.
displayName	String	The display name for the customAuthenticationExtension. Inherited from customCalloutExtension.
endpointConfiguration	customExtensionEndpointConfiguration	The HTTP endpoint that this custom extension calls. Inherited from customCalloutExtension.
id	String	Identifier for the customAuthenticationExtension. Inherited from entity.

Graph reference: externalUsersSelfServiceSignUpEventsFlow

Property	Type	Description
id	String	The unique identifier for the entity. Read-only. Inherited from entity.
displayName	String	Required. The display name for the events policy. Must be unique. Inherited from authenticationEventsFlow.
description	String	Optional. The description of the events policy. Inherited from authenticationEventsFlow.
conditions	authenticationConditions	Optional. The conditions representing the context of the authentication request which is used to decide whether the events policy is invoked. Inherited from authenticationEventsFlow.
onInteractiveAuthFlowStart	onInteractiveAuthFlowStartHandler	Required. The configuration for what to invoke when an authentication flow is ready to be initiated.
onAttributeCollection	onAttributeCollectionHandler	The configuration for what to invoke when attributes are ready to be collected from the user.
onAuthenticationMethodLoadStart	onAuthenticationMethodLoadStartHandler	Required. The configuration for what to invoke when authentication methods are ready to be presented to the user. Must have at least one identity provider linked. Supports `$filter` (`eq`). See support for filtering on user flows for syntax information.
onUserCreateStart	onUserCreateStartHandler	The configuration for what to invoke during user creation.

Property	Type	Description
displayName	String	The display name of the identity provider.
id	String	The identifier of the identity provider.

Graph reference: identityUserFlowAttribute

Property	Type	Description
dataType	identityUserFlowAttributeDataType	The data type of the user flow attribute. Can't be modified after the custom user flow attribute is created. The supported values for dataType are: `string` , `boolean` , `int64` , `stringCollection` , `dateTime`, `unknownFutureValue`. Supports `$filter` (`eq`, `ne`).
displayName	String	The display name of the user flow attribute. Supports `$filter` (`eq`, `ne`).
description	String	The description of the user flow attribute that's shown to the user at the time of sign up.
id	String	The identifier of the user flow attribute. Read-only. Supports `$filter` (`eq`, `ne`).
userFlowAttributeType	identityUserFlowAttributeType	The type of the user flow attribute. Read-only. Depending on the type of attribute, the values for this property are `builtIn`, `custom`, `required`, `unknownFutureValue`. Supports `$filter` (`eq`, `ne`).

Graph reference: onAttributeCollectionListener

Property	Type	Description
id	String	Required. Inherited from entity.
conditions	authenticationConditions	Required. Inherited from authenticationEventListener.
authenticationEventsFlowId	String	Inherited from authenticationEventListener.
handler	onAttributeCollectionHandler	Required. Configuration for what to invoke if the event resolves to this listener.

Graph reference: onAttributeCollectionStartCustomExtension

Property	Type	Description
authenticationConfiguration	customExtensionAuthenticationConfiguration	Configuration for securing the API call. For example, using OAuth client credentials flow. Inherited from customCalloutExtension.
clientConfiguration	customExtensionClientConfiguration	HTTP connection settings that define how long Microsoft Entra ID can wait for a connection, how many times you can retry a timed-out connection and the exception scenarios when retries are allowed. Inherited from customCalloutExtension.
description	String	Description for the onAttributeCollectionStartCustomExtension object. Inherited from customCalloutExtension.
displayName	String	Display name for the onAttributeCollectionStartCustomExtension object. Inherited from customCalloutExtension.
endpointConfiguration	customExtensionEndpointConfiguration	The type and details for configuring the endpoint to call the app's workflow. Inherited from customCalloutExtension.
id	String	Identifier for the onAttributeCollectionStartCustomExtension object. Inherited from entity. Inherited from entity.

Graph reference: onAttributeCollectionStartListener

Property	Type	Description
authenticationEventsFlowId	String	The identifier of the authenticationEventsFlow object. Inherited from authenticationEventListener.
conditions	authenticationConditions	The conditions on which this authenticationEventListener should trigger. Inherited from authenticationEventListener.
handler	onAttributeCollectionStartHandler	Configuration for what to invoke if the event resolves to this listener.
id	String	Identifier for this authenticationEventListener. Inherited from entity.
priority	Int32	The priority of this handler. Between 0 (lower priority) and 1000 (higher priority). Inherited from authenticationEventListener.

Graph reference: onAttributeCollectionSubmitCustomExtension

Property	Type	Description
authenticationConfiguration	customExtensionAuthenticationConfiguration	Configuration for securing the API call. For example, using OAuth client credentials flow. Inherited from customCalloutExtension.
clientConfiguration	customExtensionClientConfiguration	HTTP connection settings that define how long Microsoft Entra ID can wait for a connection, how many times you can retry a timed-out connection and the exception scenarios when retries are allowed. Inherited from customCalloutExtension.
description	String	Description for the onAttributeCollectionSubmitCustomExtension object. Inherited from customCalloutExtension.
displayName	String	Display name for the onAttributeCollectionSubmitCustomExtension object. Inherited from customCalloutExtension.
endpointConfiguration	customExtensionEndpointConfiguration	The type and details for configuring the endpoint to call the app's workflow. Inherited from customCalloutExtension.
id	String	Identifier for the onAttributeCollectionSubmitCustomExtension object. Inherited from entity. Inherited from entity.

Graph reference: onAttributeCollectionSubmitListener

Property	Type	Description
authenticationEventsFlowId	String	The identifier of the authenticationEventsFlow object. Inherited from authenticationEventListener.
conditions	authenticationConditions	The conditions on which this authenticationEventListener should trigger. Inherited from authenticationEventListener.
handler	onAttributeCollectionSubmitHandler	Configuration for what to invoke if the event resolves to this listener.
id	String	Identifier for this authenticationEventListener. Inherited from entity.
priority	Int32	The priority of this listener. Between 0 (lower priority) and 1000 (higher priority). Inherited from authenticationEventListener.

Graph reference: onAuthenticationMethodLoadStartListener

Property	Type	Description
id	String	Required. Inherited from entity.
conditions	authenticationConditions	Required. Inherited from authenticationEventListener.
authenticationEventsFlowId	String	Inherited from authenticationEventListener.
handler	onAuthenticationMethodLoadStartHandler	Required. Configuration for what to invoke if the event resolves to this listener. This property lets us define potential handler configurations per-event.

Graph reference: onInteractiveAuthFlowStartListener

Property	Type	Description
id	String	Required. Inherited from entity.
conditions	authenticationConditions	Required. Inherited from authenticationEventListener.
authenticationEventsFlowId	String	Inherited from authenticationEventListener.
handler	onInteractiveAuthFlowStartHandler	Required. Configuration for what to invoke if the event resolves to this listener. This lets us define potential handler configurations per-event.

Graph reference: onTokenIssuanceStartListener

Property	Type	Description
conditions	authenticationConditions	The conditions on which onTokenIssuanceStartListener should trigger. Inherited from authenticationEventListener.
handler	onTokenIssuanceStartHandler	The handler to invoke when conditions are met for this onTokenIssuanceStartListener.
id	String	Identifier for the onTokenIssuanceStartListener. Inherited from entity.

Graph reference: onUserCreateStartListener

Property	Type	Description
id	String	Required. Inherited from entity.
conditions	authenticationConditions	Required. Inherited from authenticationEventListener.
authenticationEventsFlowId	String	Inherited from authenticationEventListener.
handler	onUserCreateStartHandler	Required. Configuration for what to invoke if the event resolves to this listener. This lets us define potential handler configurations per-event.

Table of Contents

EventListener.ReadWrite.All

Graph Methods

Resources