IdentityVerification.ReadWrite.All

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the IdentityVerification.ReadWrite.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	-	-
DisplayText	-	-
Description	-	-
AdminConsentRequired	Yes	No

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /users/{user-id}/identityVerificationStatus/verificationEvents/{identityVerificationEvent-id}
	GET /me/identityVerificationStatus
	PATCH /users/{user-id}/identityVerificationStatus/verificationEvents/{identityVerificationEvent-id}
	POST /users/{user-id}/identityVerificationStatus/verificationEvents

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: identityVerificationEvent

Property	Type	Description
id	String	The unique event identifier, supplied by the client on creation. Acts as an idempotency key. Immutable. Inherited from entity.
lifecycle	verificationEventLifecycle	The source and current lifecycle state of the event.
overrideDetails	verificationEventOverride	The administrative or programmatic override applied to the event. `null` when no override was applied.
verification	verificationEventDetail	The verification state, provider, credential identifiers, and timestamps.

Graph reference: identityVerificationStatus

Property	Type	Description
expiryDateTime	DateTimeOffset	The effective expiry of the user's overall verified state, computed as the latest expiresDateTime across active verification events. `null` when no active event has an expiry. Read-only.
id	String	The unique identifier of this singleton resource. Equals the owning user's object ID. Read-only. Inherited from entity.
lastVerifiedDateTime	DateTimeOffset	The date and time of the most recent successful identity verification. `null` when state is `unverified`. Read-only.
state	verificationState	The overall verification state, computed from the most recent active verification event. The possible values are: `unverified`, `verified`, `revoked`, `suspended`, `issued`, `blocked`, `unknownFutureValue`. The service doesn't return an `expired` state; compare **e

Graph reference: verificationEventDetail

Property	Type	Description
expiresDateTime	DateTimeOffset	The date and time when this verification expires, in ISO 8601 format. Must be after verifiedDateTime. Compare this value with the current time to determine expiry. Immutable.
externalCredentialId	String	The unique credential reference in URN format, such as `urn:pic:73b78a00-5b9e-4f8c-85dd-b60a08dc1123`. Used for deduplication so repeated presentation of the same credential produces one event. Maximum 256 characters. Immutable.
issuedDateTime	DateTimeOffset	The date and time when the provider issued the underlying credential, in ISO 8601 format. Must not be in the future. Distinct from verifiedDateTime. Immutable.
source	String	The verification provider or attestation authority, such as `Contoso Identity Services`. May be `null` when state is `issued`. Maximum 200 characters. Immutable.
state	verificationState	The verification state of the event. The possible values are: `unverified`, `verified`, `revoked`, `suspended`, `issued`, `blocked`, `unknownFutureValue`. The service accepts only `issued` and `verified` on writes. The only caller-driven state transition is from `issued` to `verified`; other transitions are rejected. This property can't be updated through PATCH.
verifiedDateTime	DateTimeOffset	The date and time when identity verification was performed, in ISO 8601 format. Must not be in the future. May be `null` when state is `issued`. Immutable.
verifiedIdProfileId	String	The identifier of the verified identity profile in the provider's system, in UUID format. Immutable.

Graph reference: verificationEventLifecycle

Property	Type	Description
invalidatedDateTime	DateTimeOffset	The service-populated timestamp for an event in the `invalidated` lifecycle state. Otherwise, `null`. Read-only.
source	verificationLifecycleSource	The source that triggered the lifecycle state change. The possible values are: `entra`, `adminOverride`, `apiOverride`, `unknownFutureValue`. Immutable once set.
state	verificationEventLifecycleState	The service-managed lifecycle state. The possible values are: `active`, `revoked`, `suspended`, `invalidated`, `issued`, `blocked`, `unknownFutureValue`. These response values don't make administrative state-changing operations available. Read-only.

Graph reference: verificationEventOverride

Property	Type	Description
actorId	String	The object ID of the actor who applied the override. Set by the service from the caller's identity. Read-only.
actorType	verificationActorType	The type of actor who applied the override. The possible values are: `user`, `application`, `unknownFutureValue`. Set by the service from the caller's identity. Read-only.
overriddenDateTime	DateTimeOffset	The date and time when the override was applied. Set by the service. Read-only.
reason	String	The explanation for the override, such as `In-person identity proofing confirmed by help desk`. Maximum 500 characters.

Table of Contents

IdentityVerification.ReadWrite.All

Graph Methods

Resources