Which permission scope you need for which admin task. The "Insufficient privileges to complete the operation" error almost always means the scope was missing from Connect-MgGraph, not that your admin role is wrong.
Three rules cover most confusion. First, scopes are requested, not assumed: Connect-MgGraph only gets the scopes you name, and adding one later means reconnecting. Second, .Read.All vs .ReadWrite.All: request Read for reporting and ReadWrite only when you will change something; consent screens are shorter and security reviews kinder. Third, a delegated scope never exceeds your directory role: User.ReadWrite.All plus a Helpdesk Admin role still cannot edit a Global Admin's account.
Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All" -NoWelcome Get-MgContext | Select-Object -ExpandProperty Scopes # what you actually got
Type to filter. Matches scope names, tasks and cmdlets.
| Scope | What it lets you do | Typical cmdlets |
|---|---|---|
| Users and licensing | ||
| User.Read.All | Read every user's profile, properties and licence assignments. | Get-MgUser, Get-MgUserLicenseDetail |
| User.ReadWrite.All | Create, update, disable and delete users; assign licences; block sign-in. | New-MgUser, Update-MgUser, Set-MgUserLicense |
| User.EnableDisableAccount.All | Only toggle AccountEnabled, the least-privilege choice for offboarding scripts that just block sign-in. | Update-MgUser -AccountEnabled |
| User.RevokeSessions.All | Revoke a user's refresh tokens without any other write access. | Revoke-MgUserSignInSession |
| Organization.Read.All | Read tenant details and subscribed SKUs (needed for licence inventory). | Get-MgOrganization, Get-MgSubscribedSku |
| Groups and roles | ||
| Group.Read.All | Read all groups, their members and owners. | Get-MgGroup, Get-MgGroupMember |
| Group.ReadWrite.All | Create and update groups, add and remove members and owners. | New-MgGroupMember, Remove-MgGroupMemberByRef |
| GroupMember.ReadWrite.All | Manage membership only, without rights to alter or delete the groups themselves. | New-MgGroupMember |
| RoleManagement.Read.Directory | Read directory role definitions and who holds them (admin role audit). | Get-MgRoleManagementDirectoryRoleAssignment |
| RoleManagement.ReadWrite.Directory | Assign and remove directory roles. One of the most powerful scopes there is. Consent reluctantly. | New-MgRoleManagementDirectoryRoleAssignment |
| Sign-in logs and auditing | ||
| AuditLog.Read.All | Read the sign-in log and directory audit log. The core scope for every triage in the sign-in guide. | Get-MgAuditLogSignIn, Get-MgAuditLogDirectoryAudit |
| Directory.Read.All | Broad directory read. Sign-in log queries also require this alongside AuditLog.Read.All. | Get-MgAuditLogSignIn (co-requirement) |
| Reports.Read.All | Usage and activity reports: mailbox usage, Teams activity, MFA registration report. | Get-MgReportAuthenticationMethodUserRegistrationDetail |
| Authentication methods and MFA | ||
| UserAuthenticationMethod.Read.All | See which MFA methods every user has registered (compromise checks, enrolment reports). | Get-MgUserAuthenticationMethod |
| UserAuthenticationMethod.ReadWrite.All | Remove a user's registered methods (post-compromise cleanup) and create Temporary Access Passes. | Remove-MgUserAuthenticationPhoneMethod, New-MgUserAuthenticationTemporaryAccessPassMethod |
| Policy.Read.All | Read Conditional Access policies, authentication method policies and other tenant policies. | Get-MgIdentityConditionalAccessPolicy |
| Policy.ReadWrite.ConditionalAccess | Create and edit Conditional Access policies. Pair with Policy.Read.All and Application.Read.All. | New-MgIdentityConditionalAccessPolicy |
| Identity Protection (risk) | ||
| IdentityRiskyUser.Read.All | Read risky users and their risk history. | Get-MgRiskyUser, Get-MgRiskyUserHistory |
| IdentityRiskyUser.ReadWrite.All | Dismiss or confirm-compromise risky users after remediation. | Invoke-MgDismissRiskyUser |
| IdentityRiskEvent.Read.All | Read individual risk detections (impossible travel, leaked credentials, anonymised IP). | Get-MgRiskDetection |
| Devices and Intune | ||
| Device.Read.All | Read Entra ID device objects and their join state. | Get-MgDevice |
| DeviceManagementManagedDevices.Read.All | Read Intune managed devices and compliance state. | Get-MgDeviceManagementManagedDevice |
| DeviceManagementManagedDevices.ReadWrite.All | Retire, sync and delete managed devices. | Sync-MgDeviceManagementManagedDevice, Invoke-MgRetireDeviceManagementManagedDevice |
| DeviceManagementManagedDevices.PrivilegedOperations.All | The destructive remote actions: wipe, remote lock, reset passcode. | Clear-MgDeviceManagementManagedDevice (wipe) |
| DeviceManagementConfiguration.Read.All | Read configuration profiles and compliance policies. | Get-MgDeviceManagementDeviceConfiguration |
| DeviceManagementApps.Read.All | Read Intune app inventory and assignments. | Get-MgDeviceAppManagementMobileApp |
| DeviceManagementServiceConfig.Read.All | Read Autopilot device identities and enrolment configuration. | Get-MgDeviceManagementWindowsAutopilotDeviceIdentity |
| Applications and consent | ||
| Application.Read.All | Read app registrations and service principals, including client secret expiry dates. | Get-MgApplication, Get-MgServicePrincipal |
| Application.ReadWrite.All | Create and modify app registrations, add credentials. High value to attackers; consent with care. | New-MgApplication, Add-MgApplicationPassword |
| DelegatedPermissionGrant.ReadWrite.All | Read and revoke OAuth consent grants, the scope for OAuth-abuse incident response. | Get-MgOauth2PermissionGrant, Remove-MgOauth2PermissionGrant |
| AppRoleAssignment.ReadWrite.All | Assign users/groups to enterprise apps and grant app roles (fixes AADSTS50105). | New-MgUserAppRoleAssignment |
| Security and incidents | ||
| SecurityIncident.Read.All | Read Defender XDR incidents. | Get-MgSecurityIncident |
| SecurityAlert.Read.All | Read Defender alerts across workloads. | Get-MgSecurityAlertV2 |
| SecurityAlert.ReadWrite.All | Update alert status and classification during triage. | Update-MgSecurityAlertV2 |
| SecurityEvents.Read.All | Read Secure Score and secure score control profiles. | Get-MgSecuritySecureScore |
| ThreatHunting.Read.All | Run advanced hunting KQL queries via Graph. | Start-MgSecurityHuntingQuery |
| Guests and B2B | ||
| User.Invite.All | Send B2B guest invitations without broader user-write rights. | New-MgInvitation |
| CrossTenantInformation.ReadBasic.All | Look up basic tenant information for another organisation (tenant ID from domain). | Find-MgTenantRelationshipTenantInformationByDomainName |
| Mail and calendars (admin scenarios) | ||
| Mail.Read | Read the signed-in user's own mailbox. Note that delegated mail scopes are per-user, not tenant-wide; mailbox admin is Exchange Online PowerShell territory. | Get-MgUserMessage |
| Calendars.ReadWrite | Manage the signed-in user's calendar. Tenant-wide calendar admin also belongs to Exchange cmdlets. | Get-MgUserCalendar |
Everything above is a delegated scope: you sign in, and the effective access is the intersection of the scope and your admin role. Unattended automation uses application permissions instead, consented once by an admin on the app registration, with certificate authentication. The permission names are mostly identical; the difference is there is no signed-in user to constrain them, which is why app-only User.ReadWrite.All deserves far more scrutiny than the delegated version. Setup for both is covered in the connection setup guide.
Check what you actually got with Get-MgContext; a typo in a scope name fails silently at connect time. Reconnect after adding scopes; they do not accumulate onto a live session. If consent was never granted, you will see AADSTS65001; the AADSTS decoder covers the consent error family. And remember the role intersection: a scope grants the API surface, your directory role decides which objects respond.