Outlook App Permissions, Scope by Scope

The Graph mail permissions that matter

1. 1Mail.Read — read every message and attachment in your mailbox. No writes: it cannot categorise, move, draft or send.
2. 2Mail.ReadWrite — read, create, update, move and delete messages, and manage categories and folders. Deletion under Graph moves items to Deleted Items rather than destroying them.
3. 3Mail.Send — send mail as you. Microsoft keeps this separate from ReadWrite, so an app can hold write access without the ability to send, which is a genuinely useful distinction Gmail does not offer.
4. 4MailboxSettings.Read and MailboxSettings.ReadWrite — your time zone, working hours, language, automatic replies and signature. ReadWrite can change your out-of-office.
5. 5offline_access — the permission that lets the app keep working after you close the browser. Without it, access ends with the session.
6. 6Delegated versus application permissions is the crucial split. Delegated means the app acts as you and can only reach your mailbox. Application permissions like Mail.Read as an app role reach every mailbox in the tenant and require admin consent — a categorically different grant.
7. 7On a work or school account, your tenant admin may have to consent before you can connect anything, and may have granted consent on your behalf already.

What that actually means

• •The Microsoft consent screen lists permissions by display name, so Mail.ReadWrite and Mail.Send read as one vague blur
• •Nothing on the screen tells you whether a grant is delegated or tenant-wide unless you know to look for "consent on behalf of your organisation"
• •Admin-consented apps often cannot be removed by the user who uses them
• •Outlook categories created by an app persist in the mailbox after the app is removed