Application.ReadWrite.All is a high-risk Microsoft permission that allows an application to add or change credentials and permissions on other applications. If abused, it can let an attacker expand access across a tenant, move laterally, and create a much larger compromise from a single trusted application.
Expanded Definition
Application.ReadWrite.All is a Microsoft Graph application permission that grants an app authority to create and modify application objects, including credentials and related properties, across a tenant. In practice, that means the permission can alter how other applications authenticate and can reshape trust relationships without interactive user consent. For identity security teams, the key issue is not just breadth of access, but the ability to modify a control plane that other services depend on. This makes the permission materially different from read-only or narrowly scoped application permissions.
Definitions vary across vendors and implementation guides, but the security meaning is consistent: this is a tenant-wide application permission that demands strict governance, approval, and monitoring. In a Microsoft identity environment, it sits alongside other high-impact app permissions that can become privilege escalation paths when granted too broadly. The most common misapplication is treating it like a routine admin setting, which occurs when teams approve it for automation without assessing whether the app truly needs to rewrite application credentials or permissions.
Examples and Use Cases
Implementing Application.ReadWrite.All rigorously often introduces change-control overhead, requiring organisations to weigh automation speed against the risk of tenant-wide application compromise.
- An identity governance workflow updates an application registration during a controlled deployment, using the permission to rotate credentials and maintain service continuity.
- A platform team manages enterprise application metadata at scale, but only after formal approval and logging because the permission can affect authentication trust.
- A security operations script audits application objects and remediates unsafe configuration drift, with privileged execution monitored through administrative review.
- An attacker compromises a trusted app and uses the permission to add a new credential, preserving access even after the original secret is revoked.
- A tenant administrator discovers that a third-party integration holds broader write access than expected and uses policy review to NIST Cybersecurity Framework 2.0 governance practices to reassess authorization and monitoring.
Why It Matters for Security Teams
Application.ReadWrite.All matters because it can turn one trusted application into a durable administrative foothold. If the permission is abused, defenders may see credential tampering, application impersonation, or privilege expansion across multiple workloads before any obvious user-facing impact appears. That makes entitlement review, app owner accountability, and conditional approval processes essential parts of identity security governance.
For teams operating in Microsoft-centric environments, this permission should be treated as a high-risk control point in the broader application trust model. It intersects directly with identity because application registrations, service principals, and credentials are all identity assets that can be manipulated for persistence. Mapping the permission to the NIST Cybersecurity Framework 2.0 helps security teams align review, detection, and response activities around a clear governance model. Organisations typically encounter the full impact only after an app is compromised and anomalous credentials or permissions have already been planted, at which point the permission becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 | Access permissions and least privilege apply directly to this tenant-wide app permission. |
| NIST SP 800-63 | AAL2 | Strong authentication for administrators reduces abuse of privileged application management paths. |
| OWASP Non-Human Identity Top 10 | Non-human identity governance covers application credentials and over-privileged service principals. | |
| NIST AI RMF | If AI agents manage app permissions, governance must address automated authority and misuse risk. |
Limit grant scope, review app entitlements, and enforce least-privilege approvals for high-risk permissions.
