When do I need to include the full namespace for a scope e.g. "https://graph.microsoft.com/Mail.Send" vs "Mail.Send"?

Question

Hi

Initially, I was led to believe that I would need to define a scope when requesting access as an application (application-level permissions) differently from when requesting as a logged-in users (delegated permissions). I would always use the "full" namespace and include "https://graph.microsoft.com/" when requesting delegated access and use the "short" version e.g. "Mail.Send" when requesting access as an application. However, I found various situations, where the "short" version would also work when requesting delegated access.

So my question is, whether there is a rule here to go by. When do I include the full namespace and when can I drop it?

Thanks!

Answer 1

Hi @Marco vanW

If your app is only granted one type of permission, such as Graph API, then "https://graph.microsoft.com/Mail.Send" and "Mail.Send" are no different, and both point to the same thing.

However, if your app is also granted other types of permissions, such as Graph API and Outlook REST API, then using the full URL format ("https://graph.microsoft.com/Mail.Send") is necessary because it will explicitly specify the type of API you are using during authentication.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.