Does User.Read
"contain" the permissions email
openid
and profile
? I've found that apps that are requesting the 3x scopes, can instead accept just the User.Read
permission and still function equivalently
At work I'll get requests from the business to help them setup SSO using OIDC, and I'm not actually sure what permissions I should be giving them. Seems like either option works but I'd like to better understand what's happening
See my observations below:
I've created a basic Function App, and configured it to use OpenID Connect Image
My App Registration already has the
User.Read
permission with admin consent, so when I log into my Function, there's no issue. ImageHowever, after removing the
User.Read
permission and logging in, I now get a permissions request prompt ImageAnd after consenting to the permissions, I can now see that
email
openid
andprofile
permissions were added ImageEven more interesting, the permissions in the request prompt correlate to
openid
andoffline_access
, butoffline_access
wasn't added, whileemail
andprofile
weren't in the request
I did find a similar question, but the accepted answer doesn't seem to align with what I see here