Microsoft Graph Feature Requests

Welcome to the Microsoft Graph UserVoice! Do you have an idea or feature suggestion based on your experience with Microsoft Graph? Please share these with us by submitting your idea below or voting up ideas submitted by other users. This forum will be directly monitored by the Microsoft Graph engineering teams who are working on new features every day.

If you have feedback on a specific API service, please choose the corresponding category. Please submit any broad ideas related to Microsoft Graph or ideas across more than one service to the “General” category.

This site is only for feature suggestions and ideas! If you need technical help, please go to the Microsoft Graph StackOverflow or if you have a Premier support contract raise a support ticket.

For more information on Microsoft Graph, please checkout https://graph.microsoft.com.


  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Restrict permissions to app-only Azure AD applications consuming Office 365 services on resource level

    Large organization start leveraging the Graph API to provide integrations between their third party applications and Office 365. In such companies it is common to delegate the development of integrations from the central IT organization to other business units.
    The current app-only permission priviledges are not appropriate for such types of setups since there is currently no way to limit the permissions for that app to a specific resource in Office 365. This makes such use cases impossible to implement.

    As an example we could consider SharePoint Online. Whever a business unit has to develop a daemon tool that exchanges…

    297 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    37 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →

    Work has started. We plan to build an experience where end users and administrators can pick a specific resource to grant consent to, such as a specific group or site. This will be programmable through Microsoft Graph API.

  2. make Files.ReadWrite.AppFolder scope available for business accounts.

    We have created a Microsoft Teams business app with a Bot that searches for specific content and posts filecards directly back to the user. For that we need to upload the file to the users OneDrive via Microsoft Graph.

    As we are also focused on data security we would like to restrict our app and the permissions it uses, which led us to the Files.ReadWrite.AppFolder scope.
    Unfortunately this scope is only valid for personal accounts and not supported on business accounts.
    Therefore we have to ask the user for delegated Files.ReadWrite permissions which gives us access to the entire OneDrive…

    7 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  3. Graph API Beta - Un-assign Policy from Service Principal

    Today there is an endpoint to assign Azure AD Policies to service principals, but there is no endpoint to un-assign a policy from a Service Principal.

    Here is the endpoint to assign a policy:
    https://docs.microsoft.com/en-us/graph/api/policy-assign?view=graph-rest-beta

    Here is a link to the powershell cmdlet for unassign policy:
    https://docs.microsoft.com/en-us/powershell/module/azuread/remove-azureadserviceprincipalpolicy?view=azureadps-2.0-preview

    6 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  4. Make it possible to create organizational Contacts using graph API that appear in Exchange Global Address List (GAL)

    It has been stated by the Office Dev Team that POST organizational contact will not be supported as...

    "With the notion of guests now in Office 365, the decision has been made that Organizational contacts would not be needed moving forward."

    For those of us developing with Exchange-centric customers this causes us to develop solutions that must connect to Exchange Online with accounts that do not have Multi-Factor Authentication enabled. Automation is hindered by having to constantly rotate new passwords (via Import-Clixml) and factor that into the code.

    This is a security nightmare.

    Not to mention, connecting to the…

    26 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  5. Throttling

    When we need to get data out of O365 speed is important. The throttling is excessive. Suggest something in the line of E3 4X  standard E5 10X standard. You could even limit the increase to the app IDs of certain level of partners.

    3 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  6. Allow notification for user registration (creation) in Azure B2C tenant

    Applications in a B2C workflow need to be able to know when new users have registered.

    In our current flow a user purchases a license to our product. The billing software will call a webhook to our application which triggers a transactional email with a registration link (this is an azure B2C registration link). We need to be able to know once the user has completed registration (e.g. we need to be able to subscribe to a "user created" event that calls our application whenever the user signs up). This is important to send a welcome email and bootstrap the…

    6 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  7. Allow Application Permission to privilegedApproval API

    Allow Application Permission to privilegedApproval GraphAPI to allow create other interfaces to approve PIM Requests.
    (Or just put Teams approval function for PIM)

    1 vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  8. Extend MSGraph to only query failed sign-ins. Not possible now.

    I'm trying to query only the failed sign-ins using the $filter parameter but it only supports status/errorCode eq [errorcode].

    This means that i need to know all errorcodes on forehand. Which i don't.

    Can this filter be extended with status/errorCode ge 1 ?

    This would really make life easier.

    1 vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  9. To provide user's base location/country.

    Currently, User's Country is shown as Null through Graph API. It would be helpful, if the Country field is populated with location where user is currently based. If the user moves from one country to another, the country field must be updated.

    2 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  10. Add the raw user agent to Azure AD audit log scheme

    As of today, only parsed user agent information is available as part of the Azure AD audit log (in sign-in in particular). In many cases, the parsing does not work well and most of the parsed fields are 'null'.
    It will be great if we can get the raw user agent string and use our own parsing.

    1 vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  11. Deliver fileData for Get agreement request

    Performing a GET request for https://docs.microsoft.com/en-us/graph/api/agreement-get?view=graph-rest-beta&tabs=http
    on "agreement" does not deliver the fileData for the ToU files configured in the policy.
    Please deliver the bytes not only the metadata.

    1 vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  12. Add manager to list Users graph api

    Currently we allow customer to connect to the Azure AD for listing all people in their AD for an up-to-date personell system.
    If they need to have the hierarchy in our software as well (who is the manager of who) this is near impossible as you have to retrieve the manager object per user.

    Please allow an extra attribute to request the manager information when listing users instead of 'per user' basis.

    11 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    2 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  13. Graph API - Azure AD B2B - Organizational Relationships Whitelist

    Azure Active Directory > Organizational Relationships > Settings > Collaboration restrictions ... when "Allow invitations only to the specified domains (most restrictive)" option is set, it would be very nice if I could programmaticly add domains to this list and query them back. I am looking to automate the end-to-end Auzre AD B2B invitation process from an internal portal, and this will be a requirement.

    7 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    4 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  14. Graph Explorer not working as intended

    Graph Explorer is not working as intended making things more complex and complicated for developers. I am trying assign permission which requires admin consent, though logged in as admin and gave consent it never got saved. Please fix the issue immediately.

    1 vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  15. Expose New API to work with Company Branding via Graph API

    Expose new API to work with company branding like Sign-in page background image, Sign in page text, Sign-in page background color etc.
    or extend /organization endpoint.

    13 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  16. enable all User attributes (which can be queried in the MS Graph API) as custom access token claims

    There are a select few of "optional attributes" to attach to an Azure AD Access Token. Ideally, any "user" attribute can be incorporated into an access token. In our case, we need mailNickname, but I see other attributes being requested such as employeeId. We should be able to name "User" as the source and select any property available as an AD attribute attached to the user.

    1 vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  17. 1 vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  18. Graph - Add "isAdmin: true/false" to /me to identify users I can prompt for Admin consent

    My application can be used in a basic mode without Admin permissions. I would like to prompt Administrators for advanced permissions. Currently I cannot detect who is an Admin without already being granted Directory.Read.All permission by an Admin.

    If the "me" route could identify whether the user is an Admin or not it would allow much more control from our application side, without exposing much information

    11 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  19. Raise limit of 100 schema extension property values allowed per resource instance

    Removing the limit of 100 schema extensions property values allowed per resource instance would allow me to build a comprehensive directory with many, many fields for my organization. My on-premise AD has hundreds of fields that I would like to extend to AAD.

    1 vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
  20. 1 vote
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Identity and Access  ·  Flag idea as inappropriate…  ·  Admin →
← Previous 1 3 4 5
  • Don't see your idea?

Feedback and Knowledge Base