What should you check before a first integration with Microsoft Graph?
Answer out loud or in your head first, then compare.
Answer
First I choose a specific operation and check the permissions it requires. Delegated access means acting on behalf of the logged-in person, within their rights and the app's consent. Application access means the app's own identity, with no current user. These are significantly different capabilities.
I also check paging through data and limits on the number of calls. When Graph responds with 429, I respect the time in Retry-After. Notification and change-tracking mechanisms depend on the resource; they aren't identical for every endpoint. I don't assume that reading as the application will automatically check the rights of the person who asked the question in the chat.
Why it matters: Gives a practical starting point without requiring knowledge of all of Microsoft 365.
Possible follow-ups: Why does an app with broad access still have to restrict results for the user?
How did it go? Be honest — “Not yet” puts the question on your review list.
Start with
- M-P01 · What is Azure, and how does it differ from Azure OpenAI? — Python, Microsoft and SAP
- M-P02 · What are Entra ID, Microsoft Graph and SharePoint? — Python, Microsoft and SAP
- M-P03 · What is SAP, and why would an agent connect to it? — Python, Microsoft and SAP
Further reading
- Microsoft Graph: Overview of permissions(opens in a new tab)Docs; accessed 22.10.2026. Delegated and application permissions, and the limits of access.
- Microsoft Graph: Throttling guidance(opens in a new tab)Docs; accessed 22.10.2026. 429, Retry-After and controlling the call rate.