Mail.Read

Low 14.1 / 100 · delegated · microsoft-graph

Why

Reads the signed-in user’s mailbox in full, including message bodies and attachments. Mail routinely contains credentials, contracts, and personal data, so sensitivity is high even though reach stops at one user. Read-only and single-user scope keep this well below the tenant-wide variants.

Factor assignments

Factor	Value	Score	Domain
Data Classification	Confidential	25	Data Sensitivity & Leakage
Exfiltration Potential	Basic read	15	Data Sensitivity & Leakage
Permission Breadth	Single user or object	10	Access Surface & Blast Radius
Permission Type	Delegated	10	Access Surface & Blast Radius
Token Persistence	Short-lived	10	Data Sensitivity & Leakage
Access Policy Modification	None	0	Access Surface & Blast Radius
App Role Bundles	No bundle	0	Identity & Privilege Escalation
Impersonation Capability	None	0	Identity & Privilege Escalation
Legacy API Risk	Modern API	0	Compliance & Trust Heuristics
Permission Operation	Read	0	Access Surface & Blast Radius
Privilege Depth	No administrative depth	0	Identity & Privilege Escalation
Privilege Elevation	None	0	Identity & Privilege Escalation
User Breadth	One user	0	Access Surface & Blast Radius

How the score is reached

Domain	Raw	Normalized	Weight	Contribution
Identity & Privilege Escalation	0 / 140	0%	40%	0
Access Surface & Blast Radius	20 / 165	12.1%	30%	3.64
Data Sensitivity & Leakage	50 / 120	41.7%	25%	10.42
Compliance & Trust Heuristics	0 / 40	0%	5%	0
			Composite	14.1

A narrower scope exists

Mail.Read.Shared achieves the same outcome with Resource-Specific Consent, scoped to explicitly assigned resources. Requesting this scope instead is a missed least-privilege opportunity — see §3.2.2.

References

• https://learn.microsoft.com/en-us/graph/permissions-reference#mailread

---

Disagree with this rating? That is the point — open a rating change request naming the factor you would change and the evidence for it.