We have an application that requests users to grant permissions for specific features, such as Chat.Read or Calendar.Read, one at a time. We would like your assistance in understanding the following:

1. How can we programmatically revoke these permissions from our side?
2. Is it possible to revoke a specific permission only? For example, if a user has granted both Chat.Read and Calendar.Read, can we revoke only Calendar.Read while keeping Chat.Read active?

We only ask for delegated permission and never ask for any Admin consent permission.

We appreciate your guidance on this matter.

We tried doing this: Get the oauth2PermissionGrant ID for the user

GET .0/me/oauth2PermissionGrants Authorization: Bearer <token>

Delete the oauth2PermissionGrant

DELETE .0/oauth2PermissionGrants/{id} Authorization: Bearer <token>

but we got an error saying: Deleting an OAuth2 permission grant requires an admin-level token with one of the following permissions:

Application.ReadWrite.All

Directory.AccessAsUser.All

We never asked for these Admin level permissions

We have an application that requests users to grant permissions for specific features, such as Chat.Read or Calendar.Read, one at a time. We would like your assistance in understanding the following:

1. How can we programmatically revoke these permissions from our side?
2. Is it possible to revoke a specific permission only? For example, if a user has granted both Chat.Read and Calendar.Read, can we revoke only Calendar.Read while keeping Chat.Read active?

We only ask for delegated permission and never ask for any Admin consent permission.

We appreciate your guidance on this matter.

We tried doing this: Get the oauth2PermissionGrant ID for the user

GET https://graph.microsoft/v1.0/me/oauth2PermissionGrants Authorization: Bearer <token>

Delete the oauth2PermissionGrant

DELETE https://graph.microsoft/v1.0/oauth2PermissionGrants/{id} Authorization: Bearer <token>

but we got an error saying: Deleting an OAuth2 permission grant requires an admin-level token with one of the following permissions:

Application.ReadWrite.All

Directory.AccessAsUser.All

We never asked for these Admin level permissions

• azure
• microsoft-graph-api
• revoke-token

1 Answer 1

Programmatic revocation of delegated permissions (full or partial) without admin may not work. Direct users to revoke access manually via Microsoft portals, as APIs require elevated permissions not available in your scenario. Even if you log users out and clear the token, this doesn't revoke permission.