MS Graph “Subscription Permissions” for the supported resource ‘todoTask’ – To what extent are “Application Permissions” and “Delegated Permissions” supported (current status: “Permissions supported vs. not supported”)?

FrankDller-7292 0 Reputation points
2026-10-23T14:18:39.73+00:00

When attempting to synchronize “todoTask” from SAP Sales Cloud to MS Outlook using “Subscription” in combination with “Application Permission”, we did not receive any “Notifications”. As a result, task synchronization could not be performed (task was created and active).

The situation is different when using “Subscription” in combination with “Delegated Permission” (Graph Explorer). Notifications are sent immediately after the task is created.

Why aren’t notifications sent when using “Application Permission,” even though

-   “Tasks.ReadWrite.All” was granted with admin consent?

-   the same notificationUrl, resource, and tenant were configured in each case?

History - Support for “Application Permissions”

  1. Based on our observations, “Application Permissions” were generally supported in the past.
  2. This changed recently when the “not supported” list was updated, and as a result, “Application Permissions” were no longer supported.
  3. Following another update to the documentation (supported vs. not supported), “Application Permissions” for "todoTasks" are once again listed as “Supported” via "Tasks.readwrite.all" (as of today)
  4. As a result, we are observing (as of today) that on some systems, the synchronization of “todoTask” - including notifications - works with “Application Permissions,” while on others, only “Delegated Permissions” work.

We would therefore like to know what is causing this and which permissions are currently supported by Microsoft?

Here, we are referring, among other things, to the “Permissions” section in this Microsoft documentation https://learn.microsoft.com/en-us/graph/api/subscription-post-subscriptions?view=graph-rest-1.0&tabs=http

Microsoft Security | Microsoft Graph
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-10-23T14:18:59.3133333+00:00

    For Microsoft Graph change notifications on todoTask, the current documented support is:

    • Delegated (work or school account): Tasks.ReadWrite
    • Delegated (personal Microsoft account): Tasks.ReadWrite
    • Application: Tasks.ReadWrite.All

    That means application permissions are currently documented as supported for todoTask subscriptions.

    Also, for creating a subscription, Microsoft states that the app must have read permissions for the resource, and the permissions table lists the least privileged required permission for each supported resource. For todoTask, that least privileged application permission is Tasks.ReadWrite.All.

    What can be concluded from the documented facts:

    1. todoTask supports both delegated and application permissions for subscriptions.
    2. A delegated subscription working in Graph Explorer does not prove app-only behavior is identical, because delegated access and application access are different permission models:
      • delegated access is on behalf of a signed-in user
      • application access is app-only, without a signed-in user
    3. The documentation provided does not describe any tenant-by-tenant rollout difference, known limitation, or exclusion for todoTask application subscriptions.
    4. The documentation provided also does not explain why notifications would be delivered in delegated mode but not in application mode when subscription creation succeeds.

    So, based on the current documented status, the supported permissions for todoTask subscriptions are exactly:

    • Delegated: Tasks.ReadWrite
    • Application: Tasks.ReadWrite.All

    The “current status” in Microsoft documentation is therefore supported, not “not supported,” for application permissions on todoTask.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.