OAuth scope
An OAuth scope is a named access range that a client requests or an authorization server grants for an access token.
Read the permission in context
OAuth represents scopes as space-separated, case-sensitive strings. The authorization server defines what they mean. A scope is not a universal permission with the same effect across every API.
The scopes requested and granted can differ. RFC 6749 requires the authorization server to report the actual scope when it differs from the request.
For example, Microsoft’s https://graph.microsoft.com/Calendars.Read scope is for reading calendars through Microsoft Graph. Seeing it in a request tells you what the application asked for, not whether access was granted or a calendar was read.
Microsoft’s permission model
Microsoft calls delegated permissions scopes. They let an application act on behalf of a user. Application permissions use app roles for app-only access. Other OAuth providers do not have to use the same model.
Microsoft’s .default behavior applies to permissions configured and granted for a resource. It does not automatically give the application every permission that API offers.
Before approving access, check the resource’s documentation to understand each permission and whether the application needs it.