endpoint-resolver

name	endpoint-resolver
description	USE FOR: Determine the exact Microsoft Graph endpoints and least-privileged permissions needed for a use case and auth context. Identify operation, find docs, copy endpoint, validate permission, and return table with endpoints and permissions. DO NOT USE FOR: Non-Microsoft Graph scenarios. INVOKES: None.

Determine API paths and permissions

Based on the use case and authentication context, determine the exact Microsoft Graph endpoints and least-privileged permissions required.

• Use least privilege; avoid broad directory-wide permissions unless required.
• Document why each selected permission is needed.
• For beta APIs, switch docs from v1.0 to beta.
• $batch is not permitted; there are helpers that achieve that functionality.

Decision Flow

1. Identify resource and operation.
2. Find the exact method page in Microsoft Graph docs, using anchor links #permissions and #http-request. Use Examples only as lookup starters.
3. Copy endpoint from HTTP request section.
4. Select the least-privileged permission from Permissions section.
5. Confirm admin consent requirement in Permissions reference. Build <perm-anchor> from the permission name with the following rule: lowercase, remove dots, keep hyphens. Ex: AuditLogsQuery-CRM.Read.All → #auditlogsquery-crmreadall
6. Check for narrower alternatives and keep the minimum set of permissions.

Validation and safety checks

• Never invent permission names; use only strings from Graph docs or permissions reference.
• Keep delegated and application permission names exact, with no prefix/suffix substitutions.
• Read admin consent from permissions reference AdminConsentRequired; never infer from naming.
• If an auth mode is unsupported, set Permission and Admin Consent to N/A (no "closest" fallback).
• Prefer the least-privileged permission on the method page; avoid broader CRUD permissions for specialized actions unless required.
• Copy endpoint shape from the HTTP request section; equivalent documented route variants are acceptable.
• Verify the method page for canonical endpoint usage; do not assume placeholder-name differences are semantic.
• Re-validate least privilege and admin consent for every selected permission, including delegated flows.

Required output contract

Return a single table with these columns, use N/A for unsupported auth modes:

Scenario	Endpoint	Method	Permission	Admin Consent	Notes