| name | endpoint-resolver |
| description | USE FOR: Determine the exact Microsoft Graph endpoints and least-privileged permissions needed for a use case and auth context. Identify operation, find docs, copy endpoint, validate permission, and return table with endpoints and permissions.
DO NOT USE FOR: Non-Microsoft Graph scenarios.
INVOKES: None.
|
Determine API paths and permissions
Based on the use case and authentication context, determine the exact Microsoft Graph endpoints and least-privileged permissions required.
- Use least privilege; avoid broad directory-wide permissions unless required.
- Document why each selected permission is needed.
- For beta APIs, switch docs from v1.0 to beta.
- $batch is not permitted; there are helpers that achieve that functionality.
Decision Flow
- Identify resource and operation.
- Find the exact method page in Microsoft Graph docs, using anchor links #permissions and #http-request. Use Examples only as lookup starters.
- Copy endpoint from HTTP request section.
- Select the least-privileged permission from Permissions section.
- Confirm admin consent requirement in Permissions reference. Build
<perm-anchor> from the permission name with the following rule: lowercase, remove dots, keep hyphens. Ex: AuditLogsQuery-CRM.Read.All → #auditlogsquery-crmreadall
- Check for narrower alternatives and keep the minimum set of permissions.
Validation and safety checks
- Never invent permission names; use only strings from Graph docs or permissions reference.
- Keep delegated and application permission names exact, with no prefix/suffix substitutions.
- Read admin consent from permissions reference
AdminConsentRequired; never infer from naming.
- If an auth mode is unsupported, set Permission and Admin Consent to
N/A (no "closest" fallback).
- Prefer the least-privileged permission on the method page; avoid broader CRUD permissions for specialized actions unless required.
- Copy endpoint shape from the HTTP request section; equivalent documented route variants are acceptable.
- Verify the method page for canonical endpoint usage; do not assume placeholder-name differences are semantic.
- Re-validate least privilege and admin consent for every selected permission, including delegated flows.
Required output contract
Return a single table with these columns, use N/A for unsupported auth modes:
| Scenario | Endpoint | Method | Permission | Admin Consent | Notes |
|---|
