Directory.Read.All is a Microsoft Graph application or delegated permission that allows read access to directory objects such as users, groups, devices, and applications in Microsoft Entra ID. It is powerful because it exposes tenant metadata at scale, not just a single mailbox or file.
In cyber security, this permission matters because an attacker who obtains a token, compromises an app, or abuses a consent grant can use Graph to enumerate the organization’s structure. That information supports spearphishing, impersonation, privilege mapping, and discovery of high-value accounts. Defenders should treat broad directory-read access as sensitive, review app consents regularly, and monitor Graph activity and audit logs for unusual reads. Least privilege and strong Conditional Access reduce the chance that one stolen identity can turn the directory into an intelligence source.