title: Group.ReadWrite.All scope clarification
body: <p>My organization operates a shared Azure tenant between two separate organizations.</p>
  <p>I have a requirement to provide a third party application (working on behalf of just one of the orgs) Delegated <code>Group.ReadWrite.All</code> permission to Microsoft Graph.</p>
  <p>I am just being ultra-cautious about what this may mean in terms of the tenant and both organizations, and appreciate similar questions have been posted.</p>
  <p>So my understanding is</p>
  <ol>
  <li><p><code>Group.ReadWrite.All</code> grants the application permission to write to the O365 Group Calendar and SharePoint Group, delegated which means the application can only access Graph via a valid signed in application user?</p>
  </li>
  <li><p>This means whatever the signed-in user cannot do, neither can the application?</p>
  </li>
  <li><p>This also means that if the signed-in user has no permissions to access anything on the second organization (SharePoint site; O365 calendar) then neither can the application?</p>
  </li>
  <li><p>It would only be bad practice e.g. ICT accidentally adding in the wrong user etc that would result in the application having more rights than it should?</p>
  </li>
  </ol>