Microsoft Graph Teams Guest Invitation

Question

I'm trying to develop an app in Teams to help team owners invite external guests to their teams. The app uses graph api /invitations call in the backend to get the job done. We are restricting users who can invite guests by assigning them the User.Invite.All api permission in Azure portal under AD App registration blade. What we found was that even users who have not been assigned this permission are able to invite guests. Am I doing anything wrong?

Answer 1

If you gave the delegated permission User.Invite.All to the app, and the user is able to invite a user, then the user already had rights to invite users. They would be able to go to eg portal.azure.com, and invite users from there as well in that case.

If you gave the app permission User.Invite.All to the app, then any user using the app can invite users, since the app itself has the permission and the user info is not even present in the access token.