#roles 3 articles

• A list with WriteSecurity 4 ignores Contribute — only ManageLists gets throughgotchas / permissionsOnly ManageLists (Design/Edit/Full Control) overrides the item-level write block, so "break inheritance + give the group Contribute" grants nothing; resolve the role by RoleTypeKind, not by its localised name
• Approving Microsoft Graph permissions for SPFx needs a Global Administrator — Application Administrator is not enoughgotchas / permissionsAPI access requests for Microsoft Graph need Global Administrator (Application Administrator only covers third-party APIs), and admin consent for Graph application permissions such as Sites.Selected is explicitly…
• Manage Lists lets you read other people's items on a WriteSecurity 2 list, but not edit them — that takes Override List Behaviorsgotchas / permissionsOn a list with item-level write security, the Edit role (Manage Lists) still gets 403 when it updates an item someone else created; only a role with Override List Behaviors (CancelCheckout, Low 0x100) gets through, so…