{ "data": { "similar": [ { "grade": "B", "json": "https://www.anchorterminal.com/tools/google-people-api.json", "name": "Google People API", "score": 65.2, "shared": [ "contacts.read", "contacts.write", "contacts.search", "contacts.sync" ], "slug": "google-people-api" }, { "grade": "E", "json": "https://www.anchorterminal.com/tools/contactsplus.json", "name": "ContactsPlus", "score": 42.4, "shared": [ "contacts.read", "contacts.write", "contacts.search", "contacts.sync" ], "slug": "contactsplus" } ], "tool": { "slug": "microsoft-graph-people", "name": "Microsoft Graph People and Contacts API", "vendor": "Microsoft", "vendorUrl": "https://learn.microsoft.com/en-us/graph/outlook-contacts-concept-overview", "kind": "http-api", "category": "contacts", "summary": "Microsoft Graph endpoints for a user's Outlook personal contacts and contact folders, with delta sync, and the people API, which ranks the people most relevant to a user and supports fuzzy search.", "url": "https://www.anchorterminal.com/tools/microsoft-graph-people", "markdownUrl": "https://www.anchorterminal.com/tools/microsoft-graph-people.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/microsoft-graph-people.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/microsoft-graph-people.json", "repo": "https://github.com/microsoftgraph/msgraph-sdk-javascript", "license": "MIT (SDKs)", "transports": [ "http" ], "remoteUrl": "https://graph.microsoft.com/v1.0", "packages": [ { "registry": "npm", "name": "@microsoft/microsoft-graph-client" }, { "registry": "pypi", "name": "msgraph-sdk" } ], "auth": "oauth", "authNotes": "OAuth 2.0 tokens from Microsoft Entra ID. Contacts use Contacts.Read or Contacts.ReadWrite, delegated (work, school or personal Microsoft account) or application. The people API uses People.Read with user consent, or People.Read.All, which needs admin consent, to read people relevant to another user. Application permissions reach every mailbox in a tenant unless RBAC for Applications limits them.", "pricing": "byo-plan", "pricingNotes": "Contacts and people endpoints aren't metered. Work accounts need an Exchange Online mailbox through a Microsoft 365 or Exchange licence. Personal Outlook.com accounts work with delegated permissions at no cost (checked 2026-10-14).", "priceSummary": "Your plan", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Graph contacts or people docs (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 834, "npmWeekly": 2321990, "pypiWeekly": 1639437, "asOf": "2026-10-14" }, "docsUrl": "https://learn.microsoft.com/en-us/graph/outlook-contacts-concept-overview", "openapi": "https://raw.githubusercontent.com/microsoftgraph/msgraph-metadata/master/openapi/v1.0/openapi.yaml", "capabilities": [ "contacts.read", "contacts.write", "contacts.search", "contacts.sync" ], "tags": [ "hosted", "official", "oauth", "openapi", "webhooks", "typescript", "python", "enterprise" ], "lastRelease": "2026-03-12", "graded": true, "anchor": { "graded": true, "score": 64.6, "grade": "B", "agentReady": false, "rank": 369, "ranked": true, "rankOf": 1076, "categoryRank": 2, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 83, "maintenance": 76, "payments": 35, "reliability": 60, "schema": 83, "security": 72, "transparency": 69 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 60, "points": 12, "reason": "Graded on the v1.0 REST API, as the microsoft-graph-calendar and outlook-mail-graph listings were. A public Microsoft service health page at status.cloud.microsoft (20). It renders only with JavaScript, so components and history weren't readable (5). Contacts fall under the Outlook limits of 10,000 requests per 10 minutes and four concurrent requests per app and mailbox (15). 429 responses carry Retry-After with backoff guidance, but contact creation has no transactionId or other idempotency key, so a retried create can duplicate (10 of 15). No SLA covering the Graph API found (0). Contacts and people endpoints are generally available on v1.0 (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 83, "points": 13.49, "reason": "OpenAPI for all of Graph v1.0 in microsoftgraph/msgraph-metadata, plus CSDL (25). No llms.txt on learn.microsoft.com (0). Reference pages list least-privileged permissions per account type and state limits such as $search working only for the signed-in user's relevant people and $skip not working with $search (17). Typed properties and enums in the metadata (13). Example requests and responses on every page and the shared Graph error format (13). v1.0 and beta with a dated changelog whose latest personal contacts entry is 12 March 2026 (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 83, "points": 13.49, "reason": "$select and $top on both APIs, and odata.maxpagesize on delta (23). @odata.nextLink paging, delta tokens for contact folders, $filter on email addresses, relevance ordering and fuzzy $search on people (20). Graph errors carry a code, message and request ID, and 429s say which throttle scope was hit (17). No idempotency key on contact creates and no MCP tool annotations to check, since the only MCP option is the legacy User server (10 of 20). Official SDKs in .NET, Java, Python, Go and more, with the JavaScript client last published to npm in September 2023 (13)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 72, "points": 12.6, "reason": "OAuth 2.0 through Entra ID with Contacts.Read, Contacts.ReadWrite, People.Read and People.Read.All (30). Read-only permissions for every read path, admin consent for reading other users' relevant people, and RBAC for Applications to limit application permissions to chosen mailboxes. Nothing asks for confirmation before a delete or permanentDelete (17 of 20). Contact names, notes and people results can carry text written by outsiders, and no injection guidance was found in these docs (5 of 15). Graph activity logs record app, user, IP, URI, status and scopes per request with Entra ID P1 or P2 (12). microsoft.com's security.txt expired on 23 September 2026 and was still expired on 14 October, and a token-leak fix in the JavaScript client sits unreleased with no advisory (8 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 35, "points": 4.38, "reason": "No x402, MPP or L402 (0). Contacts and people endpoints aren't metered and Microsoft 365 plan prices are public, but work accounts need a licensed mailbox (15). Personal Microsoft accounts work with delegated permissions at no cost and no card (20). A person registers an app in Entra and, for application or People.Read.All permissions, an admin consents (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 76, "points": 6.65, "reason": "msgraph-sdk-python 1.64.0 on 6 October 2026 (30). Several Python SDK releases in the last 90 days, continuing the series graded on the other Graph listings (20). Public changelog and SDK issue trackers, but the June 2026 security fix still hasn't reached npm (10). Current SDKs in most languages, with the JavaScript client the exception at 3.0.7 from September 2023 (10). Active CI on the metadata and Python repositories, none of it reaching the JavaScript package (6)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 69, "points": 6.04, "note": "editorial 52, provenance 85", "reason": "Closed service under the Microsoft APIs terms of use, with MIT SDKs (15). The Microsoft privacy statement and product terms cover Graph, but we found no retention statement for contacts or people data through the API (15). Dated deprecations in the changelog, such as the sharedInsight list method announced on 14 January 2026 to stop returning data after November 2026 (14 of 20). Microsoft 365 sub-processor and data residency pages exist, which we didn't recheck (8)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "$select and $top on both APIs, and odata.maxpagesize on delta (23). @odata.nextLink paging, delta tokens for contact folders, $filter on email addresses, relevance ordering and fuzzy $search on people (20). Graph errors carry a code, message and request ID, and 429s say which throttle scope was hit (17). No idempotency key on contact creates and no MCP tool annotations to check, since the only MCP option is the legacy User server (10 of 20). Official SDKs in .NET, Java, Python, Go and more, with the JavaScript client last published to npm in September 2023 (13).", "maintenance": "msgraph-sdk-python 1.64.0 on 6 October 2026 (30). Several Python SDK releases in the last 90 days, continuing the series graded on the other Graph listings (20). Public changelog and SDK issue trackers, but the June 2026 security fix still hasn't reached npm (10). Current SDKs in most languages, with the JavaScript client the exception at 3.0.7 from September 2023 (10). Active CI on the metadata and Python repositories, none of it reaching the JavaScript package (6).", "payments": "No x402, MPP or L402 (0). Contacts and people endpoints aren't metered and Microsoft 365 plan prices are public, but work accounts need a licensed mailbox (15). Personal Microsoft accounts work with delegated permissions at no cost and no card (20). A person registers an app in Entra and, for application or People.Read.All permissions, an admin consents (0).", "reliability": "Graded on the v1.0 REST API, as the microsoft-graph-calendar and outlook-mail-graph listings were. A public Microsoft service health page at status.cloud.microsoft (20). It renders only with JavaScript, so components and history weren't readable (5). Contacts fall under the Outlook limits of 10,000 requests per 10 minutes and four concurrent requests per app and mailbox (15). 429 responses carry Retry-After with backoff guidance, but contact creation has no transactionId or other idempotency key, so a retried create can duplicate (10 of 15). No SLA covering the Graph API found (0). Contacts and people endpoints are generally available on v1.0 (10).", "schema": "OpenAPI for all of Graph v1.0 in microsoftgraph/msgraph-metadata, plus CSDL (25). No llms.txt on learn.microsoft.com (0). Reference pages list least-privileged permissions per account type and state limits such as $search working only for the signed-in user's relevant people and $skip not working with $search (17). Typed properties and enums in the metadata (13). Example requests and responses on every page and the shared Graph error format (13). v1.0 and beta with a dated changelog whose latest personal contacts entry is 12 March 2026 (15).", "security": "OAuth 2.0 through Entra ID with Contacts.Read, Contacts.ReadWrite, People.Read and People.Read.All (30). Read-only permissions for every read path, admin consent for reading other users' relevant people, and RBAC for Applications to limit application permissions to chosen mailboxes. Nothing asks for confirmation before a delete or permanentDelete (17 of 20). Contact names, notes and people results can carry text written by outsiders, and no injection guidance was found in these docs (5 of 15). Graph activity logs record app, user, IP, URI, status and scopes per request with Entra ID P1 or P2 (12). microsoft.com's security.txt expired on 23 September 2026 and was still expired on 14 October, and a token-leak fix in the JavaScript client sits unreleased with no advisory (8 of 20).", "transparency": "Closed service under the Microsoft APIs terms of use, with MIT SDKs (15). The Microsoft privacy statement and product terms cover Graph, but we found no retention statement for contacts or people data through the API (15). Dated deprecations in the changelog, such as the sharedInsight list method announced on 14 January 2026 to stop returning data after November 2026 (14 of 20). Microsoft 365 sub-processor and data residency pages exist, which we didn't recheck (8)." }, "sources": [ { "what": "Outlook contacts overview", "url": "https://learn.microsoft.com/en-us/graph/outlook-contacts-concept-overview", "seen": "2026-10-14" }, { "what": "list people reference", "url": "https://learn.microsoft.com/en-us/graph/api/user-list-people?view=graph-rest-1.0", "seen": "2026-10-14" }, { "what": "people API overview", "url": "https://learn.microsoft.com/en-us/graph/people-insights-overview", "seen": "2026-10-14" }, { "what": "contact delta reference", "url": "https://learn.microsoft.com/en-us/graph/api/contact-delta?view=graph-rest-1.0", "seen": "2026-10-14" }, { "what": "list contacts reference", "url": "https://learn.microsoft.com/en-us/graph/api/user-list-contacts?view=graph-rest-1.0", "seen": "2026-10-14" }, { "what": "throttling limits", "url": "https://learn.microsoft.com/en-us/graph/throttling-limits", "seen": "2026-10-14" }, { "what": "Graph changelog feed", "url": "https://developer.microsoft.com/en-us/graph/changelog/rss", "seen": "2026-10-14" }, { "what": "Agent 365 MCP server options", "url": "https://learn.microsoft.com/en-us/microsoft-agent-365/tooling-servers-overview", "seen": "2026-10-14" }, { "what": "npm latest for @microsoft/microsoft-graph-client", "url": "https://registry.npmjs.org/@microsoft/microsoft-graph-client/latest", "seen": "2026-10-14" }, { "what": "microsoft.com security.txt", "url": "https://www.microsoft.com/.well-known/security.txt", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: status page components and incident history, which need JavaScript", "unchecked: rate limits specific to the people API, which the throttling page doesn't list separately", "Whether Microsoft will publish msgraph-sdk-javascript 3.0.8 or an advisory for the 16 June 2026 fix", "Whether Work IQ in Agent 365 will expose contacts or people tools to replace the legacy User server" ] }, "negative": -4, "negativeNotes": [ "2026-06-16: a fix for a token leak through URL userinfo host confusion was merged into msgraph-sdk-javascript and the version bumped to 3.0.8, but on 14 October 2026 npm still serves 3.0.7 from September 2023 and the repository has no published advisory. Exploiting it needs an attacker-influenced URL passed to the client (https://github.com/microsoftgraph/msgraph-sdk-javascript/commit/5438ae90f50ef15d3656f0cf9c5485deee351f19, https://registry.npmjs.org/@microsoft/microsoft-graph-client/latest)" ], "verdict": "Covers Outlook personal contacts with delta sync and a people API that ranks the people a user works with and supports fuzzy search, all under separate read and write permissions. Contact creates have no idempotency key, the status page needs JavaScript, and Microsoft has no current MCP server for contacts.", "bestFor": "Agents working in Microsoft 365 tenants or with Outlook.com address books, especially to find who a user works with.", "strengths": [ "People API ranks contacts and colleagues by relevance and supports fuzzy name search", "Delta queries per contact folder return only what changed", "Contacts.Read and People.Read keep read-only agents away from writes", "Works for Microsoft 365 work accounts and personal Microsoft accounts", "Graph activity logs record every request with app, user, IP and status" ], "weaknesses": [ "No idempotency key on contact creation, so retries can duplicate", "4 concurrent requests per app per mailbox", "The npm JavaScript client is 3.0.7 from September 2023, without the June 2026 token-leak fix", "The only MCP option, the User server, is kept for backward compatibility", "Status page renders only with JavaScript" ], "agentNotes": [ "Use /me/people?$search= for fuzzy lookups and /me/contacts for the saved address book, since they return different sets", "Keep the @odata.deltaLink from the contact delta function and call it on the next run", "Check for an existing contact with $filter on emailAddresses before creating one", "Honour Retry-After on 429 and keep to 4 parallel calls per mailbox", "Ask for Contacts.Read and People.Read unless the task must change contacts" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.6 } ], "editorialScores": { "ergonomics": 83, "maintenance": 76, "payments": 35, "reliability": 60, "schema": 83, "security": 72, "transparency": 52 }, "provenanceScore": 85 }, "connect": { "http": "curl \"https://graph.microsoft.com/v1.0/me/people?\\$search=adele\u0026\\$top=10\u0026\\$select=displayName,scoredEmailAddresses\" \\\n -H \"Authorization: Bearer $MS_GRAPH_TOKEN\"" }, "letme": { "capability": "https://letme.dev/contacts.read", "tool": "https://letme.dev/microsoft-graph-people" }, "sameCompany": [ "azure-foundry-fine-tuning", "azure-ai-content-safety", "azure-speech-to-text", "azure-text-to-speech", "microsoft-agent-framework", "microsoft-execution-containers", "microsoft-entra-agent-id", "azure-key-vault", "azure-document-intelligence", "azure-devops-mcp", "microsoft-learn-mcp", "playwright-mcp", "azure-mcp", "azure-maps", "azure-translator", "microsoft-graph-calendar", "azure-blob-storage", "onedrive-sharepoint", "microsoft-teams", "dynamics-365-sales", "power-automate", "foundry-local", "microsoft-decision-1", "microsoft-advertising-api", "microsoft-excel-graph", "outlook-mail-graph" ], "notable": [ "GET /me/people returns people ordered by relevance from the user's communication and collaboration patterns, and $search supports fuzzy matching on name or alias, only for the signed-in user (https://learn.microsoft.com/en-us/graph/api/user-list-people?view=graph-rest-1.0)", "The contact delta function returns changes in a contact folder with $deltatoken and $skiptoken, and odata.maxpagesize sets the page size (https://learn.microsoft.com/en-us/graph/api/contact-delta?view=graph-rest-1.0)", "Contacts sit under the Outlook service limits of 10,000 requests per 10 minutes and four concurrent requests per app and mailbox (https://learn.microsoft.com/en-us/graph/throttling-limits)", "The latest v1.0 change to personal contacts in the Graph changelog, on 12 March 2026, added primary, secondary and tertiary email address properties (https://developer.microsoft.com/en-us/graph/changelog/rss)", "The User MCP server in Copilot Studio (profiles, managers, direct reports, user search) is one of the workload servers Microsoft keeps only for backward compatibility and says not to use for new projects (https://learn.microsoft.com/en-us/microsoft-agent-365/tooling-servers-overview)" ], "area": "everyday", "details": [ { "label": "Contacts", "value": "/me/contacts and /me/contactFolders with list, get, create, update, delete, permanentDelete and $filter on email addresses" }, { "label": "Sync", "value": "Contact delta per contact folder with $deltatoken and $skiptoken, plus change notification subscriptions on contacts" }, { "label": "People", "value": "/me/people and /users/{id}/people ranked by relevance, 10 results by default, $top, $skip, $select, $filter and fuzzy $search for the signed-in user" }, { "label": "Permissions", "value": "Contacts.Read, Contacts.ReadWrite, People.Read (user consent), People.Read.All (admin consent)" }, { "label": "Rate limits", "value": "10,000 requests per 10 minutes and 4 concurrent per app per mailbox, under a global 130,000 requests per 10 seconds per app" }, { "label": "Accounts", "value": "Microsoft 365 and Exchange Online work accounts, and personal Microsoft accounts with delegated permissions" } ], "provenance": { "legalEntity": "Microsoft Corporation", "domain": "microsoft.com", "domainRegistered": "1991-05-02", "endpointOnVendorDomain": true, "terms": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "privacy": "https://privacy.microsoft.com/en-us/privacystatement", "statusPage": "https://status.cloud.microsoft", "changelog": "https://developer.microsoft.com/en-us/graph/changelog", "securityTxt": "expired", "checked": "2026-10-14", "notes": [ "The endpoint is on graph.microsoft.com. www.microsoft.com/.well-known/security.txt still carried an Expires date of 2026-09-23 on 2026-10-14.", "The Microsoft service health page at status.cloud.microsoft needs JavaScript to show anything, per the Graph listings' earlier checks.", "The people API overview page is dated 2019-04-09 and the contact resource page 2026-02-27." ], "score": 85, "checks": [ { "check": "Legal entity named", "value": "Microsoft Corporation", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "microsoft.com, registered 1991-05-02 (35 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "graph.microsoft.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 3 clauses that cost points", "points": 2.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.cloud.microsoft", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "published but past its Expires date", "points": 5, "max": 10, "state": "part" } ], "policies": [ { "kind": "terms", "url": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-10-01", "words": 4555, "points": 2.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: October 2025 What's new?", "says": "Last updated 2025-10-01" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": false }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "WE MAKE NO WARRANTIES, EXPRESS OR IMPLIED, GUARANTEES OR CONDITIONS WITH RESPECT TO YOUR USE OF THE MICROSOFT APIs." }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "We may change, amend or terminate these API Terms at any time." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "WE MAY MODIFY THESE API TERMS AT ANY TIME, WITH OR WITHOUT PRIOR NOTICE TO YOU.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Unless you have use permissions expressly and specifically granted by Customers in connection with using your Application, you may not use Microsoft email protocols and APIs for any purpose other than:" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Scrape, build databases or otherwise create copies of any data accessed or obtained using the Microsoft APIs, except as necessary to enable an intended usage scenario for your Application;", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "Use the Microsoft APIs, or any data obtained using the Microsoft APIs, to conduct performance testing of a Microsoft Offering unless expressly permitted by Microsoft", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "WE MAY MODIFY THESE API TERMS AT ANY TIME, WITH OR WITHOUT PRIOR NOTICE TO YOU.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We may suspend or immediately terminate these API Terms, any rights granted herein, and/or your license to the Microsoft APIs, in our sole discretion at any time, for any reason." } ], "notes": [ { "date": "2026-10-08", "text": "Recoverable damages are limited to direct damages of up to 5 US dollars in total.", "quote": "YOU AGREE THAT YOUR EXCLUSIVE REMEDY IS TO RECOVER, FROM MICROSOFT OR ANY AFFILIATES, RESELLERS, DISTRIBUTORS, SUPPLIERS (AND RESPECTIVE EMPLOYEES, SHAREHOLDERS, OR DIRECTORS) AND VENDORS, ONLY DIRECT DAMAGES UP TO USD $5.00 COLLECTIVELY." }, { "date": "2026-10-08", "text": "After a data breach involving the Microsoft APIs, the developer may make no public statement about it without Microsoft's prior written permission.", "quote": "You agree to refrain from making public statements (e.g., press, blogs, social media, bulletin boards, etc.) without prior written and express permission from Microsoft in each instance as it relates to the Microsoft APIs." }, { "date": "2026-10-08", "text": "The developer must allow Microsoft reasonable access to its application so Microsoft can monitor compliance with the API terms.", "quote": "You will permit Microsoft reasonable access to your Application for purposes of monitoring compliance with these API Terms." } ] }, { "kind": "privacy", "url": "https://privacy.microsoft.com/en-us/privacystatement", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-09-01", "words": 33580, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: September 2026", "says": "Last updated 2026-09-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "The data we collect depends on the context of your interactions with Microsoft and the choices you make, including your privacy settings and the products and features you use." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "When you delete an email or item from a mailbox in Outlook.com, the item generally goes into your Deleted Items folder where it remains for approximately 7 days unless you move it back to your inbox, you empty the folder, or the service empties the folder automatically, whichever comes first.", "says": "Names a period of 7 days" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Service providers that help us determine your device’s location." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "not use or share student personal data for advertising or similar commercial purposes, such as providing personalized advertising to students;" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "State Data Privacy Notice (including notice at collection details) and the Consumer Health Data Privacy Policy for additional information about your rights and the processing of your personal data." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have a privacy concern, complaint, or question for the Microsoft privacy team or Data Protection Officer, please visit our privacy support and requests page and click on “Contact the Microsoft privacy team or the Microsoft Data Protection Officer” menu.", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "In such cases, we implement legal safeguards-such as standard contractual clauses approved by the European Commission – to help protect your rights and ensure your data remains protected.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models.", "costsPoints": true }, { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We also disclose personal data for digital advertising purposes." } ], "notes": [ { "date": "2026-10-08", "text": "For enterprise and developer products, the customer's agreement with Microsoft takes precedence over this privacy statement where the two conflict.", "quote": "In the event of a conflict between our privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control." }, { "date": "2026-10-08", "text": "Advertisements may be chosen from the current interaction, including Copilot conversations and files shared in them.", "quote": "Ads may be shown that relate to the current interaction you are having with us, such as your Copilot conversations (including files you share); your current location; transactions; product usage; search queries; or the content you’re viewing." }, { "date": "2026-10-08", "text": "Microsoft staff manually review some results of automated systems, including AI, against the source data.", "quote": "For example, to build, train, and improve the accuracy of our automated systems – such as AI - we manually review some of the results against the underlying data." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/microsoft-graph-people.json", "live": { "slug": "microsoft-graph-people", "probe": { "target": "https://graph.microsoft.com/v1.0", "method": "get", "lastAt": "2026-10-14T09:41:58.368018459Z", "lastOk": true, "lastStatus": 200, "lastMs": 3, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 4, "p95ms24h": 40, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "updatedAt": "2026-10-14T09:41:58.368018459Z" } }, "verify": { "accepts": "a page on microsoft.com or one of its subdomains, or the README of github.com/microsoftgraph/msgraph-sdk-javascript", "badgeUrl": "https://www.anchorterminal.com/badges/microsoft-graph-people.svg", "body": { "slug": "microsoft-graph-people", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/microsoft-graph-people", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/microsoft-graph-people\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/microsoft-graph-people.svg\" alt=\"Microsoft Graph People and Contacts API on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Microsoft Graph People and Contacts API on Anchor Terminal](https://www.anchorterminal.com/badges/microsoft-graph-people.svg)](https://www.anchorterminal.com/tools/microsoft-graph-people)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/microsoft-graph-people\"\u003eMicrosoft Graph People and Contacts API on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/microsoft-graph-people", "json": "https://www.anchorterminal.com/tools/microsoft-graph-people.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/microsoft-graph-people.md", "slim": "https://www.anchorterminal.com/tools/microsoft-graph-people.min.md" }, "markdown": "## Overview\n\n**Grade B · 64.6/100 · rank #369 of 1076 · #2 in Contacts \u0026 address books · not agent-ready · confidence medium**\n\n\nMore from Microsoft, listed separately because each is its own product: [Microsoft Foundry fine-tuning (Azure OpenAI)](https://www.anchorterminal.com/tools/azure-foundry-fine-tuning.md) (Fine-tuning), [Azure AI Content Safety (Prompt Shields)](https://www.anchorterminal.com/tools/azure-ai-content-safety.md) (Guardrails \u0026 safety filters), [Azure AI Speech speech-to-text](https://www.anchorterminal.com/tools/azure-speech-to-text.md) (Speech-to-text), [Azure AI Speech text-to-speech](https://www.anchorterminal.com/tools/azure-text-to-speech.md) (Text-to-speech), [Microsoft Agent Framework](https://www.anchorterminal.com/tools/microsoft-agent-framework.md) (Agent frameworks \u0026 SDKs), [Microsoft Execution Containers](https://www.anchorterminal.com/tools/microsoft-execution-containers.md) (Code execution sandboxes), [Microsoft Entra Agent ID](https://www.anchorterminal.com/tools/microsoft-entra-agent-id.md) (Agent auth \u0026 delegated access), [Azure Key Vault](https://www.anchorterminal.com/tools/azure-key-vault.md) (Secrets \u0026 credential vaults), [Azure Document Intelligence](https://www.anchorterminal.com/tools/azure-document-intelligence.md) (Document parsing \u0026 extraction), [Azure DevOps MCP Server](https://www.anchorterminal.com/tools/azure-devops-mcp.md) (Code \u0026 developer platforms), [Microsoft Learn MCP Server](https://www.anchorterminal.com/tools/microsoft-learn-mcp.md) (Code \u0026 developer platforms), [Playwright MCP](https://www.anchorterminal.com/tools/playwright-mcp.md) (Browser automation), [Azure MCP Server](https://www.anchorterminal.com/tools/azure-mcp.md) (Cloud \u0026 infrastructure), [Azure Maps](https://www.anchorterminal.com/tools/azure-maps.md) (Maps, geocoding \u0026 places), [Azure Translator](https://www.anchorterminal.com/tools/azure-translator.md) (Translation), [Microsoft Graph Calendar API](https://www.anchorterminal.com/tools/microsoft-graph-calendar.md) (Calendars \u0026 scheduling), [Azure Blob Storage](https://www.anchorterminal.com/tools/azure-blob-storage.md) (File storage \u0026 sharing), [OneDrive and SharePoint files (Microsoft Graph)](https://www.anchorterminal.com/tools/onedrive-sharepoint.md) (File storage \u0026 sharing), [Microsoft Teams (Microsoft Graph)](https://www.anchorterminal.com/tools/microsoft-teams.md) (Work \u0026 productivity), [Microsoft Dynamics 365 Sales](https://www.anchorterminal.com/tools/dynamics-365-sales.md) (CRM \u0026 customer platforms), [Microsoft Power Automate](https://www.anchorterminal.com/tools/power-automate.md) (Workflow automation), [Foundry Local](https://www.anchorterminal.com/tools/foundry-local.md) (Local AI), [Microsoft-Decision-1](https://www.anchorterminal.com/tools/microsoft-decision-1.md) (Decision models), [Microsoft Advertising API](https://www.anchorterminal.com/tools/microsoft-advertising-api.md) (Advertising \u0026 campaign operations), [Microsoft Excel (Microsoft Graph workbook API)](https://www.anchorterminal.com/tools/microsoft-excel-graph.md) (Spreadsheets \u0026 operational tables), [Outlook Mail (Microsoft Graph)](https://www.anchorterminal.com/tools/outlook-mail-graph.md) (Mailbox access).\n\n## Assessment\n\nCovers Outlook personal contacts with delta sync and a people API that ranks the people a user works with and supports fuzzy search, all under separate read and write permissions. Contact creates have no idempotency key, the status page needs JavaScript, and Microsoft has no current MCP server for contacts.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Microsoft (https://learn.microsoft.com/en-us/graph/outlook-contacts-concept-overview) |\n| Kind | HTTP API |\n| Category | Contacts \u0026 address books (https://www.anchorterminal.com/categories/contacts) |\n| Transport | HTTP |\n| Endpoint | `https://graph.microsoft.com/v1.0` |\n| Auth | OAuth · OAuth 2.0 tokens from Microsoft Entra ID. Contacts use Contacts.Read or Contacts.ReadWrite, delegated (work, school or personal Microsoft account) or application. The people API uses People.Read with user consent, or People.Read.All, which needs admin consent, to read people relevant to another user. Application permissions reach every mailbox in a tenant unless RBAC for Applications limits them. |\n| Pricing | Your plan (Your plan) · Contacts and people endpoints aren't metered. Work accounts need an Exchange Online mailbox through a Microsoft 365 or Exchange licence. Personal Outlook.com accounts work with delegated permissions at no cost (checked 2026-10-14). |\n| x402 | No · No x402, MPP or L402 in the Graph contacts or people docs (checked 2026-10-14). |\n| Licence | MIT (SDKs) |\n| Packages | npm: `@microsoft/microsoft-graph-client`; pypi: `msgraph-sdk` |\n| Source | https://github.com/microsoftgraph/msgraph-sdk-javascript |\n| Docs | https://learn.microsoft.com/en-us/graph/outlook-contacts-concept-overview |\n| llms.txt | not found |\n| Last release | 2026-03-12 |\n| GitHub stars | 834 (as of 2026-10-14) |\n| npm downloads / week | 2,321,990 |\n| PyPI downloads / week | 1,639,437 |\n| Contacts | /me/contacts and /me/contactFolders with list, get, create, update, delete, permanentDelete and $filter on email addresses |\n| Sync | Contact delta per contact folder with $deltatoken and $skiptoken, plus change notification subscriptions on contacts |\n| People | /me/people and /users/{id}/people ranked by relevance, 10 results by default, $top, $skip, $select, $filter and fuzzy $search for the signed-in user |\n| Permissions | Contacts.Read, Contacts.ReadWrite, People.Read (user consent), People.Read.All (admin consent) |\n| Rate limits | 10,000 requests per 10 minutes and 4 concurrent per app per mailbox, under a global 130,000 requests per 10 seconds per app |\n| Accounts | Microsoft 365 and Exchange Online work accounts, and personal Microsoft accounts with delegated permissions |\n| Capabilities | contacts.read, contacts.write, contacts.search, contacts.sync |\n| Tags | hosted, official, oauth, openapi, webhooks, typescript, python, enterprise |\n| JSON | https://www.anchorterminal.com/api/v1/tools/microsoft-graph-people.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 60 | 12.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 83 | 13.5 |\n| Agent ergonomics | 13% | 16.2 | 83 | 13.5 |\n| Security \u0026 auth | 14% | 17.5 | 72 | 12.6 |\n| Payments \u0026 pricing | 10% | 12.5 | 35 | 4.4 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 76 | 6.7 |\n| Transparency \u0026 trust (editorial 52, provenance 85) | 7% | 8.8 | 69 | 6.0 |\n| Negative events | up to −15 | up to −15 | 2026-06-16: a fix for a token leak through URL userinfo host confusion was merged into msgraph-sdk-javascript and the version bumped to 3.0.8, but on 14 October 2026 npm still serves 3.0.7 from September 2023 and the repository has no published advisory. Exploiting it needs an attacker-influenced URL passed to the client (https://github.com/microsoftgraph/msgraph-sdk-javascript/commit/5438ae90f50ef15d3656f0cf9c5485deee351f19, https://registry.npmjs.org/@microsoft/microsoft-graph-client/latest) | -4 |\n| **Total** | | | | **64.6 → B** |\n\n### Why each score\n\n- Reliability 60: Graded on the v1.0 REST API, as the microsoft-graph-calendar and outlook-mail-graph listings were. A public Microsoft service health page at status.cloud.microsoft (20). It renders only with JavaScript, so components and history weren't readable (5). Contacts fall under the Outlook limits of 10,000 requests per 10 minutes and four concurrent requests per app and mailbox (15). 429 responses carry Retry-After with backoff guidance, but contact creation has no transactionId or other idempotency key, so a retried create can duplicate (10 of 15). No SLA covering the Graph API found (0). Contacts and people endpoints are generally available on v1.0 (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 83: OpenAPI for all of Graph v1.0 in microsoftgraph/msgraph-metadata, plus CSDL (25). No llms.txt on learn.microsoft.com (0). Reference pages list least-privileged permissions per account type and state limits such as $search working only for the signed-in user's relevant people and $skip not working with $search (17). Typed properties and enums in the metadata (13). Example requests and responses on every page and the shared Graph error format (13). v1.0 and beta with a dated changelog whose latest personal contacts entry is 12 March 2026 (15).\n- Agent ergonomics 83: $select and $top on both APIs, and odata.maxpagesize on delta (23). @odata.nextLink paging, delta tokens for contact folders, $filter on email addresses, relevance ordering and fuzzy $search on people (20). Graph errors carry a code, message and request ID, and 429s say which throttle scope was hit (17). No idempotency key on contact creates and no MCP tool annotations to check, since the only MCP option is the legacy User server (10 of 20). Official SDKs in .NET, Java, Python, Go and more, with the JavaScript client last published to npm in September 2023 (13).\n- Security \u0026 auth 72: OAuth 2.0 through Entra ID with Contacts.Read, Contacts.ReadWrite, People.Read and People.Read.All (30). Read-only permissions for every read path, admin consent for reading other users' relevant people, and RBAC for Applications to limit application permissions to chosen mailboxes. Nothing asks for confirmation before a delete or permanentDelete (17 of 20). Contact names, notes and people results can carry text written by outsiders, and no injection guidance was found in these docs (5 of 15). Graph activity logs record app, user, IP, URI, status and scopes per request with Entra ID P1 or P2 (12). microsoft.com's security.txt expired on 23 September 2026 and was still expired on 14 October, and a token-leak fix in the JavaScript client sits unreleased with no advisory (8 of 20).\n- Payments \u0026 pricing 35: No x402, MPP or L402 (0). Contacts and people endpoints aren't metered and Microsoft 365 plan prices are public, but work accounts need a licensed mailbox (15). Personal Microsoft accounts work with delegated permissions at no cost and no card (20). A person registers an app in Entra and, for application or People.Read.All permissions, an admin consents (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 76: msgraph-sdk-python 1.64.0 on 6 October 2026 (30). Several Python SDK releases in the last 90 days, continuing the series graded on the other Graph listings (20). Public changelog and SDK issue trackers, but the June 2026 security fix still hasn't reached npm (10). Current SDKs in most languages, with the JavaScript client the exception at 3.0.7 from September 2023 (10). Active CI on the metadata and Python repositories, none of it reaching the JavaScript package (6).\n- Transparency \u0026 trust 69: Closed service under the Microsoft APIs terms of use, with MIT SDKs (15). The Microsoft privacy statement and product terms cover Graph, but we found no retention statement for contacts or people data through the API (15). Dated deprecations in the changelog, such as the sharedInsight list method announced on 14 January 2026 to stop returning data after November 2026 (14 of 20). Microsoft 365 sub-processor and data residency pages exist, which we didn't recheck (8).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (15 items): https://www.anchorterminal.com/fixes/microsoft-graph-people.md (JSON https://www.anchorterminal.com/fixes/microsoft-graph-people.json)\n\n### What we couldn't check\n\n- unchecked: status page components and incident history, which need JavaScript\n- unchecked: rate limits specific to the people API, which the throttling page doesn't list separately\n- Whether Microsoft will publish msgraph-sdk-javascript 3.0.8 or an advisory for the 16 June 2026 fix\n- Whether Work IQ in Agent 365 will expose contacts or people tools to replace the legacy User server\n\n### Sources\n\n- Outlook contacts overview: \u003chttps://learn.microsoft.com/en-us/graph/outlook-contacts-concept-overview\u003e (seen 2026-10-14)\n- list people reference: \u003chttps://learn.microsoft.com/en-us/graph/api/user-list-people?view=graph-rest-1.0\u003e (seen 2026-10-14)\n- people API overview: \u003chttps://learn.microsoft.com/en-us/graph/people-insights-overview\u003e (seen 2026-10-14)\n- contact delta reference: \u003chttps://learn.microsoft.com/en-us/graph/api/contact-delta?view=graph-rest-1.0\u003e (seen 2026-10-14)\n- list contacts reference: \u003chttps://learn.microsoft.com/en-us/graph/api/user-list-contacts?view=graph-rest-1.0\u003e (seen 2026-10-14)\n- throttling limits: \u003chttps://learn.microsoft.com/en-us/graph/throttling-limits\u003e (seen 2026-10-14)\n- Graph changelog feed: \u003chttps://developer.microsoft.com/en-us/graph/changelog/rss\u003e (seen 2026-10-14)\n- Agent 365 MCP server options: \u003chttps://learn.microsoft.com/en-us/microsoft-agent-365/tooling-servers-overview\u003e (seen 2026-10-14)\n- npm latest for @microsoft/microsoft-graph-client: \u003chttps://registry.npmjs.org/@microsoft/microsoft-graph-client/latest\u003e (seen 2026-10-14)\n- microsoft.com security.txt: \u003chttps://www.microsoft.com/.well-known/security.txt\u003e (seen 2026-10-14)\n\n## Who's behind it (provenance 85/100, checked 2026-10-14)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Microsoft Corporation | 20/20 |\n| Domain age | microsoft.com, registered 1991-05-02 (35 years) | 15/15 |\n| Endpoint on the vendor's domain | graph.microsoft.com | 15/15 |\n| Terms of service | read, states 5 of the 7 things a reader expects, and has 3 clauses that cost points | 2.3/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects, and has 1 clause that costs points | 8/10 |\n| Status page | status.cloud.microsoft | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | published but past its Expires date | 5/10 |\n\nThe endpoint is on graph.microsoft.com. www.microsoft.com/.well-known/security.txt still carried an Expires date of 2026-09-23 on 2026-10-14.\n\nThe Microsoft service health page at status.cloud.microsoft needs JavaScript to show anything, per the Graph listings' earlier checks.\n\nThe people API overview page is dated 2019-04-09 and the contact resource page 2026-02-27.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use), read 2026-10-08, dated 2025-10-01, states 5 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"Scrape, build databases or otherwise create copies of any data accessed or obtained using the Microsoft APIs, except as necessary to enable an intended usage scenario for your Application;\"\n- To know. Restricts benchmarking or competitive use (costs points). \"Use the Microsoft APIs, or any data obtained using the Microsoft APIs, to conduct performance testing of a Microsoft Offering unless expressly permitted by Microsoft\"\n- To know. Says the terms or the service can change without notice (costs points). \"WE MAY MODIFY THESE API TERMS AT ANY TIME, WITH OR WITHOUT PRIOR NOTICE TO YOU.\"\n- To know. Says access can be ended without notice or for any reason. \"We may suspend or immediately terminate these API Terms, any rights granted herein, and/or your license to the Microsoft APIs, in our sole discretion at any time, for any reason.\"\n- Gives the date it was last updated. Last updated 2025-10-01.\n- Not found in the text. Names the governing law or courts.\n- Says how changes to the terms are announced. Says it gives notice of a change.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-08). Recoverable damages are limited to direct damages of up to 5 US dollars in total. \"YOU AGREE THAT YOUR EXCLUSIVE REMEDY IS TO RECOVER, FROM MICROSOFT OR ANY AFFILIATES, RESELLERS, DISTRIBUTORS, SUPPLIERS (AND RESPECTIVE EMPLOYEES, SHAREHOLDERS, OR DIRECTORS) AND VENDORS, ONLY DIRECT DAMAGES UP TO USD $5.00 COLLECTIVELY.\"\n- Also in the text (2026-10-08). After a data breach involving the Microsoft APIs, the developer may make no public statement about it without Microsoft's prior written permission. \"You agree to refrain from making public statements (e.g., press, blogs, social media, bulletin boards, etc.) without prior written and express permission from Microsoft in each instance as it relates to the Microsoft APIs.\"\n- Also in the text (2026-10-08). The developer must allow Microsoft reasonable access to its application so Microsoft can monitor compliance with the API terms. \"You will permit Microsoft reasonable access to your Application for purposes of monitoring compliance with these API Terms.\"\n\n**Privacy policy** (https://privacy.microsoft.com/en-us/privacystatement), read 2026-10-08, dated 2026-09-01, states 8 of the 8 things a reader expects.\n\n- To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). \"As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models.\"\n- To know. Says it sells personal data or shares it for advertising. \"We also disclose personal data for digital advertising purposes.\"\n- Gives the date it was last updated. Last updated 2026-09-01.\n- Says how long data is kept. Names a period of 7 days.\n- Gives a privacy contact. Names a data protection officer.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n- Also in the text (2026-10-08). For enterprise and developer products, the customer's agreement with Microsoft takes precedence over this privacy statement where the two conflict. \"In the event of a conflict between our privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control.\"\n- Also in the text (2026-10-08). Advertisements may be chosen from the current interaction, including Copilot conversations and files shared in them. \"Ads may be shown that relate to the current interaction you are having with us, such as your Copilot conversations (including files you share); your current location; transactions; product usage; search queries; or the content you’re viewing.\"\n- Also in the text (2026-10-08). Microsoft staff manually review some results of automated systems, including AI, against the source data. \"For example, to build, train, and improve the accuracy of our automated systems – such as AI - we manually review some of the results against the underlying data.\"\n\n## Live (updated 2026-10-14 09:41 UTC)\n\n- Right now: up, HTTP 200, 3 ms, checked 2026-10-14 09:41 UTC (get on `https://graph.microsoft.com/v1.0`)\n- Uptime 24h 100.0% (17 probes) · 30 days 100.0% (17 probes) · p50 4 ms · p95 40 ms\n- Always current: https://www.anchorterminal.com/api/v1/live/microsoft-graph-people.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- People API ranks contacts and colleagues by relevance and supports fuzzy name search\n- Delta queries per contact folder return only what changed\n- Contacts.Read and People.Read keep read-only agents away from writes\n- Works for Microsoft 365 work accounts and personal Microsoft accounts\n- Graph activity logs record every request with app, user, IP and status\n\n## Weaknesses\n\n- No idempotency key on contact creation, so retries can duplicate\n- 4 concurrent requests per app per mailbox\n- The npm JavaScript client is 3.0.7 from September 2023, without the June 2026 token-leak fix\n- The only MCP option, the User server, is kept for backward compatibility\n- Status page renders only with JavaScript\n\n## Before you call it (notes for agents)\n\n1. Use /me/people?$search= for fuzzy lookups and /me/contacts for the saved address book, since they return different sets\n2. Keep the @odata.deltaLink from the contact delta function and call it on the next run\n3. Check for an existing contact with $filter on emailAddresses before creating one\n4. Honour Retry-After on 429 and keep to 4 parallel calls per mailbox\n5. Ask for Contacts.Read and People.Read unless the task must change contacts\n\n## Connect\n\nFirst request:\n\n```bash\ncurl \"https://graph.microsoft.com/v1.0/me/people?\\$search=adele\u0026\\$top=10\u0026\\$select=displayName,scoredEmailAddresses\" \\\n -H \"Authorization: Bearer $MS_GRAPH_TOKEN\"\n```\n\nThrough letme (picks today, calling later): https://letme.dev/microsoft-graph-people. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Google People API | B | 65.2 | 346 | contacts.read, contacts.write, contacts.search, contacts.sync | no | https://www.anchorterminal.com/tools/google-people-api.md |\n| ContactsPlus | E | 42.4 | 966 | contacts.read, contacts.write, contacts.search, contacts.sync | no | https://www.anchorterminal.com/tools/contactsplus.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- GET /me/people returns people ordered by relevance from the user's communication and collaboration patterns, and $search supports fuzzy matching on name or alias, only for the signed-in user (source: \u003chttps://learn.microsoft.com/en-us/graph/api/user-list-people?view=graph-rest-1.0\u003e)\n- The contact delta function returns changes in a contact folder with $deltatoken and $skiptoken, and odata.maxpagesize sets the page size (source: \u003chttps://learn.microsoft.com/en-us/graph/api/contact-delta?view=graph-rest-1.0\u003e)\n- Contacts sit under the Outlook service limits of 10,000 requests per 10 minutes and four concurrent requests per app and mailbox (source: \u003chttps://learn.microsoft.com/en-us/graph/throttling-limits\u003e)\n- The latest v1.0 change to personal contacts in the Graph changelog, on 12 March 2026, added primary, secondary and tertiary email address properties (source: \u003chttps://developer.microsoft.com/en-us/graph/changelog/rss\u003e)\n- The User MCP server in Copilot Studio (profiles, managers, direct reports, user search) is one of the workload servers Microsoft keeps only for backward compatibility and says not to use for new projects (source: \u003chttps://learn.microsoft.com/en-us/microsoft-agent-365/tooling-servers-overview\u003e)\n\n- All 3 contacts comparisons: https://www.anchorterminal.com/compare/contacts/index.md\n\n## Compare\n\n- [ContactsPlus vs Microsoft Graph People and Contacts API](https://www.anchorterminal.com/compare/contactsplus-vs-microsoft-graph-people.md): E 42.4 vs B 64.6\n- [Google People API vs Microsoft Graph People and Contacts API](https://www.anchorterminal.com/compare/google-people-api-vs-microsoft-graph-people.md): B 65.2 vs B 64.6\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on microsoft.com or one of its subdomains, or the README of github.com/microsoftgraph/msgraph-sdk-javascript. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"microsoft-graph-people\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/microsoft-graph-people\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/microsoft-graph-people.svg\" alt=\"Microsoft Graph People and Contacts API on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Microsoft Graph People and Contacts API on Anchor Terminal](https://www.anchorterminal.com/badges/microsoft-graph-people.svg)](https://www.anchorterminal.com/tools/microsoft-graph-people)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/microsoft-graph-people\"\u003eMicrosoft Graph People and Contacts API on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Microsoft Graph People and Contacts API is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/microsoft-graph-people-dark.png\n- Light: https://www.anchorterminal.com/assets/share/microsoft-graph-people-light.png\n- Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=microsoft-graph-people\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Contacts \u0026 address books", "url": "https://www.anchorterminal.com/categories/contacts" }, { "name": "Microsoft Graph People and Contacts API", "url": "" } ], "description": "Microsoft Graph endpoints for a user's Outlook personal contacts and contact folders, with delta sync, and the people API, which ranks the people most relevant to a user and supports fuzzy search.", "facts": [ "rank #369 of 1076", "OAuth auth", "0 desk reviews" ], "h1": "Microsoft Graph People and Contacts API", "image": "https://www.anchorterminal.com/assets/og/tools-microsoft-graph-people.png", "path": "/tools/microsoft-graph-people", "published": "2026-10-01", "section": "tools", "title": "Microsoft Graph People and Contacts review (2026), grade B", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/tools/microsoft-graph-people" }, "tokens": { "markdown": 6800, "slim": 1230 }, "version": 1 }