Update long-running-operations.md

Author: corranrogue9

graph/patterns/long-running-operations.md

@@ -57,6 +57,11 @@ There are some deviations from the base guidelines where Microsoft Graph API sta
   - The API response says the operation resource is being created at the URL provided in the Location header and indicates that the request is not completed by including a 202 status code.
   - Microsoft Graph doesn’t allow tenant-wide operation resources; therefore, stepwise operations are often modeled as a navigation property on the target resource.
 
+- For most implementations of the LRO pattern, there will be 3 permissions necessary to comply with the principle of least privilege: `{operation}.ReadWrite.All` to create the operation entity, `{operation.Read.All}` to track the operation entity to completion, and `{resource}.Read.All` to retrieve the resource that was created as a result of the operation.
+For APIs that would have been modeled as a simple `GET` on the resource URL, but that are modeled as long-running operations due to MSGraph performance requirements, only the `{resource}.Read.All` permission is necessary as long as creating the operation entity is "safe".
+Here, "safe" means that there are no side effects for creating the operation entity that would change the functioning of any entities outside of the resource being retrieved.
+This requirment is less strict than idempotence, and an idempotent API is suffucient to meet this requirement.
+
 ## When to use this pattern
 
 Any API call that is expected to take longer than one second in the 99th percentile should use the long running operations pattern.
@@ -254,4 +259,4 @@ HTTP/1.1 202 Accepted
 
 Location: https://graph.microsoft.com/v1.0/storage/operations/123
 
-```
+```