1

I'm building a web application that uses OData to retrieve data from SharePoint Online lists.

The authentication I choose is Azure AD service principal OAuth. I do not choose user interactive way because refresh token expiration is annoying.

I refer to this doc Granting access via Azure AD App-Only and it works but I'm concerned about the permission control.

According to the doc, the scope of the listed application permission is Allsites which means the application would be able to access all the sites under my tenant. So how can I set site level (or list level even better) permissions to the application?

Improve this question
1

I don't think you can't. As far as I know site, list & item permissions are only meant for users.

You could use the SharePoint App only permissions. That's restricted to a site collection. https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs Although I would refrain from using this methods as the ACS mechanisme doesn't have a bright future.

Improve this answer
1
  • Thanks Martijn. ACS works but I still wonder if it is achievable from Azure AD? As you said, ACS doesn't have a bright future : ). – Z. Xu Aug 27 '18 at 3:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.