I'm building a web application that uses OData to retrieve data from SharePoint Online lists.

The authentication I choose is Azure AD service principal OAuth. I do not choose user interactive way because refresh token expiration is annoying.

I refer to this doc Granting access via Azure AD App-Only and it works but I'm concerned about the permission control.

According to the doc, the scope of the listed application permission is Allsites which means the application would be able to access all the sites under my tenant. So how can I set site level (or list level even better) permissions to the application?

1 Answer 1


I don't think you can't. As far as I know site, list & item permissions are only meant for users.

You could use the SharePoint App only permissions. That's restricted to a site collection. https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs Although I would refrain from using this methods as the ACS mechanisme doesn't have a bright future.

  • Thanks Martijn. ACS works but I still wonder if it is achievable from Azure AD? As you said, ACS doesn't have a bright future : ).
    – Z. Xu
    Aug 27, 2018 at 3:07
  • Hi everyone, ACS seems to be kept alive for these SP use-cases. Does anyone know if there is an AAD-based alterative yet? May 31, 2021 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.