By default the permissions of a sharepoint app seem limited to read/write/full control over the entire site.

I'm looking for a way to grant a supplier access to a list but do not want them to be able to access the information stored on the site other than the list.

Preferred solution would be to limit the app using user permissions like a regular user.

2 Answers 2


May be below solution will be help you achieve your goal.

Follow below step to assign unique permission on list

  1. Open list on which you want to give unique permission
  2. Go to List Setting -> click on Permissions for this list
  3. Click Stop Inheriting Permission

    enter image description here

  4. Then it will look like as below

    enter image description here

  5. Then If you want remove existing user or group permission then you can remove it

  6. Now, you can add/give permission to new user or group to access your list by click on Grant Permission from ribbon

    enter image description here

  • Hmm, a _api/web/currentuser query in postman shows the user as app@sharepoint, if I were to restrict this user I assume I would restrict all other apps as well. Is there a way to link the app to a user perhaps?
    – Zalmfilet
    Jul 18, 2019 at 11:22
  • Hi, I did not get your point. But was I suggested that REST api work on current user context so if current user has permission to access any stuff from UI then it will we access from REST API Jul 18, 2019 at 11:40

I realize I've been looking in the wrong place entirely.

A quick google search provided me little (useable) information on using the REST API in user context, but this was due to my lack of knowledge with API's in general.

After Bharat's comment I realized that the problem was creating an app, and with some more googling I found the following answer from Lee Liu: https://stackoverflow.com/questions/50598598/the-oauth2-authentication-request-process-of-office-365-forwards-the-link-to-htt

This is exactly what I needed, I created a Cloud Only user (federated requires some extra steps it seems) and managed to get the digest token in the end.

With the REST API in user context I can follow Bharat's steps to exclude all permissions except the ones in the list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.