5

In an Azure AD app registration under API Permissions I've added Sites.Read.All AppOnly to let my app access SharePoint resources through the Microsoft Graph API.

How do I restrict this permission to apply to just one site collection?

My app only need to access this one site collection and it would be irresponsible to require access to anything else (principle of least privilege), and it is unlikely that any client administrator would allow this.

So I need to restrict the permissions of the app service principal, but where/how do I do that?

EDIT: My app is not a SharePoint Add In. It is a standalone service application that simply access SharePoint through MS Graph. As such there is no AppManifest as nothing is installed in SharePoint (the question is relevant to other Graph resources than SharePoint as well).

Here is how the app is registered: https://docs.microsoft.com/en-us/azure/healthcare-apis/register-service-azure-ad-client-app

4 Answers 4

4

This is indeed not possible yet (still not, 7 months after you posted this). Here is proof: https://github.com/SharePoint/sp-dev-docs/issues/5730

Microsoft did however announce they will solve this issue in the near future. This reply from MS to the UserVoice request from October 2020 mentions a new feature called "resource-specific consent" for Teams: https://microsoftgraph.uservoice.com/forums/920506-microsoft-graph-feature-requests/suggestions/37796059-restrict-permissions-to-app-only-azure-ad-applicat

This will then supposedly be similar for SharePoint. Image a Site.Read RSC scope for app-only access which can be consented for by a site-admin. This site-level access is apparently something that is still missing in Graph and currently in beta for Teams apps: https://docs.microsoft.com/en-us/microsoftteams/platform/graph-api/rsc/resource-specific-consent

Looking forward to it..

2
  • 1
    Thanks for the update, voted. It is a much welcome feature - we ended up introducing a service account and use that for "app only" queries, since delegated permission masks are restricted by actual granular user rights on sites etc.
    – mhbuur
    Nov 9, 2020 at 7:56
  • Interesting workaround @mhbuur.
    – frevd
    Nov 10, 2020 at 9:03
2

Use the Sites.Selected permission (Due release February 2021):

Applications can now use the new "Sites.selected" permission to request access to SharePoint sites. By default an application that requests “Sites.Selected” instead of a tenant wide permission may not access any SharePoint sites. The tenant administrator can grant or revoke an application’s access to individual sites through new endpoints in the Microsoft Graph API.

Source: https://www.microsoft.com/en-us/microsoft-365/roadmap?filters=&searchterms=Sites.selected

Be aware that the Sites.Selected approach requires you to register permissions for your app via the Sites/Permissions endpoint (there is currently no interface for this). Now this endpoint itself can only be used with the App Only permission mask Sites.FullControl.All. Some would argue that this permission may be even harder to get from a client administrator that in the first place would not grant Sites.Read.All ;-)

The mitigating aspect however, is that you can now design a secondary granter app/script and let the client administrator execute that. You will probably need a new app registration for that alone. Jeremy Kelley explains that design here.

Consider using a service account If you are an ISV that has to work with large client tenants on a daily basis, you might still want to consider a classic service account approach: Set up a standard user account, ask the client administrator to add that user to the specific site collection, with the required permissions and let your application authenticate with that user and perform requests in a delegated context (i.e. you only need delegated permissions). This way you can avoid the whole App Only and Granter app condundrum, and client administrators seem to take in the concept of service accounts much easier.

1

Here's the blog post announcing how to make this work: https://developer.microsoft.com/en-us/graph/blogs/controlling-app-access-on-specific-sharepoint-site-collections/

-1

You may check this - go to the

https://yoursposite.sharepoint.com/sites/SharePointRND/_layouts/15/appinv.aspx

Example:

https://globalsharepoint2019.sharepoint.com/sites/SharePointRND/_layouts/15/appinv.aspx

Add the below XML in the "Permission Request XML" box:

<AppPermissionRequests AllowAppOnlyPolicy="true">
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />

Note:

  • Scope="http://sharepoint/content/sitecollection/" here sitcollection indicates as site collection level scope.

For other permission levels, you may refer the below MSDN article:

Add-in permissions in SharePoint

3
  • My app is not a SharePoint Add-In, but a stand alone application that reads from SharePoint through MS Graph. I'm not sure where to add this?
    – mhbuur
    Apr 1, 2020 at 9:43
  • In general, if we want to access SharePoint from third party application - we should use token to authenticate to SharePoint - and while we want to generate the token we have to register the app and pass the above XML. For details, you may refer to the below article: global-sharepoint.com/sharepoint-online/…
    – SP 2022
    Apr 1, 2020 at 9:49
  • I updated the question - I do not have any AppManifest and as such my app is not running in SharePoint.
    – mhbuur
    Apr 1, 2020 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.