In an Azure AD app registration under API Permissions I've added Sites.Read.All AppOnly to let my app access SharePoint resources through the Microsoft Graph API.

How do I restrict this permission to apply to just one site collection?

My app only need to access this one site collection and it would be irresponsible to require access to anything else (principle of least privilege), and it is unlikely that any client administrator would allow this.

So I need to restrict the permissions of the app service principal, but where/how do I do that?

EDIT: My app is not a SharePoint Add In. It is a standalone service application that simply access SharePoint through MS Graph. As such there is no AppManifest as nothing is installed in SharePoint (the question is relevant to other Graph resources than SharePoint as well).

Here is how the app is registered: https://docs.microsoft.com/en-us/azure/healthcare-apis/register-service-azure-ad-client-app


This is indeed not possible yet (still not, 7 months after you posted this). Here is proof: https://github.com/SharePoint/sp-dev-docs/issues/5730

Microsoft did however announce they will solve this issue in the near future. This reply from MS to the UserVoice request from October 2020 mentions a new feature called "resource-specific consent" for Teams: https://microsoftgraph.uservoice.com/forums/920506-microsoft-graph-feature-requests/suggestions/37796059-restrict-permissions-to-app-only-azure-ad-applicat

This will then supposedly be similar for SharePoint. Image a Site.Read RSC scope for app-only access which can be consented for by a site-admin. This site-level access is apparently something that is still missing in Graph and currently in beta for Teams apps: https://docs.microsoft.com/en-us/microsoftteams/platform/graph-api/rsc/resource-specific-consent

Looking forward to it..

  • 1
    Thanks for the update, voted. It is a much welcome feature - we ended up introducing a service account and use that for "app only" queries, since delegated permission masks are restricted by actual granular user rights on sites etc. – mhbuur Nov 9 '20 at 7:56
  • Interesting workaround @mhbuur. – frevd Nov 10 '20 at 9:03

You may check this - go to the




Add the below XML in the "Permission Request XML" box:

<AppPermissionRequests AllowAppOnlyPolicy="true">
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />


  • Scope="http://sharepoint/content/sitecollection/" here sitcollection indicates as site collection level scope.

For other permission levels, you may refer the below MSDN article:

Add-in permissions in SharePoint

  • My app is not a SharePoint Add-In, but a stand alone application that reads from SharePoint through MS Graph. I'm not sure where to add this? – mhbuur Apr 1 '20 at 9:43
  • In general, if we want to access SharePoint from third party application - we should use token to authenticate to SharePoint - and while we want to generate the token we have to register the app and pass the above XML. For details, you may refer to the below article: global-sharepoint.com/sharepoint-online/… – GSD - SharePoint Apr 1 '20 at 9:49
  • I updated the question - I do not have any AppManifest and as such my app is not running in SharePoint. – mhbuur Apr 1 '20 at 11:19

Use the Sites.Selected permission (Due release February 2021):

Applications can now use the new "Sites.selected" permission to request access to SharePoint sites. By default an application that requests “Sites.Selected” instead of a tenant wide permission may not access any SharePoint sites. The tenant administrator can grant or revoke an application’s access to individual sites through new endpoints in the Microsoft Graph API.

Source: https://www.microsoft.com/en-us/microsoft-365/roadmap?filters=&searchterms=Sites.selected


Here's the blog post announcing how to make this work: https://developer.microsoft.com/en-us/graph/blogs/controlling-app-access-on-specific-sharepoint-site-collections/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.