3

In an Azure AD app registration under API Permissions I've added Sites.Read.All AppOnly to let my app access SharePoint resources through the Microsoft Graph API.

How do I restrict this permission to apply to just one site collection?

My app only need to access this one site collection and it would be irresponsible to require access to anything else (principle of least privilege), and it is unlikely that any client administrator would allow this.

So I need to restrict the permissions of the app service principal, but where/how do I do that?

EDIT: My app is not a SharePoint Add In. It is a standalone service application that simply access SharePoint through MS Graph. As such there is no AppManifest as nothing is installed in SharePoint (the question is relevant to other Graph resources than SharePoint as well).

Here is how the app is registered: https://docs.microsoft.com/en-us/azure/healthcare-apis/register-service-azure-ad-client-app

2

This is indeed not possible yet (still not, 7 months after you posted this). Here is proof: https://github.com/SharePoint/sp-dev-docs/issues/5730

Microsoft did however announce they will solve this issue in the near future. This reply from MS to the UserVoice request from October 2020 mentions a new feature called "resource-specific consent" for Teams: https://microsoftgraph.uservoice.com/forums/920506-microsoft-graph-feature-requests/suggestions/37796059-restrict-permissions-to-app-only-azure-ad-applicat

This will then supposedly be similar for SharePoint. Image a Site.Read RSC scope for app-only access which can be consented for by a site-admin. This site-level access is apparently something that is still missing in Graph and currently in beta for Teams apps: https://docs.microsoft.com/en-us/microsoftteams/platform/graph-api/rsc/resource-specific-consent

Looking forward to it..

| improve this answer | |
  • 1
    Thanks for the update, voted. It is a much welcome feature - we ended up introducing a service account and use that for "app only" queries, since delegated permission masks are restricted by actual granular user rights on sites etc. – mhbuur Nov 9 at 7:56
  • Interesting workaround @mhbuur. – frevd Nov 10 at 9:03
0

You may check this - go to the

https://yoursposite.sharepoint.com/sites/SharePointRND/_layouts/15/appinv.aspx

Example:

https://globalsharepoint2019.sharepoint.com/sites/SharePointRND/_layouts/15/appinv.aspx

Add the below XML in the "Permission Request XML" box:

<AppPermissionRequests AllowAppOnlyPolicy="true">
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />

Note:

  • Scope="http://sharepoint/content/sitecollection/" here sitcollection indicates as site collection level scope.

For other permission levels, you may refer the below MSDN article:

Add-in permissions in SharePoint

| improve this answer | |
  • My app is not a SharePoint Add-In, but a stand alone application that reads from SharePoint through MS Graph. I'm not sure where to add this? – mhbuur Apr 1 at 9:43
  • In general, if we want to access SharePoint from third party application - we should use token to authenticate to SharePoint - and while we want to generate the token we have to register the app and pass the above XML. For details, you may refer to the below article: global-sharepoint.com/sharepoint-online/… – GSD - SharePoint Apr 1 at 9:49
  • I updated the question - I do not have any AppManifest and as such my app is not running in SharePoint. – mhbuur Apr 1 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.