How to restrict App Only permissions to one site

Question

In an Azure AD app registration under API Permissions I've added Sites.Read.All AppOnly to let my app access SharePoint resources through the Microsoft Graph API.

How do I restrict this permission to apply to just one site collection?

My app only need to access this one site collection and it would be irresponsible to require access to anything else (principle of least privilege), and it is unlikely that any client administrator would allow this.

So I need to restrict the permissions of the app service principal, but where/how do I do that?

EDIT: My app is not a SharePoint Add In. It is a standalone service application that simply access SharePoint through MS Graph. As such there is no AppManifest as nothing is installed in SharePoint (the question is relevant to other Graph resources than SharePoint as well).

Here is how the app is registered: https://docs.microsoft.com/en-us/azure/healthcare-apis/register-service-azure-ad-client-app

Answer 1

This is indeed not possible yet (still not, 7 months after you posted this). Here is proof: https://github.com/SharePoint/sp-dev-docs/issues/5730

Microsoft did however announce they will solve this issue in the near future. This reply from MS to the UserVoice request from October 2020 mentions a new feature called "resource-specific consent" for Teams: https://microsoftgraph.uservoice.com/forums/920506-microsoft-graph-feature-requests/suggestions/37796059-restrict-permissions-to-app-only-azure-ad-applicat

This will then supposedly be similar for SharePoint. Image a Site.Read RSC scope for app-only access which can be consented for by a site-admin. This site-level access is apparently something that is still missing in Graph and currently in beta for Teams apps: https://docs.microsoft.com/en-us/microsoftteams/platform/graph-api/rsc/resource-specific-consent

Looking forward to it..

Answer 2

Use the Sites.Selected permission (Due release February 2021):

Applications can now use the new "Sites.selected" permission to request access to SharePoint sites. By default an application that requests “Sites.Selected” instead of a tenant wide permission may not access any SharePoint sites. The tenant administrator can grant or revoke an application’s access to individual sites through new endpoints in the Microsoft Graph API.

Source: https://www.microsoft.com/en-us/microsoft-365/roadmap?filters=&searchterms=Sites.selected

Be aware that the Sites.Selected approach requires you to register permissions for your app via the Sites/Permissions endpoint (there is currently no interface for this). Now this endpoint itself can only be used with the App Only permission mask Sites.FullControl.All. Some would argue that this permission may be even harder to get from a client administrator that in the first place would not grant Sites.Read.All ;-)

The mitigating aspect however, is that you can now design a secondary granter app/script and let the client administrator execute that. You will probably need a new app registration for that alone. Jeremy Kelley explains that design here.

Consider using a service account If you are an ISV that has to work with large client tenants on a daily basis, you might still want to consider a classic service account approach: Set up a standard user account, ask the client administrator to add that user to the specific site collection, with the required permissions and let your application authenticate with that user and perform requests in a delegated context (i.e. you only need delegated permissions). This way you can avoid the whole App Only and Granter app condundrum, and client administrators seem to take in the concept of service accounts much easier.

Answer 3

Here's the blog post announcing how to make this work: https://developer.microsoft.com/en-us/graph/blogs/controlling-app-access-on-specific-sharepoint-site-collections/

Answer 4

You may check this - go to the

https://yoursposite.sharepoint.com/sites/SharePointRND/_layouts/15/appinv.aspx

Example:

https://globalsharepoint2019.sharepoint.com/sites/SharePointRND/_layouts/15/appinv.aspx

Add the below XML in the "Permission Request XML" box:

<AppPermissionRequests AllowAppOnlyPolicy="true">
<AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />

Note:

• Scope="http://sharepoint/content/sitecollection/" here sitcollection indicates as site collection level scope.

For other permission levels, you may refer the below MSDN article:

Add-in permissions in SharePoint