We have written an application that access SharePoint CSOM apis to do the following:

  1. Get sharepoint users and groups in a site collection.
  2. Get sites in a site colleciton
  3. Get lists in a site collection
  4. Get role assignments/definitions
  5. Get list items in a site collection.
  6. Get changes since a given time in a site collection.

When we access SharePoint online using app-auth (oauth or azure private key), we are forced to give Full admin access to the app in order to do these things.

But when we use a normal service account (username/password) we have access to the fine-grained permissions as you would expect. We do this by creating a custom SharePoint permission level and give it

  • View Items - View items in lists and documents in document libraries.
  • Open Items - View the source of documents with server-side file handlers.
  • View Versions - View past versions of a list item or document.
  • View Application Pages - View forms, views, and application pages. Enumerate lists. Site Permissions
  • View Web Analytics Data - View reports on Web site usage.
  • Browse Directories - Enumerate files and folders in a Web site using SharePoint Designer and Web DAV interfaces.
  • View Pages - View pages in a Web site.
  • numerate Permissions - Enumerate permissions on the Web site, list, folder, document, or list item.
  • Browse User Information - View information about users of the Web site.
  • Use Remote Interfaces - Use SOAP, Web DAV, the Client Object Model or SharePoint Designer interfaces to access the Web site.
  • Open - Allows users to open a Web site, list, or folder in order to access items inside that container.

Is Microsoft ever going to fix this so that app-auth can be given fine grained permission?

1 Answer 1


As a workaround, I would suggest using the "legacy" SharePoint-only apps. These apps' permissions can be limited to access specific lists or libraries. Even though it's considered legacy, it's not going away any time soon and it's the only option for many real-world cases.

Using Azure App registration is considered the best practice, but in in reality it's not usable in most cases. Especially in large organizations with tight security. Imagine a department in a large company that needs to build an app that works with a single library in a specific site. Giving them Azure App registration with Full Read/Write access to the entire tenant is out of question.

Over the last several years, there were no improvements in terms granular security except for one thing. This year (2021), Microsoft announced an ability to assign permissions to a specific site for Graph API. As you can imagine, it's not very helpful for those who are using SharePoint as a datasource and are used to REST API or even CSOM. Graph API still remains incredibly limited when it comes to working with SharePoint.

  • I will give these Legacy apps a look! Thanks for the pointer. Commented Jul 14, 2021 at 17:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.