I have a external application that needs to be able to make requests to the sharepoint search api. This application only needs to know about information from a single site collection. However, from what I have read so far, the solution is to register the application with full control at the tenant scope. For our purposes this is not acceptable - often we will be integrating our solution with a customer's sharepoint tennant, where they may have confidential information. Should the app key become compromised, that poses a significant security risk.

Is there a means to make the search api available to an app with only site collection scope?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.