0

Is it possible to grant access to an App Registration from another Azure AD using _layouts/15/AppInv.aspx?

We provide a service where we offer to upload files to our clients' SharePoint (using SharePoint.Client objects). Currently we are doing this by asking the client to create a Client Id using _layouts/15/AppRegNew.aspx, and then grant that Client Id access to a Document Library using _layouts/15/AppInv.aspx, and then provide us with the Client Id and Client Secret.

But as more and more SharePoint tenant are set up with DisableCustomAppAuthentication=True, this no longer works. As an attemp to work around this, we have created an App Registration (Multi-tenant) in our Azure AD following the instructions in https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread. The App is created with Sites.Selectedchecked under API Permissions. And this App Id we can use to access our own SharePoint (with DisableCustomAppAuthentication=True), after using _layouts/15/AppInv.aspx to give it access to a document library.

Is there any way for other SharePoint tenants to grant our App Id access to a specific Document Library in their SharePoint?

We have done a similar things to access our Clients' Business Central tenants, and here the client just has to enter our App Id, and the Grant access to the App inside BC.

1 Answer 1

0

The permission scopes for the SharePoint APIs (CSOM and REST) in Azure AD are not as granular as the permission scopes used by Azure Access Control Services (ACS) and the Add-in model (i.e. those managed by _layouts/15/AppRegNew.aspx and _layouts/15/AppInv.aspx).

The most granular permission scope is available is Sites.Selected, which give permission to access one or more site collections. There is no permission scope currently available to give access to specific sites or to specific lists/libraries with a site.

SharePoint API permission scopes

Please see Controlling app access on a specific SharePoint site collections is now available in Microsoft Graph for more information on how to use the Sites.Selected permission scope.

I'd also like to mention that the SharePoint team has been hinting that the Add-in model will be deprecated at some point in the not too distant future. This would mean that the use of Azure ACS will be deprecated as well. Even though there may be challenges to adopting it initially, I would strongly suggest that you consider using Azure AD as you move forward.

2
  • We have already checked the Sites.Selected under API Permissions (forgot to mention this in the question - I have now updated the question), and this seems to require the use of _layouts/15/AppInv.aspx to get access to a document library. I thought that the way we had made the App Registration was using Azure AD. Do you have any link to information on how we should do this (sorry - still a novice in regards to SharePoint/Azure AD)? Commented Mar 30, 2022 at 11:00
  • You can't register an app with Azure AD and then manage its permissions using _layouts/15/AppInv.aspx. Permissions for Azure AD apps are managed in the Azure portal using the Request API permissions page. I did some searching and unfortunately I couldn't find a resources that provides additional detail for someone just getting started. I realize this is frustrating, it took me quite some time to understand Azure AD app registration and permissions myself. I wish I could be more help. Commented Mar 30, 2022 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.