Authentication - Sharepoint App-only vs Azure AD App-Only

Question

To do the authentication to SharePoint we can do either

1. Granting access using SharePoint App-Only
2. Granting access via Azure AD App-Only

I don't have any issues using the 1st method however some articles suggesting that 2nd approach is the preferred approach.

My question is with 1st approach , I can generate ClientID/secret for each site collection under one tenant. Example for HR , I can use the generated Client ID that can be use only for HR site and for IT I will be having different client id so sharing the Client ID with the developer working specifically for HR wont be able to use the same client id for IT site.

but in 2nd approach , my understanding is we can use the same credentials for any site collection in that tenant.

Please share your thoughts.

Answer 1

Yes, your understandings are correct. However, for second approach (Azure AD App), you can restrict the access to specific site collections for Azure AD App.

You can use Sites.Selected permissions scope to restrict access to selected site collections.

Check more details at: Controlling app access on a specific SharePoint site collections is now available in Microsoft Graph