0

I am trying to show SharePoint list items from a different site collection in a SharePoint adaptive card extension using Graph API. This is working as expected for any user who has access to the SharePoint list.

Do we have any options to show the SharePoint list items in spfx who doesn't have access to the list.

When checked, I could see to use GraphAPI from SharePoint, there is a default app registered in Azure under the name "SharePoint Online Client Extensibility Web Application Principal". The App has delegated permission for Sites.ReadAll and Sites.ReadWriteAll as shown below:

enter image description here enter image description here

So along with this I tried to add Sites.ReadAll with application permission as shown below:

enter image description here

But this doesn't made any change and the list of items were not visible for any users without access to the list.

Please let me know if we have any option to show the SharePoint list items in an SPFx app without giving the end user read access to the list.

2 Answers 2

3

"Delegated Permissions" mans the app will assume the security context of the logged in user. Application Permissions are not used by SharePoint Framework.

Users should never be shown data they do not have access to. That is the whole point of security.

1
  • Thank you, I understood. In our case we have a restricted list in a site where access is not given to all users which hold data about all the users. But we have to show some data which is specific to the logged in user in another site (intranet site). We thought of using some adaptive cards to show this. Do we have any option to get this list data in an spfx app with an elevated or app-only kind of permission similar to something we used to implement in server side code.
    – Mahesh KP
    Jul 6, 2022 at 3:23
1

SharePoint Framework always runs with current user's context so you will not able to access anything where current user don't have access.

You need to create middle layer API which gets data from another site collection using Application.

Below is the link where you can find similar scenario where Item is being added using API with elevation.

https://github.com/pnp/sp-dev-fx-webparts/tree/main/samples/react-sp-elevatedprivileges

Hope it will help you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.