I am not familiar at all with the app registration under Azure AD, so this post might be a little erratic, and I am sorry for that. I will try to be as simplest and clearest as possible and ask you two questions about App registration under Azure Portal.

Here is what a team need :

They have an application (called Iterop) wich is basically a workflow application. This app will generate pdf documents. It will need to push those documents under one precise folder in a Document Library under a SharePoint online Team site.

They can do it via calls to a REST API with the SharePoint endpoints.

I know you have to register an app under Azure AD to be able to generate a token (client's secret and all), so here are my questions about it :

  1. Permissions

I read about permissions (those articles : [Granting access via Azure AD App-Only | Microsoft Docs][1] and [MS Graph Permissions References][2]) and they seem to be given Tenant-wide.

I only want this application to be able to communicate with one team site. And inside this teamsite, i want it to only read and possibly upload documents in one document library. I read a little article about a preview feature which is about [granting permission for selected site][3] but it seems to still be in preview, because I could not see it on the permission page with our Azure team.

So here is my question : What permission should the Azure team give the application to access only one Document Library in one specific team site and read/upload document in it ?

  1. URIs

My second question is about the URIs :

I don't fully understand their means, and I read (but can not find the documentation back) that you don't need to specify one if the API you are calling is for SharePoint. Could someone explain URIs to me please ?

Thanks a lot, I hope you a wonderful day [1]: https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread [2]: https://docs.microsoft.com/en-us/graph/permissions-reference#sites-permissions [3]: https://devblogs.microsoft.com/microsoft365dev/controlling-app-access-on-specific-sharepoint-site-collections/

1 Answer 1


you can use the POST sites/{site-id}/permissions API to create permission for your application to access specific site with the permission Sites.FullControl.All as the documentation mentioned. Hope this can help you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.