I'm unsure about the exact security implications of installing a non-MS helpdesk app to my SP Online environment from the store. The app is requesting "Let it read items in all site collections."

Some of our site collections contain resources that this app should never read. Is this type of permission grant normal for SharePoint Online? I did some reading at https://devblogs.microsoft.com/microsoft365dev/updates-on-controlling-app-specific-access-on-specific-sharepoint-sites-sites-selected/ and then asked the publisher about it; their sales persons stated it is an application permission, and claim it applies strictly to the site collection where the app is installed. Can someone please confirm that this must be incorrect, since the AAD consent prompt asking for "Let it read items in all site collections." suggests that the, relatively new, Sites.Selected option was not used in this app? To use this app safely, do I need to create a whole new root apart from the sensitive docs root site and install it there?

This will be the first 3rdparty app I permit on the environment, and I want to be doing this securely going forward, there will be other apps that request permissions and it seems like I will be the gatekeeper..

AAD access reviews are one way to vet an app's access, but it seems they require an app is already installed to a site collection in the environment in order to initiate. Is best practice to spin a whole new environment and then install and test an apps access with graph? How would I know that the app is over-permissive, or worse, full-blown malicious before installing it and scheduling an access review.

  • What app is it? Can you share a link? Sites.Selected can only be used if the app uses Graph API. If it uses the older non-Graph API (SharePoint REST/CSOM), then Sites.Selected won't be possible to use. Dec 11, 2022 at 0:19
  • This seems to be the case. The app is called Steady Point help desk. Dec 18, 2022 at 15:03

1 Answer 1


For safely testing 3rd party apps, I recommend getting a free Development m365 tenant.

It includes 25 E5 licenses. Before installing any apps in a production tenant, it's a good practice to do it in a throwaway tenant.

You can review what the app does in your tenant by checking its permissions and using the Purview Audit Log in the security and compliance center.

  • Just to confirm, if the app is created using the REST/CSOM, is it not possible to apply resource-specific consent (Sites.Selected) after it is installed? (Even typing this and reading it back makes me think it would just break the app, but hey, I'll ask). Jan 9, 2023 at 13:12
  • Sites.Selected is a Graph API permission. But when using REST/CSOM API, you can limit permissions to a specific site if you follow these guides: 1) learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/… 2) youtube.com/watch?v=Tn-jB7vdnOE&feature=youtu.be Jan 9, 2023 at 14:54
  • These guides only make sense if you're the creator of the app, is that right? So, it appears to be the case that (without the app source code), most off-the-shelf AppSource apps that did not leverage Graph API (i.e. Used CSOM/REST) are impossible to restrict retroactively by the guides? Jan 9, 2023 at 18:49
  • Good point! Perhaps, you can still retroactively limit permissions for any app. But the app might fail if it uses more permissions than just a single site. However, I don't see many cases for an app to require permissions to an entire tenant. Jan 9, 2023 at 19:05
  • I don't think anything prevents us, as non-app creators from updating app permissions as we wish. It might go against he app creator's recommendations, but they can't stop you from conducting an experiment. Jan 9, 2023 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.