0

I need to do some actions (ex: create a subsite via REST or Graph) with my SPFX app (webpart) that the viewing user wont have the rights to do.
So I need to find a way to run these with elevated privileges. I have ready this can be done a few ways, Powerautomate flow called from SPFX, an Azure function, etc. Unfortunately Powerautomate, Azure functions, or some middleware are not really options. I have heard mention that Graph provides for this somehow, but I cant makes heads nor tails of it.

How can Graph be accessed within a SPFX application with permissions beyond that of the logged in user?

Any help greatly appreciated! -Powell

Improve this question

2 Answers 2

Reset to default
0

Graph Api delegated permissions work in user_impersonation mode so if there is end point available in Graph API that covers the requirements then even if user is not having required permission, Graph api will work as admin will grant the required permissions to SPFx.
Please check the note section Configure the API permissions requests

Currently there are only read endpoints for site resources in Microsoft graph api so site creation is not possible.

other approach you can use is Connect to Azure AD-secured APIs in SharePoint Framework solutions

Improve this answer
6
  • This is incorrect. For delegated access to work, both the app and the client (user) must have the appropriate permission to make the request. This is stated by Microsoft here: learn.microsoft.com/en-us/graph/auth/…
    – Callum Crowley
    Commented Feb 25, 2023 at 17:31
  • 1
    In SPFx, Tenant or Global admin, grant the consent to SPFx app to peform the elevated actions. Please refer notes section under learn.microsoft.com/en-us/sharepoint/dev/spfx/…
    – Harminder Singh
    Commented Feb 26, 2023 at 10:36
  • SPFx applications are purely client side and run in the context of the current user. If the current user does not have the required permission to make a particular request then delegated access will fail because both user and app must have the permission for it to work: learn.microsoft.com/en-us/graph/auth/…
    – Callum Crowley
    Commented Feb 26, 2023 at 10:45
  • The user must have access to the resource for their API request to work, e.g. if they don't have access to a SharePoint list, then an API request to fetch items from that list will fail. SPFx is entirely client side meaning every API request runs in the context of the current user. Of course, a user cannot elevate their own permissions to resources (otherwise they could grant themselves access to resources whenever they like).
    – Callum Crowley
    Commented Feb 26, 2023 at 10:52
  • 1
    I recently created a SPFx webpart that read the M365 service health status which is available for tenant admins only but with the help of graph api, user without having the tenant/global admins are able to see the health status. if it completly runs in the user context then except tenant/global admin no body can see the status github.com/pnp/sp-dev-fx-webparts/tree/main/samples/…
    – Harminder Singh
    Commented Feb 26, 2023 at 12:44
2

If the user does not have the required permissions, then their request to the Graph will be denied. Since the Graph API is being accessed from the current user's context, there is no way around this. You will either need to give the users the necessary permissions so that their REST call is successful or to provide a mechanism that would complete this action on their behalf e.g. Power Automate flow, Azure Function etc.

Improve this answer
2
  • Was afraid of that :) I imagine an Azure function calling graph would be the way to go. Now to convince the admins to let me make one. Thanks again for the help!
    – Powell
    Commented Jan 25, 2023 at 21:16
  • 1
    Yes, this is the case. I'm not sure why delegated access is being floated as a solution because both the user and the app must have the required permission to make the request for it to work: learn.microsoft.com/en-us/graph/auth/…
    – Callum Crowley
    Commented Feb 25, 2023 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.