0

I am working on SharePoint online site, and as part of the system, we have a list of Assets and a list of Spare Parts. now those 2 info are been stored and managed inside a 3rd party system which does not provide a API.

But i need this data inside our system. now the 3rd party system can post and read the data from SharePoint using REST API.. for this i can create and register an App inside azure https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app .. The issue is that i can only restrict access for the register azure app to certain site/s without been able to restrict the access to specific lists/libraries, and on the same side i do not want to directly give the app registered (which will be used by the 3rd party system) access to the whole current SharePoint site. So for this i am thinking of creating a new site to store the pushed data from the 3rd party system, then i can implement a power automate flow to read the data from the new site to the current site on scheduled basis.. can anyone advice if my approach sound valid? at the end I do not want to give the 3rd party access to all the whole site, as this can break the data if a mistake was performed by the 3rd party and they update the wrong lists/libraries.

any advice on this ? and my suggested approach?

Thanks

Improve this question

2 Answers 2

Reset to default
2

I think what you're proposing in an unnecessary complication. You already have two sources of truth and are adding a third. The probability of something going wrong multiplies with every new source you have to keep in sync.

It's valid to be concerned about security, and if there is sensitive data you'll want to consider that. But if not, and the third party system is automated, and it doesn't know about the other lists, I don't see how it could accidentally post REST calls to them.

Improve this answer
2
  • As a rule I try to avoid having to sync data as much as I can, by reimagining requirements if necessary, but sometimes it can't be avoided.
    – Derek Gusoff
    Nov 16 at 14:58
  • let say the third part system data was comprised (as we do not manage this 3rd part system),, then at least not all of our data will be compromized .. i always give security the highest rank over complicity and sync. i would like to know your feedback, thanks
    – microsoftdeveloperdesigner
    Nov 19 at 23:46
1

Agree with Derek, but with respect to question itself I'd say

Option 1: keep data in only one new site, do not sync it with existing site, but provide access for users to this new site - they just should be able to understand that there is a separate site for assets and spare parts

Option 2: use classic ACS-based permissions (provided via appinv.aspx) for Azure-registered app. Though Microsoft recommends to avoid ACS-based permissions, in your case it the only possible way to provide permissions for the app to a specific list.

Improve this answer
1
  • but ACS-based permissions is deprecated and might get removed in the future.... so that why i need to grant permissions using the azure app registration, which can only restrict access to a whole site. so that why i want to have a separate site for the assets and spare parts
    – microsoftdeveloperdesigner
    Nov 19 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.