Restrict app access of graph apis to specific site or folder of share point

Question

In order to access share point files via apis on my backend server, I use graph apis. To use graph apis, I registered an app on app registrations admin centre.
If I provide access if Sites.Selected, I am unable to access site via api. If I provide access Sites.Read.All, then this app token is able to access all sites. My use case is to restrict access to particular site. Also I want to restrict access to particular folder in a site. How do I do that ?

Answer 1

Hello @GEETIKA GARG ,

Thanks for contacting Microsoft Support!

To restrict access to a specific SharePoint site and even a particular folder within that site using Microsoft Graph APIs, you can follow these steps:

Use Sites.Selected Permission:

• Ensure your app is granted the Sites.Selected permission. This permission allows you to specify which sites the app can access.

1. Grant Access to Specific Site:
   • After registering your app and granting Sites.Selected permission, you need to explicitly grant access to the specific site. This can be done using the Microsoft Graph API.
   Here’s an example of how to grant read access to a specific site:

      POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions
      Content-Type: application/json
      {
      "roles": ["read"],
      "grantedToIdentities": [
       {
         "application": {
           "id": "your-app-id",
           "displayName": "Your App Name"
         }
       }
      ]
      }
   

By following these steps, you can ensure that your app has access only to the specific site and folder you want.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.