Sites.Selected Require Sites.Read.All

Sharee Huddleston 25

I have an app registration. It has been granted admin access to graph permission Sites.Selected. A Global admin granted registered app explicit write access to specific sharepoint site using graph explorer. It seems we also need admin consent for Sites.Read.All. If we use both Sites.Read.All and Sites.Selected, does Sites.Selected filter access to only read the site.selected? Why is Sites.Read.All also needed? Thank you.

Accepted answer

Emily Du-MSFT 45,991 Reputation points Microsoft Vendor

2024-08-13T09:57:32.54+00:00

You need both Sites.Selected and Sites.Read.All to read data for a site collection.

Sites.Selected is an endpoint which administrator can grant Read, Write, or Read and Write permissions to an application for a site collection.

So, first develop aplication with Sites.Selected permission, then use Sites.Selected endpoint to grant Read permissions to an application for a site collection.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Sharee Huddleston 25 Reputation points

2024-08-13T14:34:27.11+00:00

Thank you. It seems this Microsoft document explains the need for Sites.Read.All to perform any "Gets" on a site. https://learn.microsoft.com/en-us/graph/api/site-get?view=graph-rest-1.0&tabs=http

Sharee Huddleston 25 Reputation points

2024-08-16T14:49:11.96+00:00

Hello - do you know the security around this configuration? It seems that the app is allowed to read all sites in the tenant, but only read/write to the selected site. Is this the case? If so, is there a way to scope so only the single site is read?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

1 additional answer

Michael Taylor 53,971 Reputation points

2024-08-12T21:22:09.2966667+00:00

Perhaps this will provide some insight for you.

You should also read the subsequent blog article from earlier this year about it.
Please sign in to rate this answer.
Sharee Huddleston 25 Reputation points

2024-08-13T04:43:22.6433333+00:00

Thank you. These are both great references. I configured our app registration per the first article. The blog mentions combining delegated/application permission, but that didn't seem to work either. It seems the consensus is that you still need Sites.Read.All even though Microsoft documentation says Sites.Selected is sufficient. I am hoping Microsoft can provide a definitive answer which is required, and if it is both, is Sites.Read.All scoped to only read site granted with Sites.Selected. If not, the use of Sites.Selected provides no new scope.

Darian 5 Reputation points

2024-08-16T13:58:08.95+00:00

I am experiencing a similar issue here. The endpoint https://graph.microsoft.com/v1.0/search/query does not work with Sites.Selected permissions alone. The search functionality requires either Files.Read.All, Sites.Read.All, Files.ReadWrite.All, or Sites.ReadWrite.All permissions. I have read in the forums that when an Azure application is granted Sites.Read.All and Sites.Selected permissions, it conducts searches everywhere rather than confining the search scope to Sites.Selected. I am wondering if this is a bug that Microsoft will address or if this there is a specific way to provide the Sites.Read.All permissions required for the application to run the search query while also using Sites.Selected to limit the scope to specific sites in the workspace.

Sharee Huddleston 25 Reputation points

2024-08-16T14:50:55.9033333+00:00

Dorian - I have a similar question. Is there a way to secure scope to only read the selected site? Hopefully, someone can answer for us.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Sites.Selected Require Sites.Read.All

1 additional answer

Your answer