Get Granted User/Group Permissions for SharePoint Files via MS Graph

Question

I am developing an application that needs to read files from SharePoint. Specifically, I want to limit access to a specific list of SharePoint folders, which I believe can be managed using the Sites.Selected permission for the app. Additionally, I need to retrieve the permissions for files within these sites, ideally via the IDs of the Microsoft 365 users and groups with access.

I aim to authenticate the app via Client / Client Secret and seek to determine the minimal permissions required for the app registration to accomplish this task.

Appreciate your help!

Answer 1

Hello AM91,

Thank you for contacting Microsoft Support!

To restrict access to a specific SharePoint site using Microsoft Graph APIs, you can follow these steps:

Use Sites.Selected Permission:

In case if you are trying to site information without signed in user (Application permission), you need to create two app registrations. First Application will have Sites.FullControl.All permission and second Application will have Sites.Selected permission.

Using first application you can make POST call with second application details in request body. You can perform the above operations in postman.

POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions
   Content-Type: application/json
   {
     "roles": ["read"],
     "grantedToIdentities": [
       {
         "application": {
           "id": "your-app-id",
           "displayName": "Your App Name"
         }
       }
     ]
   }

Please note following above steps target application can access entire site collection.

Please refer to below documentations.

https://devblogs.microsoft.com/microsoft365dev/controlling-app-access-on-specific-sharepoint-site-collections/

https://techcommunity.microsoft.com/t5/microsoft-sharepoint-blog/develop-applications-that-use-sites-selected-permissions-for-spo/ba-p/3790476

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.