I would like to know how to restrict sites using "Sites.Selected".

Question

Currently, we are using the Graph API of "Search Sites" to get a list of SharePoint sites.
https://learn.microsoft.com/ja-jp/graph/api/site-search?view=graph-rest-1.0&tabs=http

The documentation for "Search Sites" states,
"Note: This method does not support Sites.Selected application permissions."
So, it is recognized that "Search Sites" cannot restrict sites using "Sites.Selected" because it is stated that "Sites.

If it is the "List Sites" one, would it be affected?
https://learn.microsoft.com/ja-jp/graph/api/site-list?view=graph-rest-1.0&tabs=http

What Graph APIs are affected by the restriction of sites using "Sites.Selected"?

Also, I understand that "Sites.Selected" is an application type permission setting, but can it also be set as a delegation type permission setting?

Answer 1

Hi @Ren Higashida,

Thank you for posting in this community.

The Sites.Selected application permission is designed to restrict an application's access to specific site collections. However, it does not support listing all sites in the organization.

Instead, the Sites.Read.All and Sites.ReadWrite.All application permissions are required.

Yes, the Sites.Selected permission can now be set as a delegation type permission setting.

Initially, the Sites.Selected scope was only available for application-only authentication scenarios. However, as of February 2024, SharePoint supports delegated Sites.Selected authentication. This means that you can now use the Sites.Selected permission in scenarios where an application is consented to the delegated scope, allowing the application to access specific site collections with the minimal intersection of application and user permissions.

Reference: SharePoint now supports delegated Sites.Selected authentication.

I also checked in my environment and did have Sites.Selected in delegated permissions.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello Ren Higashida,

Thank you for reaching out to Microsoft Support!

The "Search Sites" API does not support the "Sites.Selected" application permissions, meaning it cannot restrict sites using this permission.

Regarding the "List Sites" API, it is affected by the "Sites.Selected" permission. This permission allows applications to access only specific sites that have been explicitly granted access.

Delegated Permissions:

"Sites.Selected" is primarily designed for application permissions, but it can also be used with delegated permissions. This means that a user can delegate access to specific sites to an application, allowing the application to perform actions on behalf of the user within those sites.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.