The Task

Grant an Azure AD app write access to a single SharePoint site - instead of every site in the tenant.

Prerequisites

  • Global Administrator role or
  • Site Owner permissions on the target site
  • An app registration with the Sites.Selected permission

Checking Existing Permissions

GET request: https://graph.microsoft.com/v1.0/sites/{site-id}/permissions

Graph Explorer GET request showing empty permissions array

Empty value: [] means no app-level permissions have been granted yet

Granting Permissions

POST request

Body:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

{
  "roles": ["write"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "APP_CLIENT_ID_HERE",
        "displayName": "Your App Name"
      }
    }
  ]
}
Graph Explorer POST request body with app client ID and display name

Request body: application ID + display name

Result:

Graph Explorer showing 201 Created response

201 Created - permission granted

Notes

  • roles accepts "read" or "write"
  • id is the app’s Client ID (not Object ID)
  • This grants site-scoped permissions - no need for tenant-wide Sites.ReadWrite.All
  • Easiest to run through Graph Explorer