https://somethingwentwrong.dev/tags/m365/ Recent content in M365 on SomethingWentWrong.dev Hugo -- 0.153.2 en-us Wed, 29 Jul 2026 00:00:00 +0000 https://somethingwentwrong.dev/posts/site_selected_permissions/ Wed, 29 Jul 2026 00:00:00 +0000 https://somethingwentwrong.dev/posts/site_selected_permissions/ <h2 id="the-task">The Task</h2> <p>Grant an Azure AD app write access to a single SharePoint site - instead of every site in the tenant.</p> <h2 id="prerequisites">Prerequisites</h2> <ul> <li>Global Administrator role or</li> <li>Site Owner permissions on the target site</li> <li>An app registration with the <code>Sites.Selected</code> permission</li> </ul> <h2 id="checking-existing-permissions">Checking Existing Permissions</h2> <p><strong>GET request:</strong> <a href="https://graph.microsoft.com/v1.0/sites/%7Bsite-id%7D/permissions">https://graph.microsoft.com/v1.0/sites/{site-id}/permissions</a></p> <figure> <img loading="lazy" src="https://somethingwentwrong.dev/images/site-permissions-get.png" alt="Graph Explorer GET request showing empty permissions array"/> <figcaption> <p>Empty value: [] means no app-level permissions have been granted yet</p> </figcaption> </figure> <h2 id="granting-permissions">Granting Permissions</h2> <p><strong>POST request</strong></p> <p><strong>Body:</strong></p> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt"> 1 </span><span class="lnt"> 2 </span><span class="lnt"> 3 </span><span class="lnt"> 4 </span><span class="lnt"> 5 </span><span class="lnt"> 6 </span><span class="lnt"> 7 </span><span class="lnt"> 8 </span><span class="lnt"> 9 </span><span class="lnt">10 </span><span class="lnt">11 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-json" data-lang="json"><span class="line"><span class="cl"><span class="p">{</span> </span></span><span class="line"><span class="cl"> <span class="nt">&#34;roles&#34;</span><span class="p">:</span> <span class="p">[</span><span class="s2">&#34;write&#34;</span><span class="p">],</span> </span></span><span class="line"><span class="cl"> <span class="nt">&#34;grantedToIdentities&#34;</span><span class="p">:</span> <span class="p">[</span> </span></span><span class="line"><span class="cl"> <span class="p">{</span> </span></span><span class="line"><span class="cl"> <span class="nt">&#34;application&#34;</span><span class="p">:</span> <span class="p">{</span> </span></span><span class="line"><span class="cl"> <span class="nt">&#34;id&#34;</span><span class="p">:</span> <span class="s2">&#34;APP_CLIENT_ID_HERE&#34;</span><span class="p">,</span> </span></span><span class="line"><span class="cl"> <span class="nt">&#34;displayName&#34;</span><span class="p">:</span> <span class="s2">&#34;Your App Name&#34;</span> </span></span><span class="line"><span class="cl"> <span class="p">}</span> </span></span><span class="line"><span class="cl"> <span class="p">}</span> </span></span><span class="line"><span class="cl"> <span class="p">]</span> </span></span><span class="line"><span class="cl"><span class="p">}</span> </span></span></code></pre></td></tr></table> </div> </div><figure> <img loading="lazy" src="https://somethingwentwrong.dev/images/site-permissions-post-body.png" alt="Graph Explorer POST request body with app client ID and display name"/> <figcaption> <p>Request body: application ID + display name</p>