Unable to Grant App Permissions to SharePoint Site via Microsoft Graph API

DeanNeedsAnswers 60 Reputation points
2025-09-09T16:09:52.6933333+00:00

Good day,

Following the guide here - https://devblogs.microsoft.com/microsoft365dev/controlling-app-access-on-specific-sharepoint-site-collections/ - I'm trying to assign an app access to an individual SPO site but an running into issues. Every time I run the query, I get the error Forbidden - 403 - 581 ms Either the signed-in user does not have sufficient privileges, or you need to consent to one of the permissions on the ``Modify permissions`` tab

Some things to note -

  1. I've confirmed that in Azure, the app's API permissions include Sites.ReadWrite.All, Sites.Selected, and User.Read
  2. The account I'm running the query with is listed as a site admin in the SPO site in question.
  3. In the permissions panel in the graph explorer, all three of permissions above are consented too with "AllPrincipal" consent type"

Any insights on this?

My code in graph is as follows - 

POST https://graph.microsoft.com/v1.0/sites/{mysiteId}/permissions


{
"roles": ["write","read"],
"grantedToIdentities": [{
"application": {
"id": "MyAppID",
"displayName": "MyAppName"
}
}]
}
Microsoft Security | Microsoft Graph
Answer accepted by question author
Vasil Michev 127.6K Reputation points MVP Volunteer Moderator
2025-09-09T17:24:46.78+00:00

There are two things you need. First, to grant the permission entry on the site in question, by running a request similar to the one you've shown above. The requirement for this to work is to have the Sites.FullControl.All permission though, so make sure you've granted that, and if you are using delegate permissions, make sure the user running this query is listed as Site collection admin.

Next, you need the "restricted" app itself. The Sites.Selected permission is what you assign to the "restricted" app. Do not assign Sites.ReadWrite.All or any similar permissions to it, as the restricted access will not apply in such scenarios.

If you need more details on how Sites.Selected works, I have a guide here: https://michev.info/blog/post/3256/limiting-access-to-sharepoint-online-resources-via-the-graph-api

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.