Copy Sharepoint files using ADF and Graph Api Site.Selected

Question

Copy Sharepoint files using ADF and Graph Api Site.Selected

Arundhati Sen 151

I am trying to fetch files from Sharepoint location and load it in Azure Sql Database using ADF. I am trying to use Graog API site.Selected and Managed Identity permission to create the authentication.

I am trying to avoid the ACL approach where we have to generate Bearer token to establish connection. I am able to load data using this approach.

I am following this blog https://pivotalbi.com/copy-files-from-sharepoint-online-using-azure-data-factory-and-the-microsoft-graph-api/

The challenge I am facing is: while trying to give read access to SharePoint Online via the Graph API getting error

powershell code executed:

Connect-AzureAD

$ObjectId = "a507ffa0-3a98-4d16-870a-a82e6a3abbe0"

$graphScope = "Sites.Selected"

$ManagedIdentity = Get-AzureADServicePrincipal -ObjectId $ObjectId

$GraphAPI = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Microsoft Graph'"

$GraphAPI

$SitesSelected = $GraphAPI.AppRoles | where Value -like $graphScope

New-AzureADServiceAppRoleAssignment `

-Id $SitesSelected.Id `

-ObjectId $ManagedIdentity.ObjectId `

-PrincipalId $ManagedIdentity.ObjectId `

-ResourceId $GraphAPI.ObjectId

Error :
Error occurred while executing NewServicePrincipalAppRoleAssignment

Code: Authorization_RequestDenied

Message: Insufficient privileges to complete the operation.

HttpStatusCode: Forbidden

HttpStatusDescription: Forbidden

HttpResponseStatus: Completed

User's image

I am not sure how to solve this, Please help. There is no option to provide any permission at the Managed Identity Level as well.

@RaytheonXie_MSFT

Answer accepted by question author

0 additional answers

Your answer

Answer 1

CarlZhao-MSFT 46,406

Hi @Arundhati Sen

Are you using a user principal or service principal to connect to Azure AD?

If you're using a user principal to connect to Azure AD, make sure your user is a tenant administrator.

Connect-AzureAD

If you're using an application service principal to connect to Azure AD, make sure your application has been granted AppRoleAssignment.ReadWrite.All and Application.Read.All application permissions.

Connect-AzureAD -TenantId $tenantOrDomain -ApplicationId $appId -CertificateThumbprint $thumb

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Arundhati Sen 151 Reputation points

2023-02-17T10:06:05.95+00:00

No I am trying to connect using Managed Identity. this is the process I was following https://pivotalbi.com/copy-files-from-sharepoint-online-using-azure-data-factory-and-the-microsoft-graph-api/
CarlZhao-MSFT 46,406 Reputation points

2023-02-17T10:54:10.0266667+00:00

Hi @Arundhati Sen

You should use a user to connect to Azure AD, because the New-AzureADServiceAppRoleAssignment command is to grant permissions to your managed identity.
CarlZhao-MSFT 46,406 Reputation points

2023-02-21T02:51:29.82+00:00

Hi @Arundhati Sen

Would you please provide us with an update on the status of your issue?
Arundhati Sen 151 Reputation points

2023-02-21T06:37:02.3266667+00:00
Hi @CarlZhao-MSFT can you please clarify below doubts

If Graph:Application:Sites.FullControl.All permission is granted to App, whether the app will get full control of sites present in other Tenant or other subscription as well?

2)For the permissions AppRoleAssignment.ReadWrite.All & Application.Read.All, are these allowed/restricted to only my subscription or multi subscription?
CarlZhao-MSFT 46,406 Reputation points

2023-02-21T07:06:56.7066667+00:00

Hi @Arundhati Sen

The premise of these two problems is that your application must be a multi-tenant application. If your application is not a multi-tenant application, of course it cannot control any other tenant's site.

Even if your app is multi-tenant app, the permissions granted by the app in its original tenant will not automatically map to the target tenant it accesses, so any permissions you grant to the app in the original tenant will not affect other tenants. If your multi-tenant app needs to access resources of other tenants, it must be approved by the administrator of the target tenant.
CarlZhao-MSFT 46,406 Reputation points

2023-02-23T10:20:48.9266667+00:00

Hi @Arundhati Sen

I am checking to see if this issue is resolved or not. If you have any concerns, please feel free to reply.
Arundhati Sen 151 Reputation points

2023-02-23T12:05:41.0766667+00:00

thanks, it is working now!

Share via

Copy Sharepoint files using ADF and Graph Api Site.Selected

0 additional answers

Your answer