SharePoint Online | Granting access using SharePoint App-Only | Audit and Report

Question

SharePoint Online | Granting access using SharePoint App-Only | Audit and Report

Oscar 177

Hello,

Can you please help to find a way to list all applications registered for SharePoint?

And what kind of permissions do those applications have, like tenant-wide, per site, etc?

Else in this article, it explains how to create an API but not how to list them all:

https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs

Found a way can run Get-MsolServicePrincipal but then this info is not clear,

Which API is using by which SharePoint,

And is this API exposed to all SharePoint sites or only to specific ones?

Accepted answer

0 additional answers

Your answer

Answer 1

RaytheonXie_MSFT 40,471 Microsoft External Staff

Hi @Oscar

Per my research, there is no such function to list the permission or scope of the SharePoint App-only. We can only get the list of Apps that have access to the content within the site collection by following url

https://<SharePointWebsite> /_layouts/15/AppPrincipals.aspx

I will recommend you to use Azure AD app only as alternatives, and the Azure AD will provide more information about permission level.

User's image

Here is the document for you to reference

https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Oscar 177 Reputation points

2023-02-21T08:00:38.35+00:00

@RaytheonXie_MSFT Hi,

That's the thing when the Azure AD App access wasn't working, users used the SharePoint App-Only and now we try to check what goes where especially interested in the Root APIs that are added on the top and have access to everything.

I suspect the APIs that might have access to all sites must be located under the root URL: https://mytenantname.sharepoint.com/_layouts/15/AppPrincipals.aspx

And maybe also here: https://mytenantname-admin.sharepoint.com/_layouts/15/AppPrincipals.aspx

But then I see some Apps added, how to find if those are "Standard Microsoft"?

Print screen below from tenant root: mytenantname.sharepoint.com/_layouts/15/AppPrincipals.aspx

First "Microsoft.SharePoint" maybe is from "Standard" as its ID starts with "i:0i.t|ms.sp.ext|00000003-0000-..."

Print screen below from tenant admin root: mytenantname-admin.sharepoint.com/_layouts/15/AppPrincipals.aspx

If I go to my second tenant, then I see one API record under tenant root: mysecond_tenantname.sharepoint.com/_layouts/15/AppPrincipals.aspx
RaytheonXie_MSFT 40,471 Reputation points Microsoft External Staff

2023-02-22T06:51:40.1766667+00:00
Hi @Oscar

In my site, the app should be like following format

i:0i.t|ms.sp.ext|ClientID@TenantID

The first screenshoot is in tenant admin

The second is in https://mytenantname.sharepoint.com/_layouts/15/AppPrincipals.aspx

The tenant admin scope will be only avaliable in https://mytenantname-admin.sharepoint.com/_layouts/15/AppPrincipals.aspx

And the sitecollection scope app is avaliable in https://mytenantname.sharepoint.com/_layouts/15/AppPrincipals.aspx
Oscar 177 Reputation points

2023-02-22T08:56:03.57+00:00

@RaytheonXie_MSFT

Do you confirm that the SharePoint App-only API, that might have access to All tenant sites, will be located under this URL:

https://mytenantname.sharepoint.com/_layouts/15/AppPrincipals.aspx ?
RaytheonXie_MSFT 40,471 Reputation points Microsoft External Staff

2023-02-22T09:13:20.3733333+00:00

Hi @Oscar

The app in https://mytenantname.sharepoint.com/_layouts/15/AppPrincipals.aspx just have the permission to https://mytenantname.sharepoint.com. This doesn't mean the apps have permission to other sites. Apps in https://mytenantname.sharepoint.com/sites/sitename/_layouts/15/AppPrincipals.aspx have the permission of the site
RaytheonXie_MSFT 40,471 Reputation points Microsoft External Staff

2023-02-27T06:28:34.96+00:00

Hi @lightupdifire

Would you tell me whether your issue has been resolved or have any update?

I am looking forward to your reply.

Have a nice day!

Thanks,

Raytheon Xie
Oscar 177 Reputation points

2023-02-27T07:52:15.2233333+00:00
Hello @RaytheonXie_MSFT

As you say

<<<

The app in https://mytenantname.sharepoint.com/_layouts/15/AppPrincipals.aspx has permission to https://mytenantname.sharepoint.com. This doesn't mean the apps have permission to access other sites.

But this we can use to query, we can use the API ID and do the "/_layouts/15/appinv.aspx", then we can see if it has access to all sites or only to the specific one. Yes? :)

But what I can see, it is not really an automated process to filter all SharePoint Apps and their permissions...

I think it would be much better if in some sections, Office 365 Admin or SharePoint Admin we could use some Reports like:

Give me all SharePoint APIs

Or give me all Azure APIs with SharePoint permissions

Give me all permissions, is it tenant wide or per site

Maybe it will be there in the future, do you know?
RaytheonXie_MSFT 40,471 Reputation points Microsoft External Staff

2023-02-28T02:41:10.07+00:00

Hi @lightupdifire,

Currently there is no such api to get permission level of apps. I feel regretful to inform you that it turns out to be a by-design one.

Many features of our current products are designed and upgraded based on customers’ feedback. With requirements like this increase, the problem may well be released in the future. Thanks for your understanding.
Oscar 177 Reputation points

2023-02-28T08:17:07.64+00:00

Hello @RaytheonXie_MSFT

Thanks for all the efforts and have a great all ahead ;)
RaytheonXie_MSFT 40,471 Reputation points Microsoft External Staff

2023-02-28T08:39:13.21+00:00

Hi @Oscar

Thanks for letting us know your user experience. If there's anything about sharepoint you'd like to know in future, don't hesitate to raise a ticket in our forum.

Share via

SharePoint Online | Granting access using SharePoint App-Only | Audit and Report

0 additional answers

Your answer