How to limit Azure AD App access to only a folder on a SPO Document Library site?

Question

How to limit Azure AD App access to only a folder on a SPO Document Library site?

Denis Payne 181

A 3rd party has asked for an Azure AD App to be created so they can use use it to upload and edit data in SharePoint online.

I cannot see a way to limit the Azure AD App access to a certain folder on a certain SPO site document library. Seems I can only give the Azure AD App access to ALL SPO sites, or one entire SPO site.

Answer accepted by question author

0 additional answers

Your answer

Answer 1

CarlZhao-MSFT 46,406

Hi @Denis Payne

As of now, you can only restrict application access to only specific site collections, not to specific folders.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Denis Payne 181 Reputation points

2023-04-25T11:55:07.89+00:00

Does that apply to specific SharePoint online sites also? As we have no site collections.
CarlZhao-MSFT 46,406 Reputation points

2023-04-26T02:12:07.8533333+00:00

Hi @Denis Payne

Of course, the same applies to a single specific SharePoint online site.
Denis Payne 181 Reputation points

2023-04-26T12:09:44.4733333+00:00

If I were to create an AAD guest account with the 3rd parties email address, would they be able to use that account to programmatically access the SPO document library folder via a specific people share link?
CarlZhao-MSFT 46,406 Reputation points

2023-04-27T07:03:55.41+00:00
Hi @Denis Payne

Yes, according to my tests, the guest account was able to programmatically access the SPO document library folder via a shared link.

A simple API call test:

Sample code snippet:

var result = await graphClient.Shares["{sharedDriveItem-id}"].DriveItem.GetAsync();

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.
Denis Payne 181 Reputation points

2023-04-28T12:42:02.7966667+00:00

Hi CarlZhao-MSFT
Thank you for checking.
3rd party who I want to connect to our SPO is advising that "Whilst a user account can work for individual manual access, it doesn't grant any API level access - for that you still need to create an app and all the associated user level connections such as a single sign on path."

Are they correct?
Or can a user account be used to access API rather then an Azure AD APP?
CarlZhao-MSFT 46,406 Reputation points

2023-05-02T07:03:51.9333333+00:00

Hi @Denis Payne

Yes, I think they are correct.

The user account cannot directly call the API, the user must log in to the application and obtain an access token, and then use the access token to call the API.

Also, users cannot be granted graph API permissions directly, this can only be achieved through applications.

Hope this helps.
Denis Payne 181 Reputation points

2023-05-02T11:40:42.12+00:00

Hi CarlZhao-MSFT
Thank you, will speak to 3rd party to see if another way to give them access and if not will check out IFTTT type cloud service to see if that can be used instead.

Share via

How to limit Azure AD App access to only a folder on a SPO Document Library site?

0 additional answers

Your answer