This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 43%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMA%3C/text%3E%3C/svg%3E)
We are using Microsoft Entra ID to authorize applications to register and use the Graph API to access Sharepoint API.
Is there a way to give an application authorization to operate only one site, rather than all Sharepoint sites?
Thank you.
Yes, you can restrict access to specific site(s) only by leveraging the method detailed here: https://devblogs.microsoft.com/microsoft365dev/controlling-app-access-on-specific-sharepoint-site-collections/
If you need more detailed steps, I've put some here: https://www.michev.info/blog/post/3256/limiting-access-to-sharepoint-online-resources-via-the-graph-api
I was able to achieve this with the methods you teached.
However, in my project it is not possible to temporarily grant Sites.FullControl.All permissions to the application.
Is there any way to avoid giving permission for Sites.FullControl.All?
The Sites.FullControl.All permissions is not needed for the application you want to restrict. It is needed to configure the restrictions, by an admin performing this operation via another (usually self-registered) application. Since accessing the /permissions endpoint is only available via the Graph API currently, there is no alternative.
@Vasil Michev
I completely understand and my problem is solved.
Thank you very much.