How to give Sharepoint folder granular access to a Service Principal ?

Question

Our team is working to get data from Sharepoint to Azure blob storage. We decided to use ADF as logic apps has size limitations.

The doc referred is Microsoft Learn

To complete this solution, we need to give the sharepoint site full access to the application registered from azure portal. ("https://[your_site_url]/_layouts/15/appinv.aspx")

However, there are some folders with restricted content which we don't want to give access to (app).

So is there any way to give the app access to only specific folders in the sharepoint site ?

Answer 1

To provide granular access to specific folders in SharePoint for a Service Principal (application) without giving it access to the entire SharePoint site, follow these steps:

1. Create the Service Principal and Add SharePoint API Permissions:

• In Azure Active Directory (Entra ID), register your application (if not done already).
  • Go to API Permissions for the app and add SharePoint permissions. Choose the appropriate level of permission, such as Sites.Selected for limited access to specific sites and folders.
  • Grant admin consent for the API permissions if required.

2. Grant Limited Access to the SharePoint Site:

• Navigate to the SharePoint site where you need to give access.
  • Open the site with the URL format: https://[your_site_url]/_layouts/15/appinv.aspx.
  • Enter the Client ID (Service Principal ID) for your application.
  • Click "Lookup," and SharePoint will populate the app details.

3. Set Permissions in AppInv Page:

• In the "Permission Request XML" field, specify granular access to a specific folder.
  • The following XML can be used to define read or write access to specific folders. For example:

    
         <AppPermissionRequests AllowAppOnlyPolicy="true">
    
            <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list" Right="Read" />
    
            <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list/folder" Right="Write" />
    
         </AppPermissionRequests>
    
    

  • Replace sitecollection/web/list/folder with the appropriate path to the folder you want to grant access to.

4. Use the Microsoft Graph API or SharePoint API for Granular Access:

• Once the permissions are configured, you can use the Microsoft Graph API or SharePoint REST API in Azure Data Factory to access only the folders the Service Principal has access to.
  • To limit the scope to specific folders, you can use the Sites.Selected permission and then assign permissions to the Service Principal via the SharePoint Online PowerShell or the Microsoft Graph API.

5. Configure Azure Data Factory for Folder-Specific Access:
   • When configuring ADF's connection to SharePoint, ensure the Service Principal is using only the permissions granted to specific folders.

• Use the correct folder path in your ADF activities to interact with the desired content.

Answer 2

Hi @Chandra Boorla and @Amira Bedhiafi

Hope you're doing well and sorry for the late answer

This solution is not authorized within my organization as evryone has the access to appinv.aspx to grant access and therfore can grant someone access that have never been approved by security

So is there any other alternative ?

Also, what about retiring this feature by 2026 april ? is there any alternative also ?

Kinds