Microsoft Graph service exception Error code: accessDenied with Site.Selected Permission

Question

I have application which uploads files from S3 to a specific Sharepoint site using Microsoft graph Java SDK. I registered app called 'S3ToSharePoint' in Azure active directory, add Application type 'Sites.Selected' permission to my app since admin won't grant Sites.ReadWrite.All(Application) for security concern. In the description of 'Sites.Selected', it says 'Allow the application to access a subset of site collections without a signed in user. The specific site collections and the permissions granted will be configured in SharePoint Online. ' So I added this the account as owner(full access) in Sharepoint sites(not sure if this is the correct way to do configuration). But still got 'accessDenied' error when trying to upload to this Sharepoint sites. Does anyone know if this is the correct way? I saw someone use Sites.ReadWrite.All(Application) and that works for them. Not sure 'Sites.Selected' will do the same since it is in preview mode.

Answer 1

Hi @s-taxcomreporting SA , may I ask how did you add the Application as owner in Sharepoint sites?

So I added this the account as owner(full access) in Sharepoint sites

Answer 2

Just found this question today and wanted to provide some clarity.

There are two components to making the scenario work.

1 You already found which is requesting Sites.Selected

2 Is using the new Permissions API on the Site object (https://learn.microsoft.com/en-us/graph/api/resources/permission?view=graph-rest-1.0) to grant access to your application on each site you want to be able to access.

To accomplish #2 you will need a separate application that already has Sites.FullControl.All. The intent here is that the application that manages the permissions would likely be owned by your IT or Tenant Admin group since granting permissions requires the necessary broad scope.

See our blog post (https://developer.microsoft.com/en-us/graph/blogs/controlling-app-access-on-specific-sharepoint-site-collections/) for more details and a demo.

Answer 3

This might help, refer this blogpost on how to use this permission in the Azure ad APP
https://ashiqf.com/2021/03/15/how-to-use-microsoft-graph-sharepoint-sites-selected-application-permission-in-a-azure-ad-application-for-more-granular-control/

Answer 4

SharePoint tenant admin has to approve access to AAD app prior to making call. Tenant admin can user graph explorer to grant permissions. you can refer article for details.

Make a post request to https://graph.microsoft.com/v1.0/sites/<<siteId>>/permissions for granting permissions to AAD app on the SPO site.
Headers: Content-Type: application/json
Body
{
“roles”: [“read”],
“grantedToIdentities”: [{
“application”: {
“id”: “<<client id from step 1>>”,
“displayName”: “<<name of aad app created in step 1>>”
}
}]
}