Granting AllSites.FullControl and Sites.FullControl.All on one particular Sites only

Question

Granting AllSites.FullControl and Sites.FullControl.All on one particular Sites only

EnterpriseArchitect 6,391

In the SharePoint Online,

How can I grant a specific Enterprise Application / Service Principal any of these permissions in Entra ID, but for just one particular SharePoint online sites only, Not all ?

AllSites.FullControl

or

Sites.FullControl.All

Austin-H 8,370 Reputation points Microsoft External Staff Moderator

2025-07-31T04:03:16.3333333+00:00

Hi @EnterpriseArchitect,

It has been a while since your last approach.

May I know if Teddie's suggestions work on your end?
I am looking forward to your response.

1 answer

Your answer

Austin-H 8,370 Reputation points Microsoft External Staff Moderator

2025-07-31T04:03:16.3333333+00:00

Hi @EnterpriseArchitect,

It has been a while since your last approach.

May I know if Teddie's suggestions work on your end?
I am looking forward to your response.

Answer 1

Teddie-D 19,760 Microsoft External Staff Moderator

Hi @EnterpriseArchitect

Thank you for posting your question in the Microsoft Q&A forum.

In SharePoint Online, application permissions like Sites.Read.All and Sites.FullControl.All grant access across the entire tenant by default. In contrast, Sites.Selected lets you restrict access to specific site collections.

If you want to grant Sites.FullControl.All or AllSites.FullControl to an Enterprise Application or Service Principal to a single site, you must configure the Sites.Selected permission model in Microsoft Entra ID.

I found an article which may be useful, please take it as a reference Develop Applications that use Sites.Selected permissions for SPO sites. | Microsoft Community Hub
I hope this helps.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread

EnterpriseArchitect 6,391 Reputation points

2025-06-27T12:11:36.44+00:00

@Teddie-D ,
Thank you for the confirmation. Yes, I just wanted to limit the scope to just one site, one in SPO, Does it mean I can modify from Entra or this must be done through PowerShell or Graph API ?

EnterpriseArchitect 6,391

Like this:

Import-Module Microsoft.Graph.Sites
Connect-MgGraph -Scopes "Sites.FullControl.All"
$siteId = "tenant.sharepoint.com,xxxxxx-6710-417e-bd83-xxxxx,xxxxxx-b61c-49dd-af50-xxxxx"
$appId = "your-app-client-id"
$params = @{
    roles = @("write")
    grantedToIdentities = @(
        @{
            application = @{
                id = $appId
                displayName = "YourAppName"
            }
        }
    )
}
New-MgSitePermission -SiteId $siteId -BodyParameter $params

Teddie-D 19,760 Reputation points Microsoft External Staff Moderator

2025-07-01T15:16:22.8566667+00:00

Hi @EnterpriseArchitect
Thank you for your response.

To assign the Sites.Selected permission

Go to Entra ID > App registrations > [Your App] > API permissions

Add Microsoft Graph > Application > Sites.Selected

Click Grant admin consent

We're currently testing your PowerShell script. We'll share the results as soon as we've completed validation.

Thank you for your patience and understanding.
EnterpriseArchitect 6,391 Reputation points

2025-07-02T01:07:08.0933333+00:00

Thank you @Teddie-D ,
I wanted to know how do we enter the specific SharePoint site ?

Teddie-D 19,760 Microsoft External Staff Moderator

Hi @EnterpriseArchitect,

After testing, here is the PowerShell script to grant site-specific permission:

Import-Module Microsoft.Graph.Sites 
Connect-MgGraph -Scopes "Sites.FullControl.All"  $site = Get-MgSite -SiteId "tenant.sharepoint.com:/sites/yoursite:" 
$siteId = $site.Id 
$appId = "7e829e02-xxxxxxxxxxxxxx-94db4d801db2" 
$params = @{ 
roles = @("write") 
grantedToIdentities = @( 
@{ 
application = @{ 
id = $appId 
displayName = "your app name" 
} 
} 
) 
} 
New-MgSitePermission -SiteId $siteId -BodyParameter $params

This is the script to authenticate and verify access when calling Microsoft Graph API

#Get access token 
Install-Module MSAL.PS -Force 
# Set your app values 
$appId = "7e829e02xxxxxxxxdb4d801db2" 
$tenantId = "41ae7872-xxxxxxxxxx132-0fcd21bee785" 
$plainSecret = "e638Q~7Bp4xxxxxxxxxxxzB3WGi_3u_tX1pcXP" 
  
# Convert to SecureString 
$secureSecret = ConvertTo-SecureString -String $plainSecret -AsPlainText -Force 
  
# Get access token using MSAL.PS 
$token = Get-MsalToken -ClientId $appId -TenantId $tenantId -ClientSecret $secureSecret -Scope "https://graph.microsoft.com/.default" 
  
# Extract access token 
$accessToken = $token.AccessToken 
$headers = @{ 
    Authorization = "Bearer $accessToken" 
} 
  
Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/sites/tenant.sharepoint.com:/sites/Teddietest" -Headers $headers

This is the result:
User's image

I hope this helps.
If you think my answer is helpful to you, don't forget to mark it as an answer.
Warm thanks!

Teddie-D 19,760 Reputation points Microsoft External Staff Moderator

2025-07-03T08:24:18.8633333+00:00

Hi @EnterpriseArchitect
Just checking in to see if the information above was useful to you.
If you have any additional updates or need further assistance, don't hesitate to reach out.
If my response was helpful, please consider marking it as an answer. Warm thanks!
Teddie-D 19,760 Reputation points Microsoft External Staff Moderator

2025-07-06T23:20:18.2566667+00:00

Hi @EnterpriseArchitect

I hope you are doing well.
May I know if you have got any chance to check my answer? If you need further assistance, feel free to let me know.
If you found my response helpful, please consider marking it as an answer. It can help other community users in future to solve similar issues.
Thanks for your understanding.
EnterpriseArchitect 6,391 Reputation points

2025-07-07T02:40:42.9833333+00:00

@Teddie-D ,
Thank you for the update.
In my current case, there are multiple single Enterprise Application that I wanted to downgrade from AllSites.FullControl and Sites.FullControl.All.

Can I just modify or update the existing App Registration or do I nee to create new registration?
Teddie-D 19,760 Reputation points Microsoft External Staff Moderator

2025-07-08T08:58:05.1833333+00:00

Hi @EnterpriseArchitect
Thank you for your response.
You can modify or update the existing App Registration.
If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well. Thanks for your understanding
Teddie-D 19,760 Reputation points Microsoft External Staff Moderator

2025-07-10T08:59:06.6233333+00:00

Hi @EnterpriseArchitect
How are things progressing?
If you still have further concerns, please feel free to let us know.
Any update would be appreciated.
If you think my answer is helpful to you, don't forget to mark it as an answer. Thank you!
EnterpriseArchitect 6,391 Reputation points

2025-07-10T12:52:56.8866667+00:00

Thank you @Teddie-D ,
I will try next week and get back to you.
Teddie-D 19,760 Reputation points Microsoft External Staff Moderator

2025-07-28T11:38:55.6433333+00:00

Hi @EnterpriseArchitect
It has been a while, and I am writing to see how things are going with this issue.
May I know if you had a chance to test the solution I shared? It would be great to know if it worked for your scenario. And if you encounter any issues or have questions, feel free to reach out. I’m happy to assist.