Azure App registration API Permissions & Sharepoint

Question

I want to access Sharepoint on behalf of a user via OAuth (delegated access). My app would connect to sharepoint and read files, documents, etc. from the sites user has access to. Could you please let me know what all scopes must be configured in App registration -> API Permissions to access the sites (sites which are accessible to the signed in user)

I tried the following -

1. created a multitenant app with permission Graph: Sites.read.all and admin granted consent OK.
2. Now in OAuth flow, I set my client id, client secret and scope=Sites.selected. I'm able to grant consent as a non admin user and I get an access token and I'm able to access sites I have access to.

Is this a recommended way? I thought with this permission Graph: Sites.selected, an admin must configure the permission to selected sites on Sharepoint. How is it I'm able to access without configuring this and just by admin granting consent in app for Graph: Sites.read.all?

Another related question - assuming I'm user X, is there a way to configure app permissions to access the sites in Sharepoint which are accessible to the user X without involving an admin?

Answer 1

When you configured Sites.Read.All as an Application permission and admin-consented it, then used Sites.Selected scope in your OAuth flow, you're actually leveraging a combination of both permission models. The Sites.Selected scope in the OAuth flow operates as a delegated permission, meaning it respects the signed-in user's existing SharePoint access rights rather than requiring explicit site configuration.
For Sites.Selected-->Refer to the Microsoft Graph Permissions reference here to differentiate Application and Delegated Permissions as well as whether Admin Consent is required or not- https://learn.microsoft.com/en-us/graph/permissions-reference#sitesselected
For Sites.Read.All configured as delegated permission, no admin needs to configure specific sites, it follows least privilege principal and the user sees permissions they are granting during consent
Documentation here https://learn.microsoft.com/en-us/graph/permissions-reference#sitesreadall