Admin Approval Prompt for Sites.Read.All Delegated Scope

Question

Admin Approval Prompt for Sites.Read.All Delegated Scope

Samuel JN 66

According to Microsoft’s documentation, the Sites.Read.All delegated scope should not require admin approval. However, during authorization, we encounter a “Need Admin Approval” error when requesting this scope.

Could you please confirm whether admin consent is actually required for Sites.Read.All, or is there another underlying reason for this error?

Screenshot 2025-09-16 at 6.01.25 PM

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Rin-L 23,385 Microsoft External Staff Moderator

Hi @Samuel JN,

Thank you for posting your question in the Microsoft Q&A forum.

Based on my research, although Microsoft documentation previously indicated that Sites.Read.All (delegated) does not require admin consent (AdminConsentRequired = No), Microsoft has updated its policy as of July 2025.

The Sites.Read.All permission is now classified by Microsoft as a high-impact permission. This means:

Users can no longer self-consent to this permission unless your tenant has a custom policy in place.
Admin approval is now required for applications requesting this scope.

You can read more about this change in the following article: Microsoft Entra Consent Changes Coming July 2025: A Guide for Admins - Securing Insights: Microsoft…

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

To configure custom consent policies for users via the Microsoft Entra portal, please refer to the following official documentation:

Configure how users consent to applications - Microsoft Entra ID | Microsoft

Configure permission classifications - Microsoft Entra ID | Microsoft Learn

User's image

Please note that Sites.Read.All has been assigned a Security Rating: Critical, which indicates the highest level of risk in Microsoft’s production tenants. If needed, I recommend requesting admin consent from your tenant administrator.

Our initial response may not always fully address your question or needs. If you have any further questions, updates, or feedback regarding this answer, please feel free to leave a comment under this post.

I’ll be happy to assist further!

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Samuel JN 66 Reputation points

2025-09-17T07:59:11.1533333+00:00
Thank you for your response.

I’ve added the Sites.Read.All scope as a low-impact scopes at the tenant level. However, I still can’t authorize using a non-admin account.

If Sites.Read.All is only meant for administrators. Which alternative scopes should I authorize for non-admin users to access SharePoint?
Rin-L 23,385 Reputation points Microsoft External Staff Moderator

2025-09-17T12:58:04.5133333+00:00

Hi @Samuel JN,

Thank you for your follow-up.

Initially, I was going to recommend using the Sites.Selected (Delegated) permission along with user-specific file permissions. However, based on further research, it appears that Sites.Selected actually requires Sites.Read.All in order to read data from a site collection. This means both permissions are needed together for the intended functionality: Sites.Selected Require Sites.Read.All - Microsoft Q&A

Since these permissions grant access to potentially sensitive data across SharePoint sites, admin consent is required to ensure proper governance and security. At this time, I haven’t found an alternative approach that would bypass the need for admin approval while still achieving the same level of access.

Additionally, because our forum category primarily focuses on general and out-of-the-box features of SharePoint Online, and your question involves Graph API integration with SharePoint, I sincerely recommend posting your query in the dedicated Microsoft 365 and Office SharePoint Development - Microsoft Q&A space. This is the specialized channel for development-related topics, and the experts there may be able to offer tailored advice or alternative solutions specific to your scenario.

I truly regret that I haven’t yet found an optimal workaround for your scenario. Due to product design and default permission requirements, some limitations, especially around delegated permissions like Sites.Read.All are currently unavoidable.

Still, I hope the information I’ve shared has helped clarify the situation and pointed you toward the right channels for further support.

Thank you again for your understanding!
Samuel JN 66 Reputation points

2025-09-19T05:50:11.7933333+00:00

Thank you for your kind response.
Rin-L 23,385 Reputation points Microsoft External Staff Moderator

2025-09-19T08:40:17.8866667+00:00

Hi @Samuel JN,

Thank you for taking the time to mark the answer as accepted. I truly appreciate it, and I hope to have the opportunity to assist you again in the future.

Wishing you a wonderful day ahead!