Sites.Selected not working as expected with Files.Read.All and/or User.Read.All included

Question

Hi,

I am currently implementing the Sites.Selected permission for our developer application, which accesses the endpoint https://graph.microsoft.com/v1.0/sites/{SITE_ID}/drives. My expectation is that the application should only receive a successful response if it has been explicitly granted read access to the specific site.

However, I have observed that when either Files.Read.All or User.Read.All is included alongside Sites.Selected in the application's permissions, the application is still able to access data from sites it has not been granted explicit permission to read. When these additional permissions (Files.Read.All and User.Read.All) are removed, the application behaves as expected and access is restricted.

Could you please confirm if this is the intended behavior for Sites.Selected when combined with broader permissions like Files.Read.All or User.Read.All?

Thank you.

Answer 1

Hi Melvin, 

Welcome to Microsoft Q&A Forum! Have a good day and I hope you're doing well! 

Thank you for reaching out and providing such a detailed description of the issue you're facing. I've looked into this based on Microsoft's documentation and permission model guidelines, and I'll explain what's happening here. 

From what you've described, it sounds like the behavior you're observing is indeed by design in the Microsoft Graph permission system. Here's a breakdown: 

1. Sites.Selected is intended as a least-privilege permission, allowing your application to access only specific SharePoint sites that have been explicitly granted access via admin consent. 

2. However, when broader permissions like Files.Read.All or User.Read.All are included in your application's delegated or application permissions, they effectively override the restrictions imposed by Sites.Selected.  

• Files.Read.All grants read access to all files across the tenant, which inherently includes files in any SharePoint site, bypassing the site-specific limitations.

References: https://learn.microsoft.com/en-us/graph/permissions-reference#filesreadall 

• Similarly, User.Read.All allows reading user data tenant-wide, which can interact with site-related operations in ways that extend beyond the selected sites. 

This is how Microsoft's permission model is architected: Permissions are additive and evaluated in a way that the most permissive scope takes precedence. If a broader permission is present, it expands the access scope, making the more restrictive one (like Sites.Selected) ineffective in limiting access to only the granted sites. 

This design ensures flexibility but can lead to unexpected results if not carefully managed. It's documented in Microsoft's Graph API permission references (e.g., in the Microsoft Graph permissions reference and best practices for least-privilege), where they emphasize using only the minimal permissions needed to avoid unintended access. 

I hope the information I’ve shared is helpful or provides some clarity. If you have any concerns, questions, or if anything I mentioned seems unclear or misunderstood, please feel free to reach out anytime. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".    

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.