Unable to grant Files.SelectedOperations.Selected application permission to a SharePoint Online file using Microsoft Graph (403 AccessDenied)

Question

Question

I'm trying to grant file-level application access to a SharePoint Online document using the new Files.SelectedOperations.Selected permission as described in the Microsoft documentation.

Environment

SharePoint Site

https://gamerdey8801gmail.sharepoint.com/sites/barrier24IAM

Document Library

Documents

Folder

IAM Docs

File

Application Input file.csv

---

Application

App Registration

AppOnboarding-SAML

Client ID

c3acb49e-e19f-4544-9e77-2739acddd037

The application has the following Microsoft Graph Application permissions:

• Files.SelectedOperations.Selected

Admin consent has already been granted.

---

User

I am signed in as a Global Administrator.

The delegated token used in Graph Explorer contains the following scopes (among others):

Files.ReadWrite.All

Sites.FullControl.All

Sites.ReadWrite.All

Sites.Manage.All

---

SharePoint IDs

Site ID

gamerdey8801gmail.sharepoint.com,5f7168ab-8a36-47cc-b82c-f483e8cace02,d0d4383e-17ef-4836-b5aa-d5556e783eed

Drive ID

b!q2hxXzaKzEe4LPSD6MrOAj44JNDvFzZltarVVW54Pu00o5LG4xbXRbUVETRTpdNA

DriveItem ID

017XCENBRG6LCHO2ZIUZALH4CSEDJRH4ZQ

---

Verification

The following requests succeed:

Get the file

GET /v1.0/sites/{site-id}/drive/root:/IAM Docs/Application Input file.csv

Get the file permissions

GET /v1.0/sites/{site-id}/drive/items/017XCENBRG6LCHO2ZIUZALH4CSEDJRH4ZQ/permissions

The response correctly returns the inherited SharePoint permissions (Owners, Members, Visitors), confirming the DriveItem is valid.

---

Request that fails

I'm attempting to grant read access to the application using the following request:

POST /v1.0/sites/gamerdey8801gmail.sharepoint.com,5f7168ab-8a36-47cc-b82c-f483e8cace02,d0d4383e-17ef-4836-b5aa-d5556e783eed/drives/b!q2hxXzaKzEe4LPSD6MrOAj44JNDvFzZltarVVW54Pu00o5LG4xbXRbUVETRTpdNA/items/017XCENBRG6LCHO2ZIUZALH4CSEDJRH4ZQ/permissions

Request body:

{

"roles": [

"read"

],

"grantedToV2": {

"application": {

  "id": "c3acb49e-e19f-4544-9e77-2739acddd037",

  "displayName": "AppOnboarding-SAML"

}

}

}

I also tested the same request using grantedTo instead of grantedToV2.

Both return:

{

"error": {

"code": "accessDenied",

"message": "Access denied"

}

}

---

PnP PowerShell

I also tested using the latest PnP PowerShell:

Grant-PnPEntraIDAppFilePermission `

-AppId "c3acb49e-e19f-4544-9e77-2739acddd037" `

-DisplayName "AppOnboarding-SAML" `

-Permissions Read `

-List "Documents" `

-Path "IAM Docs/Application Input file.csv"

This also returns:

403 AccessDenied

Since PnP internally calls the same Microsoft Graph endpoint, both methods fail with the same error.

---

Question

Is there any additional prerequisite to grant Files.SelectedOperations.Selected on a regular SharePoint Online document library, or is the POST /permissions endpoint currently supported only for SharePoint Embedded containers?

If Files.SelectedOperations.Selected is supported for standard SharePoint Online document libraries, could someone please confirm the correct API and request format for granting an Entra ID application access to a specific file?

Answer 1

Sites.FullControl.All is the permission required to grant the file-level scope, but if you are running this in the context of a user (delegate permissions) you must also make sure the user itself has sufficient permissions assigned either via the SharePoint Online/Global admin role, or as site collection administrator.

If you are still having issues, can you share the decoded access token you are using for your request, specifically the roles/scopes therein.