Sites.selected Application or delegated permission - Which is more secure?

Question

Sites.selected Application or delegated permission - Which is more secure? Can you please provide me which is more secure with example? I know application is more secure. But in case of delegation, the access is constrained by two layers:

1. The signed-in user's permissions
2. The site's explicit assignment to the application

E.g Suppose:

• Alice has access to:
  • HR Site
  • Finance Site

The app is granted sites.selected delegated and is assigned:

• Finance Site
• IT Site

What can the app access when Alice signs in?

Answer: Nothing.

Is my understanding correct?

Answer 1

Yes, that is correct. Though this is more of a "design" question, as application permissions are usually leveraged when you want to perform non-interactive/automated tasks, whereas apps with delegate permissions usually rely on user's input. So try to answer the "how the app will be used" question first.

When it comes to Sites.Selected permissions, both variants can be considered (almost) equally restrictive. The biggest issues customers have with application permissions is that they are tenant-wide, unconstrained. SItes.Selected addresses that, in both the delegate and application permission variants. But with the application variant, there is no user element in the equation, so the app gets access to any site you've granted it permissions for, without any other factors in play.

Delegate permissions are instead "doubly constrained" as both the app and the user must have sufficient permissions to access the site. That said, it's not uncommon to have SPO sites provisioned to "everyone" or "everyone without external users", resulting in each user getting access by default. So you can consider them more restrictive than application permissions, so if your app will be performing actions on behalf of a given user, you must ensure both the user and the app have permissions.