Sites.Selected Require Sites.Read.All

Question

Sites.Selected Require Sites.Read.All

Sharee Huddleston 50

I have an app registration. It has been granted admin access to graph permission Sites.Selected. A Global admin granted registered app explicit write access to specific sharepoint site using graph explorer. It seems we also need admin consent for Sites.Read.All. If we use both Sites.Read.All and Sites.Selected, does Sites.Selected filter access to only read the site.selected? Why is Sites.Read.All also needed? Thank you.

0 comments

Answer accepted by question author

Emily Du-MSFT 51,996 Microsoft External Staff

You need both Sites.Selected and Sites.Read.All to read data for a site collection.

Sites.Selected is an endpoint which administrator can grant Read, Write, or Read and Write permissions to an application for a site collection.

So, first develop aplication with Sites.Selected permission, then use Sites.Selected endpoint to grant Read permissions to an application for a site collection.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Sharee Huddleston 50 Reputation points

2024-08-13T14:34:27.11+00:00

Thank you. It seems this Microsoft document explains the need for Sites.Read.All to perform any "Gets" on a site. https://learn.microsoft.com/en-us/graph/api/site-get?view=graph-rest-1.0&tabs=http
Sharee Huddleston 50 Reputation points

2024-08-16T14:49:11.96+00:00

Hello - do you know the security around this configuration? It seems that the app is allowed to read all sites in the tenant, but only read/write to the selected site. Is this the case? If so, is there a way to scope so only the single site is read?
Constantin Kwiatkowski 45 Reputation points

2025-01-27T22:51:09.1966667+00:00

can you explain how I can get the title of a sharepoint site? What permissions I mutst set up on the Azure app to receive the sharepoint site title? It looks like site.selected for app-only is not enough.
Chris King 10 Reputation points

2026-07-07T17:54:43.63+00:00

I don't believe this is accurate. We have many apps that specifically target sites with sites.selected app permissions. I would suggest that sites.read.all is too open. I would not want applications that need to read all sites to find the site it is looking for but that of course is up to your organization to decide.

1 additional answer

Your answer

Sharee Huddleston 50 Reputation points

2024-08-13T14:34:27.11+00:00

Thank you. It seems this Microsoft document explains the need for Sites.Read.All to perform any "Gets" on a site. https://learn.microsoft.com/en-us/graph/api/site-get?view=graph-rest-1.0&tabs=http
Sharee Huddleston 50 Reputation points

2024-08-16T14:49:11.96+00:00

Hello - do you know the security around this configuration? It seems that the app is allowed to read all sites in the tenant, but only read/write to the selected site. Is this the case? If so, is there a way to scope so only the single site is read?
Constantin Kwiatkowski 45 Reputation points

2025-01-27T22:51:09.1966667+00:00

can you explain how I can get the title of a sharepoint site? What permissions I mutst set up on the Azure app to receive the sharepoint site title? It looks like site.selected for app-only is not enough.
Chris King 10 Reputation points

2026-07-07T17:54:43.63+00:00

I don't believe this is accurate. We have many apps that specifically target sites with sites.selected app permissions. I would suggest that sites.read.all is too open. I would not want applications that need to read all sites to find the site it is looking for but that of course is up to your organization to decide.

Answer 1

Michael Taylor 61,236

Perhaps this will provide some insight for you.

You should also read the subsequent blog article from earlier this year about it.

Sharee Huddleston 50 Reputation points

2024-08-13T04:43:22.6433333+00:00

Thank you. These are both great references. I configured our app registration per the first article. The blog mentions combining delegated/application permission, but that didn't seem to work either. It seems the consensus is that you still need Sites.Read.All even though Microsoft documentation says Sites.Selected is sufficient. I am hoping Microsoft can provide a definitive answer which is required, and if it is both, is Sites.Read.All scoped to only read site granted with Sites.Selected. If not, the use of Sites.Selected provides no new scope.
Darian 15 Reputation points

2024-08-16T13:58:08.95+00:00

I am experiencing a similar issue here. The endpoint https://graph.microsoft.com/v1.0/search/query does not work with Sites.Selected permissions alone. The search functionality requires either Files.Read.All, Sites.Read.All, Files.ReadWrite.All, or Sites.ReadWrite.All permissions. I have read in the forums that when an Azure application is granted Sites.Read.All and Sites.Selected permissions, it conducts searches everywhere rather than confining the search scope to Sites.Selected. I am wondering if this is a bug that Microsoft will address or if this there is a specific way to provide the Sites.Read.All permissions required for the application to run the search query while also using Sites.Selected to limit the scope to specific sites in the workspace.
Sharee Huddleston 50 Reputation points

2024-08-16T14:50:55.9033333+00:00

Dorian - I have a similar question. Is there a way to secure scope to only read the selected site? Hopefully, someone can answer for us.
Benjamin Wolfe 0 Reputation points

2025-05-14T07:13:15.6333333+00:00

After recently going through the painful process of setting this up myself, I can fully appreciate how convoluted the documentation is, and how difficult it is to implement, maintain over time, or even just retrieve what permissions have been granted to a service principal or SharePoint site.

To make this easier, I have put together a script that handles the heavy lifting. It lets you add or remove permissions and easily retrieve both Graph and SharePoint permissions for a given SharePoint site or service principal.

You can grab it from here:
https://github.com/WolfeByte/toolbox/tree/main/SharePoint%20Online#sharepoint-graph-permissions-helper