Azure App access to subsite

Use Selected permissions so the app is restricted to just the target list, even if it is in a subsite.

1. In Microsoft Entra app registration
   • Grant the app the appropriate Selected scope for lists, for example the application or delegated Lists.SelectedOperations.Selected scope.
   • An admin must consent to this scope.
2. Grant the app access to the specific list (in the child site)
   • Resolve the site and list IDs for Parent site -> Child site -> List.
   • Call Microsoft Graph to assign permissions at list level:

          POST /sites/{siteId}/lists/{listId}/permissions
          Content-Type: application/json
          
          {
            "roles": ["read"],
            "grantedToIdentities": [
              {
                "application": {
                  "id": "{clientId}",
                  "displayName": "{application-name}"
                }
              }
            ]
          }
     

   • Here roles can be read, write, manage, or fullcontrol. Use read to restrict to read-only.
3. Acquire tokens and call the list
   • The app must request an access token that includes the Lists.SelectedOperations.Selected scope.
   • With that token, the app can call Graph or SharePoint APIs against only the permissioned list.
4. How this avoids broader scope
   • Selected scopes (*.Selected and *.SelectedOperations.Selected) give no access by themselves. Access is granted only where an explicit permission object exists (for example, on that single list).
   • Without a POST /sites/{siteId}/lists/{listId}/permissions assignment, the app has no access, even though the scope is consented.

This works the same regardless of whether the list is on the root site or a subsite; the key is using the list’s siteId and listId and assigning a read role only to that list.

References:

• Overview of Selected permissions in OneDrive and SharePoint
• Understanding Resource Specific Consent for Microsoft Graph and SharePoint Online