How to scope permissions to a Sharepoint subsite using Graph API

No. In Microsoft Graph, Sites.Selected scopes access at the site collection level, not at the SharePoint subsite level.

The supported Selected scopes in the provided documentation are:

• Sites.Selected for a specific site collection
• Lists.SelectedOperations.Selected for a specific list
• ListItems.SelectedOperations.Selected for specific files, list items, or folders
• Files.SelectedOperations.Selected for specific files or library folders

That means there is no Graph Selected scope in the provided documentation that grants app access to a subsite as a distinct boundary below a site collection.

For Sites.Selected, the documented grant endpoint is:

• POST /sites/{siteId}/permissions

The SharePoint guidance also states that Sites.Selected grants explicit permissions for the selected target sites/site collections, and the permission roles are read, write, manage, or fullcontrol.

What can be confirmed from the documentation:

1. Sites.Selected is the site-collection-level option.
2. The finer-grained Graph Selected scopes are list, list item, folder, and file based.
3. No subsite-specific Selected permission is described.

Given the requirement to read a subsite and its child subsites, the provided documentation does not show a Graph API mechanism to assign one permission to a subsite tree. The only documented finer scoping options are per list, list item, folder, or file, which would require explicit assignment at those resource levels.

If the site owners cannot allow access to the whole site collection, the documented Graph options in the provided material do not provide a subsite-scoped equivalent to Sites.Selected.

References:

• Overview of Selected permissions in OneDrive and SharePoint
• Understanding Resource Specific Consent for Microsoft Graph and SharePoint Online