Best way for an application to call Microsoft Graph against a SharePoint site in another organization's tenant?

This implies a multi-tenant Entra ID app. Because legacy SharePoint-only credentials, such as Azure ACS appregnew.aspx, are fully retired, use the standard Microsoft Entra ID application permissions model tied to Microsoft Graph API.

To protect your partner's security, configure this via the Sites.Selected permission workflow. This ensures your background service only has access to that specific single partner site, rather than their entire corporate tenant.

You own and configure the application identity so:

1. Register the Application: Navigate to the Microsoft Entra Admin Center in your own tenant and create a New Registration.
2. Enable Multi-Tenant: Under "Supported account types", choose "Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)".
3. Configure Graph Permissions: Go to API Permissions > Add a permission > Microsoft Graph > Application permissions and select Sites.Selected.
4. Generate Credentials: Go to Certificates & secrets to configure authentication. While client secrets work over Microsoft Graph, using a certificate is recommended by Microsoft for multi-tenant, unattended production workloads.

Your partner would need to trust your application and grant it permission to their specific site. Send the partner's Global Administrator a custom onboarding URL. When the partner admin opens this link and logs in, they will see a prompt asking to trust your app. Clicking Accept should provision your application as a Service Principal inside their tenant's Enterprise Applications.

By default, your app has Sites.Selected but cannot access any sites yet. The partner would need to specify which site you can access. Their administrator needs to execute a Microsoft Graph POST request, using PowerShell or Graph Explorer, to grant your service principal permission to the specific site.

endpoint:

POST https://microsoft.com{partner-site-id}/permissions

payload:

{
  "roles": ["write"],
  "grantedToIdentities": [{
    "application": {
      "id": "YOUR_APPLICATION_CLIENT_ID",
      "displayName": "Your Integration Service Name"
    }
  }]
}

Now that permissions are active, your background service can request tokens and perform transactions.

import requests

# 1. Get an access token from the PARTNER'S tenant endpoint using Client Credentials
# Note: You MUST use the partner's Tenant ID (or verified domain) here, NOT your own.
token_url = f"https://login.microsoftonline.com/{PARTNER_TENANT_ID}/oauth2/v2.0/token"

payload = {
    'grant_type': 'client_credentials',
    'client_id': 'YOUR_CLIENT_ID',
    'client_secret': 'YOUR_CLIENT_SECRET', # Or use a Client Assertion Jwt if using certificates
    'scope': 'https://graph.microsoft.com/.default'
}

token_res = requests.post(token_url, data=payload).json()
access_token = token_res['access_token']

# 2. Interact with the allowed partner SharePoint Site via Graph API
headers = {'Authorization': f'Bearer {access_token}'}

# Example: Uploading a file into the target site's document library
upload_url = f"https://microsoft.com{PARTNER_SITE_ID}/drive/root:/YourFolder/file.txt:/content"
response = requests.put(upload_url, headers=headers, data="Hello Partner!")

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin