Configure authentication and authorization

Applies to: Developer

Configure authentication and authorization before your SharePoint Embedded application calls Microsoft Graph or SharePoint Embedded APIs.

Complete Register application permissions first so the container type is registered in the consuming tenant.

Understand the access model

SharePoint Embedded uses two permission layers.

Microsoft Graph permissions allow the app to call SharePoint Embedded endpoints.

Container type application permissions allow the app to access containers of a specific container type.

Both layers are required.

Configure the Microsoft Entra ID app

Start with a Microsoft Entra ID app registration.

Configure it for your application type:

1. Register or identify the owning application.
2. Add redirect URIs for development and production clients.
3. Add credentials for app-only flows when needed.
4. Add Microsoft Graph permissions for SharePoint Embedded access.
5. Add the Microsoft Graph permission required for registration scenarios.
6. Ask an administrator to grant consent where required.

For general steps, see Register an application with the Microsoft identity platform.

Request Microsoft Graph permissions

SharePoint Embedded operations through Microsoft Graph require FileStorageContainer.Selected.

Use delegated FileStorageContainer.Selected for access on behalf of a user.

Use application FileStorageContainer.Selected for app-only access.

Application FileStorageContainer.Selected requires admin consent in the consuming tenant. Delegated FileStorageContainer.Selected does not require admin consent.

For administrative capabilities on behalf of an administrator user — such as enumerating, deleting, restoring, purging, and updating containers and managing their permissions across all governable container types in the consuming tenant — request FileStorageContainer.Manage.All.

Request the permission for registration

Container type registration uses the Microsoft Graph container type registration API in v1.0.

For registration, request the FileStorageContainerTypeReg.Selected Microsoft Graph permission (delegated or app-only).

For delegated registration calls, the signed-in user must have the SharePoint Embedded Administrator or Global Administrator role.

Use this permission with Register application permissions.

Prefer delegated access when possible

Use access on behalf of a user whenever possible.

Delegated access improves security, accountability, auditability, and alignment with the user's container membership.

When using delegated access, effective permissions are the intersection of application permissions and user container permissions.

The user must be a member of the container.

Use a confidential client application to keep your app in control of actions taken on behalf of a user. A public client application can expose user tokens to the end user, which can lead to actions taken outside your app's control. For more information, see Public client and confidential client applications.

Configure delegated token acquisition

For delegated calls:

1. Sign in the user with Microsoft identity platform.
2. Request delegated FileStorageContainer.Selected.
3. Confirm delegated consent is granted according to the consuming tenant's user consent policies.
4. Acquire an access token for Microsoft Graph.
5. Call Microsoft Graph SharePoint Embedded endpoints.
6. Verify the user is a member of the target container.

If the user isn't a container member, the app can't access that container on the user's behalf.

Configure app-only token acquisition

Use app-only access for service workloads that don't run as a user.

For app-only calls:

1. Configure an application credential, such as a certificate.
2. Request application FileStorageContainer.Selected.
3. Have a consuming tenant administrator grant admin consent.
4. Acquire a token using the client credentials flow.
5. Call Microsoft Graph SharePoint Embedded endpoints.
6. Limit container type permissions to the workload's needs.

Call Microsoft Graph APIs

After token acquisition, call SharePoint Embedded operations through Microsoft Graph. Useful references include:

• File storage container resource type
• Create fileStorageContainer
• Microsoft Graph authentication and authorization basics

Continue with Create and manage containers for lifecycle operations.

Handle operations not exposed through Graph

Some operations have exceptional access patterns.

These operations use exceptional access patterns:

• Container type management in the owning tenant through the Microsoft Graph container type API (FileStorageContainerType.Manage.All delegated permission).
• Container type registration in the consuming tenant through the Microsoft Graph container type registration API (FileStorageContainerTypeReg.Selected).
• SharePoint Embedded agent experiences through their own permission requirements.
• Search: Microsoft Search on SharePoint Embedded content requires the delegated Files.Read.All permission in addition to FileStorageContainer.Selected.
• Operations that require a user license: List containers returns 403 Forbidden for a delegated user who doesn't have a OneDrive (app-only calls aren't affected), and users need a Microsoft 365 license to appear in the Office @mentions people picker.
• Administrative actions on containers: FileStorageContainer.Manage.All requires the signed-in user to be a SharePoint Embedded Administrator or Global Administrator. For a non-admin user it grants nothing — if only Manage.All is granted, the app gets access denied; if both Manage.All and FileStorageContainer.Selected are granted, Manage.All is ignored.

Grant container type application permissions

The owning application grants container type application permissions through container type registration in a consuming tenant. These permissions determine what an application can do with containers of the container type.

Manage container type owners

Any Microsoft Entra user that isn't an external identity can be a container type owner. Owners are managed through the permissions navigation property on the fileStorageContainerType resource. Each entry has the owner role and identifies the user through grantedToV2.

• Automatic assignment: The user who creates a container type is automatically assigned as an owner.
• Add owners: Use POST /containerTypes/{id}/permissions to add up to three owners per container type.
• Remove owners: Use DELETE /containerTypes/{id}/permissions/{id} to remove an owner.
• Read owners: Use GET /containerTypes/{id}?$expand=permissions or GET /containerTypes/{id}/permissions to retrieve owners.

SharePoint Embedded Administrators can manage all applications created in the owning tenant and installed in the consuming tenant. Assign the least privileged role necessary; the SharePoint Embedded Administrator role is recommended over Global Administrator for these tasks.

Understand container permissions

Container permissions apply only to delegated access. An app that accesses containers without a user gets the full access defined by its container type application permissions instead.

Users get container membership in two ways:

• Direct membership — the user is added directly to a container with specific permissions.
• Transitive membership — the user belongs to a Microsoft 365 group that's a member of the container.

A user must be a member of the container with one of these roles:

When a user creates a container through delegated calls, that user is automatically assigned the Owner role.

To share individual items without granting container access, use the driveItem invite or permission create endpoints. Sharing an item doesn't grant access to the container or to any other item in it.

Validate authentication

Validate the flow before feature code:

1. Confirm admin consent completed successfully.
2. Acquire a delegated token.
3. Acquire an app-only token.
4. Call a simple Graph endpoint that matches the token type.
5. Confirm registration includes the calling app.
6. Confirm user membership for delegated calls.
7. Confirm app-only access is limited by container type permissions.

Troubleshoot authorization failures

Next steps

Use your configured flow to Create and manage containers.