Introduction
SharePoint Online is a powerful tool for collaboration and document management, and its API capabilities extend its usefulness even further. However, configuring API permissions, especially Site. Selected API permissions, can be intimidating for those who are new to it. Not to worry! In this guide, we'll break down everything you need to know about configuring a Site. Selected API permissions in SharePoint Online, making it simple and easy to understand.
What are SharePoint Online API permissions?
SharePoint Online API permissions are settings that allow third-party apps to access your data within SharePoint Online. These permissions make it possible for apps to perform various actions, such as reading or writing data, depending on the permissions granted to them.
Understanding Sites.Selected permission
Sites.Selected Permission in SharePoint
The Sites.Selected permission is a specific type of API permission within SharePoint Online. Unlike more general permissions, Sites.Selected grants access to specific site collections rather than across all site collections in a tenant. This makes it a highly secure and efficient way to control access.
Purpose of Sites.Selected Permission
The primary purpose of the Sites.Selected permission is to provide controlled access to specific sites. This is particularly useful when you want to grant limited access to third-party applications without exposing all your SharePoint data.
How to Configure Site.Selected API Permissions in SharePoint Online?
Step-by-step guide to Configure API permissions
- Register your application in Azure AD
- Go to the Azure Active Directory portal.
- Navigate to "App registrations" and click "New registration."
- Fill in the necessary details and click "Register."
- Add the Sites.Selected permission.
- Navigate to "API permissions" in your newly registered app.
- Click "Add a permission," then choose "SharePoint."
- Select "Delegated permissions" or "Application permissions," and then look for "Sites.Selected."
- Add the permission.
- Grant admin consent
- After adding the Sites.Selected permission, click "Grant admin consent for [Your Organization]."
Configuring Permissions using PnP PowerShell
PowerShell is a powerful scripting language that can also be used to configure SharePoint Online API permissions effortlessly.
- Install PnP PowerShell
Install-Module -Name PnP.PowerShell
- Connect to SharePoint Online
Connect-PnPOnline -Url https://[yourtenant].sharepoint.com -UseWebLogin
- Grant Sites.Selected Permission
$siteId = (Get-PnPTenantSite -Url "https://[yourtenant].sharepoint.com/sites/[yoursite]").Id
Grant-PnPAzureADAppSitePermission -AppId "[YourAppId]" -Site $siteId -DisplayName "My App" -Permissions "write"
- Verify Permission Granted
Get-PnPAzureADAppSitePermission -Site $siteId
Common Issues and Troubleshooting
Receiving a 403 Forbidden Error
If you're getting a 403 Forbidden error after configuring Sites.Selected, there are a few common reasons why this might be happening.
- The app may not have been granted admin consent.
- The user does not have sufficient permissions themselves.
- There might be discrepancies in the site URL or configuration.
Double-check the settings and configurations to resolve these issues.
Granting Admin Consent for Site.Selected Permissions
If you're an admin and need to grant consent, follow these steps.
- Go to the Azure Active Directory portal.
- Navigate to "App registrations."
- Select your app, go to "API permissions," and click "Grant admin consent for [Your Organization]."
Conclusion
Configuring Site.Selected API permissions in SharePoint Online may seem complex, but with this guide, you're well on your way to mastering it. With the steps outlined here, you can ensure that your third-party apps have the specific permissions they need, without compromising the security of your SharePoint data.
FAQs
1. What are Site.Selected API permissions in SharePoint Online?
Site.Selected API permissions allow third-party applications to access specific SharePoint Online site collections instead of granting access to all site collections.
2. How do I configure Site.Selected API permissions in SharePoint?
You can configure Site.Selected API permissions by registering your application in Azure AD, and adding the Sites.Selected permission, and granted admin consent. You can also use PnP PowerShell to configure these permissions.
3. What is the purpose of the Sites.Selected permission in SharePoint?
The primary purpose of the Sites.Selected permission is to provide controlled access to specific site collections in SharePoint Online, enhancing security and management efficiency.
4. Why am I receiving a 403 Forbidden error after configuring Sites.Selected?
This error typically occurs due to issues such as the app not having admin consent, the user lacking necessary permissions, or discrepancies in the site URL or configuration.
5. How to grant admin consent for Site.Selected permissions in SharePoint?
To grant admin consent, navigate to the Azure Active Directory portal, go to "App registrations," select your app, then go to "API permissions," and click "Grant admin consent for [Your Organization]."
Aman PanjwaniPosted Sep 5, 2025, 7:24 AM
Hi, I’ve added the same Sites.Selected delegated permission to the App Registration for SharePoint. However, when I generate a token using device code flow and try to query the site, I get an “Access Denied” error. I verified that the Graph permission for that SharePoint site is set to Write and has been granted. The permission is also Admin Consented, and the delegated user is a SharePoint Admin, but I’m still seeing the same issue. Could you please help me troubleshoot this?