►
Description
In this 10-minute developer-focused demo, Paolo Pialorsi explains Sites.Selected permissions in SharePoint Online. The new Sites.Selected permission in AAD negates the need for ACS. Sites.Selected is an application permission for Microsoft Graph and/or SPO and allows Admins to grant Read or Write permission to the selected/targeted sites. Manage sites using Graph or CSOM/REST. PnP PowerShell can be used to Grant, Get, Revoke and Set AAD app permissions in Azure. Perfect for running an application in the background. This PnP Community demo is taken from the Microsoft 365 & Power Platform Development Community call recorded on June 9, 2022.
Demo Presenter
• Paolo Pialorsi (PiaSys.com) | @PaoloPia
Supporting materials
• Video - Sites.Selected Application permission for Graph and SharePoint APIs | https://youtu.be/mz4ye-AsUnY
• Documentation - Sites permissions - Application permissions | https://docs.microsoft.com/en-us/graph/permissions-reference#application-permissions-56
• Article - Controlling app access on a specific SharePoint site collections is now available in Microsoft Graph | https://devblogs.microsoft.com/microsoft365dev/controlling-app-access-on-specific-sharepoint-site-collections/
Learn more
• Microsoft 365 Unified Sample gallery - https://aka.ms/m365/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/m365/videos
• Microsoft 365 Platform Community - http://aka.ms/m365/community
A
Welcome
everyone:
yes,
now
we're
going
to
talk
about
how
we
can
use
the
new
site
selected
permission
that
we
have
in
azure
active
directory
in
order
to
access
sharepoint
online
content.
So
let
me
briefly
explain
you
what
the
context
is
and
then
I
will
move
to
the
demo
environment.
So
most
likely
most
of
us
were
used
to
use
the
uprig
new
page
to
register
through
acs
and
through
the
old
school
sharepoint,
adding
model
client,
ids
and
secrets
in
order
to
be
able
to
access
specific
site
collections
or
specific
content
with
specific
permissions.
A
A
We
can
select
the
site
collections
where
we
want
to
have
access
and
we
can
then
use
either
micrograph
and
the
microsoft
graph,
sdk
or
season
rest,
and
eventually
the
pmp
sdk
to
access
the
target
set
collection
by
selecting
only
the
set
collection
that
we
want
to
manage,
and
we
want
to
edit
in
our
solution.
So
how
does
it
work
and
what
do
we
need
to
do
in
order
to
satisfy
the
requirements?
Well,
first
of
all,
we
need
an
admin
to
grant
the
selected
permissions
to
the
target
application,
which
is
reasonable.
A
Otherwise
it
will
be
a
knack
of
the
tenant,
so
we
need
a
global
administrator
or
an
application
with
decide,
full
control,
dot
or
permission
or
a
site
collection,
administrator
or
the
psychologist
where
we
want
to
grant
the
permission.
The
selected
permission
for
the
target
app
when
we
do
that
we
grant
the
permission
using
a
graph
endpoint,
which
is
available
under
the
size
endpoint
followed
by
the
site,
id
slash
permissions
and
through
that
endpoint
we
can
grant.
A
We
can
revoke,
or
we
can
update
permission
grants
to
specific
applications
which
have
the
site
dot
selected
permission
configured
in
azure
active
directory.
We
can
also
grant
those
permissions
using
the
pmp
powershell
command
list
that
you
see
right
here,
so
grant
get
revoked
or
set
pmp
as
your
id
upside
permission
and
the
permission
that
we
can
grant
using
then
using
spo
season.
Rest
are
read,
write,
manage
and
full
control.
So
basically,
if
you
want
to
create
a
solution
which
will
run
in
the
background
with
application,
only
you
can
now
do
that.
A
Just
selecting
a
specific
set
collection
as
the
target
and
not
anymore,
being
forced
to
provide
the
permission
to
access
all
of
the
site
collection,
the
whole
tenant,
which
was
not
really
good
in
the
past.
So
let
me
try
to
show
you
how
it
works
through
a
demo,
and
so
I
always
reach
to
my
demo
environment
and
show
you
something
in
action.
So,
first
of
all,
here
we
have
an
azure
active
directory
application
registered,
which
I
pre-registered
in
my
environment.
A
We
have
our
client
id
and
we
have
the
client
sticker
that
we
can
use
to
access
with
our
app-only
token,
the
target
api
from
a
sharepoint
online
point
of
view.
If
we
want
to
access
sharepoint
online
with
uponly
mode,
we
need
an
x509
certificate
and
that's
why,
in
this
application
I
also
configured
a
and
now
to
generate
the
x509
certificate.
A
Then
I
created
for
the
sake
of
explaining
you
how
these
new
sites
selected
permission
work.
I
created
two
different
site
collections.
One
is
called
site
selected
granted
site,
meaning
that
this
is
the
site
where
I
explicitly
granted
the
permission
to
access
the
content
for
my
application,
and
then
I
have
another
one
which
is
called
site
selected,
not
granted
site,
which
is
a
set
collection
where
I
did
not
grant
the
permissions
to
my
application
so
that
we
will
be
able
to
see
that
we
can
easily
access
and
consume
the
content
of
this
set
collection.
A
But
we
will
not
be
able
to
do
the
same
against
this
one
because
we
are
not
granted.
We
didn't
have
the
grant
of
the
permission.
So
how
do
we
access
the
target
site
collections?
I
have
a
demo
which
is
built
using
dotnet
and
using
either
the
graph
sdk
or
the
pmp
libraries
and
first
of
all,
we
will
see
how
to
use
graph.
So
we
have
a
method
called
consume,
spo
selected
site
via
graph.
A
I
simply
provide
the
url
of
the
target
site,
so
I
can
so
that
I
can
use
it
twice,
targeting
the
the
good
one
and
the
bad
one.
So
the
one
where
I
have
the
grant
and
where
the
one
where
I
don't
have
the
grant
of
the
permission,
and
in
this
method
I
simply
use
msil
and
the
graph
sdk
to
access
the
target
environment.
A
So
I
say
that
I
want
to
get
for
the
specific
tenant,
client,
id
and
client
secret,
my
credentials,
which
I
will
provide
to
the
constructor
of
the
graph
service
client
in
the
graph
sdk,
so
that
I
can
then
say.
Okay,
give
me
the
site
collection
that
I
want
to
access
and
I
will
try
to
create
a
new
list
in
the
target
site,
because
I
want
to
show
you
that
I
can
manage
the
content
and
I
can
basically
be
the
admin
of
the
target
set
collection.
A
If
I
have
the
permission
granted
and
in
fact
I
can
get
a
new
list,
I
can
add
the
new
list
to
the
list
of
lists
that
I
have
in
my
site
and
I
will
be
able
to
do
that
in
the
granted
site.
Not
in
the
other
one
and
the
same
thing
can
be
done
also
using
the
spo
approach.
I
will
explain
you
the
code
and
then
run
the
application
at
once.
A
So
here
I
have
another
method
which
will
rely
on
the
pmp
libraries,
just
for
the
sake
of
simplicity
and
here
I'm
using
the
authentication
manager
that
we
have
to
create
a
client
context
of
pmp
so
that
we
can
use
the
externalized
certificate.
With
all
of
the
information
that
I
need
to
create
the
context
and
then
we
can
simply
say:
okay
load,
the
current
user
and
let's
see
if
the
current
user
is
an
admin
just
for
the
sake
of
showing
you
the
output
and
then
using
csm.
I
can
create
a
new
list.
A
Creation
information
object
and
I
can
add
it
to
the
list
of
sites
through
season
and
then
I
execute
the
query
asynchronous
using
the
pmp
framework.
So
let
me
run
this
application.
Let
me
show
you
the
output.
I
will
just
run
it
with
ctrl
f5,
and
here
I'm
dragging
the
ui.
So
here
you
can
see
we
start
consuming
the
site
where
we
have
the
granted
permission
here.
You
see
successfully
added
a
list
to
the
spo
site
with
selected
permission
and
using
graph.
A
A
So
I
can
access
the
site
where
I
was
granted
the
permission,
and
I
am
an
admin
of
that
site
and
I
cannot
access
the
site
where
I
don't
have
the
grant
of
the
permission
and
in
fact,
if
I
go
back
here
and
go
to
site
contents,
we
can
see
that
in
this
site
we
have
a
new
generated
via
season
generated
by
a
micrograph
lists
created
in
this
site,
while
in
the
other
one.
I
don't
have
any
list
created,
because
I
don't
have
the
permission
to
do
that.
A
So
how
did
I
grant
the
permissions
to
my
app
well
using
pmp
powershell,
which
is
the
easy
way?
In
my
opinion,
I
simply
connect
to
the
target
environment,
so
contact
pmp
online.
I
provide
the
url
of
the
site
and
eventually
the
credentials
in
with
whatever
technique
you
like
and
then
once
I
am
connected
to
the
target
site
and
I
simply
need
to
be
a
site
collection
administrator
of
the
target
site.
A
A
The
option
that
I
have
are
read
and
write
when
I
grant,
but
I
can
later
on
update
and
I
can
even
use
the
full
control
permission
so
that
basically
we
can
start
with
an
initial
grant
of
right
permission,
and
then
we
can
make
an
elevation
of
permissions
with
the
update
the
set
method,
the
set
command
sorry
and
we
can
configure
the
full
control
permission
so
that
we
don't
need
to
be
a
tenant
administrator.
We
don't
need
a
tenant
administrator.