Microsoft 365 Community SharePoint, 7 Jul 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Microsoft Graph “Sites.Selected” permissions within SharePoint Online

Description

In this 18-minute developer focused demo, Pankaj Surti shows viewers how to access SharePoint resources using a headless account without granting full permissions site access. Learn about Access Control Service (ACES) and its retirement, using PowerShell and the new Sites.Selected MS Graph permission for granular site level access, and how to automate and govern the granular access of sites with the Sites Selected Request Tracker (SSRT) tool that triggers actins in Logic Apps. Step-by-step tool usage explained/shown herein. This PnP Community demo is taken from the Microsoft 365 & Power Platform Development Community call recorded on July 7, 2022.

Demo Presenter
• Pankaj Surti (Microsoft) | @pankajsurti

Supporting materials
• Article - How does the MS Graph “Sites.Selected” permission work for granular permissions for SPO sites? | https://pankajsurti.com/2021/12/15/how-do-sites-selected-work-for-granular-permissions-for-spo-sites/
• Article – How to automate and govern the “Sites.Selected” permissions using a custom tool? | https://pankajsurti.com/2022/01/16/how-to-automate-and-govern-the-sites-selected-permissions-using-a-custom-tool/
• Article - Controlling app access on a specific SharePoint site collections is now available in Microsoft Graph | https://devblogs.microsoft.com/microsoft365dev/controlling-app-access-on-specific-sharepoint-site-collections/

Learn more
• Microsoft 365 Unified Sample gallery - https://aka.ms/m365/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/m365/videos
• Microsoft 365 Platform Community - http://aka.ms/m365/community

A

I am going to talk focus only on the site selected, ms croft site selector permission, and that is what I am going to talk about. Just just a little bit about me.

A

I work as a senior consultant in modern work domain in microsoft and my expertise is a design, architect, development and azure and I'm a big fan of this community. I attend this community many times and- and I have a lot of my fans here- I'm a big fan of a few of the presenters here. So so what is access control system? So basically, what this agenda is about accessing sharepoint content or sharepoint list or libraries using headless account.

A

What we have used in past and what my customer has used in past is access control system, which is retired, and I will point to the west as blog post as well. The retirement was it in 2018 and the better way to do this is using the site selected, miscrop permission prior to site selected. We used to give full permission, which was not a good thing to have have, because then that particular app has access to everything, but site selected allows you to do the granularity.

A

When I did that, I explained them my customer about the site selected how it works. uh They said it's a lot of work for the admins, so I have proposed to them some proof of concept on automating and governing this as using the tracker, uh this particular site selected, and that is what I'm going to show. So these are my three points and I'll demo it uh and if you are not aware this is this is a slide here. This is this. This group is a sharepoint group.

A

We used to do approach new app revenue and then you select the client id and client secret, and then you provide the access to site or web or a list using app inv, and there is a special xml file, I'm not going to get into details of that, but this is retired. It is working as if now it is working and it will work, there is no thing mentioned that it will not work for now, but the better or recommended approach is using the sites selected.

A

So what was my customer need was that they needed a site under around 200 sites, access using client, id and client secret, which would have made things worse because they would have to create one-on-one, acs, app and client secret for entire all these site collections, and that is not a good thing to do so. The better approach would be to use the site selector and what site selector does. Is it allows application to access subset of sites and site collection uh without signed in user? As I said, it's without any logged in user.

A

So that's that's the. That is what is required and uh in the in the graph api call.

A

You have the api's rest api, as shown in the screen right now, but what I have used is I've used the pnp powershell commands and that in turn called the similar rest api, which is shown here, and it is showing only the current operation, but it's only the create operation, but there is read and write operations as well and and list operations, so that is get and put right so that all this thing is already uh coded in the pnp powershell. So I have used that uh to show them how to use this particular permission.

A

So, to use this permission you will need two azure id app one azure id app will be sites.fullcontrol.all, and this particular azure id app will be only allowed by the admins to provide the granular permission using the second app. So there will be two apps. The client who are going to write program against will be using the second azure area and that azure id app will be either allowed one or many site collection and it can be read or write.

A

So there are the two grant permission you can provide and my demo will not be any ui or anything just the powershell commands in that powershell command. What I have to do is using the uh using the connect pnp online using the first azure id app, which is the admin app I would connect and then, after that, I would create grand pnp azure id app permission, app site permission call and that will allow me to add a write or a read permission for a site which is applied.

A

So I would add, if it is 200 sites, I would run 200 times, grant permission for write and that particular azure edu app will have only 200 sites access, not entire time. That's the beauty of this particular permission. Now I am going to share. What I have here is on my demo tenant. I already have azure id app, which is the first app. I talked about called admin app and this admin app. Has this permission?

A

As I said in the slide deck, it has an site select sites, dot, full control all so this is required and this particular app will be only accessible by admins, who will be providing access using the sites for the site selected and I've used the best practices way. Basically, I've created a a certificate rather than client secret. uh I it was just a test, but I'm using the certificate and using certificate.

A

I will get an access token and then, after getting the access token, I will add a permission for a site for this particular tenant at a test site to read list or write into the library and then the second app which I have taken second app I have is the app which is the app the client will use the programmer. Will user developer will use? You do not want to share with them them the admin app, but you share them the client app and that client app.

A

As I said in the slide that will have api permission for site selected, I have provided for both sharepoint as well as graph, because sometimes pnp uses sharepoint api sometimes uses graph api. So I just gave them both of them, and this is what I would add now, let's assume that this is the app which we want to use to connect first, and I still have time for finishing my demo, uh so I am going to connect to this app, which basically gave me the connection right.

A

I and then I am going to say, hey get me on the list of this app and, as you can see, this particular app id having this app id and secret, or your secret rs or a pfx file doesn't give you automatically permission to that particular app or you cannot just immediately access that particular site.

A

Admin has to do one more extra step, and that is where I am here on the admin script in the admin script, I'm connecting using the admin app id and obviously I have password and which is hidden somewhere down on the right side. But what I'm going to do is I'm going to run this and connect to the admin app? Okay, after connecting to admin app, I have some of the power shell commands. Pnp powershell commands, which is I just, did the gcn on it, and those gcn is showing me get grant revoke and set.

A

Obviously grant is post call get. Is the list call and the revoke is the delete call and the set is the put call or update call in the ms crop point of view. If you see the documentation, that's what behind the scene, uh this particular pnp powershell commands does so what I'm going to do here. I just did the I just did the connection to the admin id app and then I'm going to say. uh Okay, then I'm going to initialize some client variable. I did not do so.

A

So let me initialize that and then now I'll say, hey get me all the permission for the site called test one and for this particular client app id and as I as you can see here, I have none. I have not granted anything yet so I'm going to say, hey grant this permission and when it is granting the permission it is giving the permission for the lead, as you can see here so now.

A

If I go back to my client demo and I will connect to client again and just because the context has switched down me so now I connected so what happened here is I connected the client id and now I will say, hey get me all the list within that particular site collection, and I do get that, but let's try adding something into it and when I try to add it, the granular permission is such that I just said: hey, it's only read permission. This is access denied.

A

So if your customer or if your developers want that right permission, what you would do is again I have to do this thing for the demo purpose. I have to connect to the pnp online connect pnp online because my contacts switched and I I probably have the same variables. I just apply anyway, and I will say, get this permission and when I get this permission, I get this permission object as you can see here. This is the permission object.

A

It has a role which is not showing, I think it's a bug in the pnp or I don't know where it is, but maybe it is a graph, but this is the app which is having an access now, instead of granting the permission as a read, what I'm going to say, hey now make change to from read to right. So that's what I'm going to run and when I run that I do get that object again and roll is showing me as right once that is done.

A

What I can do, I can go to demo script again and I say: connect pnp online and, let's see my get, call works.

A

That will work because it's just right now it is, and now we will try to write something into the list and when I write to the list and a list is called test1 and the site is also called plus one. So I should have something in the list. So that is what I just added seven seven yesterday I was testing something so that is uh that is that now, for some reason you want to have that particular uh permission taken away.

A

The last thing is, I would do uh what I would do is just go into the admin app again and and then run this thing again and I will say, get me the permission.

A

I got the permission object then. I will say revoke this permission.

A

So having now uh app id and app secret for the client for the developer, this is revoking the permission right. So now we are back to square one when we started this, but wait a minute so off. After all, this demonstration uh admin admins were saying there is too much work for them if they want to do 2000 sites. What happens then? So that's where I have written the blog post and you should be able to see my blog post in the blog post one I have.

A

I just demonstrated what I was just demonstrating about all the demo scripts. It is right here and then my blog post tool is where I have defined architecture. Where you have a tracker, the tracker is tracking about all your apps and what kind of sites you are giving permission to? There is a logic app which is always listening to this particular tracker.

A

App once that particular logic app defines what what this particular user wants to do, whether you want to give a read or write, access or grant or revoke and accordingly azure function will do the job for you, for that particular admin, and they can do so so now, let's, let's do the same thing. What I've did with with that.

A

So I'm going to provide this particular list as an item saying here, let me go and click the list site name so site url, so I'll provide the site, url and then app id, and this particular app id is basically a lookup list and I'm providing an app id. And I'm saying I want to provide a read access: let's, let's provide the right access right away and I want to grant first time and what happens here is behind the scene. The logic app is working here and logic.

A

App is going to pick it up every one minute. This logic app is working and it will pick it up in us in a minute and there is a azure function behind the scene and I will show the code and the code is also shared on my blog post. If you go to my blog first, it is there. So what I'm going to do here is I'm going to click on this logs.

A

So you will see the logs what is happening here and it should be running now in a minute it takes 30 seconds or so so.

A

Okay come on. Okay, it should be there. It is so it started ready what it did. It item added all right to modify event it picked up and then what it does is it formulates the json input, information for the azure function. What azure function does- and this is this- is the similar uh where it is okay there it is so this is the json object.

A

It creates whether you want to revoke or whether you want to write or read operation and which site url and what is the client id that is passed and that is passed through that particular list and if I go to here as you can see, this particular azure function ran when I was sharing other screen and it did the thing which I did show you in the powershell ise. So live. We revoke that permission.

A

If you remember right so what I did I revoked the permission now, let's see whether it has the right permission or not so hopefully I'll go to demo client and then I'll connect to the client. Okay, I connect to the client and then I say hey.

A

Let me see so I'm back again, and I am able to uh add this so now what the point I'm trying to make here is now, if I want to have more sites or more sites for this particular app id, I can keep on adding that without writing this function, and on top of that, if I want to say revoke a permission for a particular site for this particular app, all they have to do is click on it and just say revoke and the function behind the scene.

A

The function will revoke it as well as uh it as well as it will revoke, and it will uh delete an entry from here. So, for example, if I have let's say 200 sites here- and I just wanted to remove one side and revoke that permission for that particular site, I can do so and that will be done in a minute. So let me refresh the screen again.

A

Let's go to run history again and refresh.

A

So there is a timer for one minute uh and it just item modified event comes in and it changes it. So let let me while that is doing, uh I am going to just walk through the function uh logic app here, which is very simple. uh I'm just checking whether uh grant or revoke I need to do or I need to read or write accordingly, I will formulate a json object right, so I'm just doing that.

A

I'm checking and after checking that I in the body function, I create an action whether it is a read, sorry grant or revoke the client app id is already passed to me in the in the item itself. uh Display name of the app is plus password me and then read or write is passed to me and site. Url is also passed to me and I have one more minute. I think, and I think I should be that particular thing should be revoked now.

A

So if I go back here and here so as you can see, this permission is now revoked. So if I go back to the function app and now I do click on it and then I say get me the list, it will say 403, so that is what revoked and and the engine just last last point.

A

Engine is very simple, very simple it just it just does the if condition if it's just the path of revoke and revoke and grant and if it is already granted, if it is read, then do the right if our user has asked for right and things like that says very simple code, but that's pretty much it from my side back to you, david awesome. Thank you. Pankaj. That's really really innovative. The way you set that up.

A