Microsoft 365 Community Transform SharePoint Add-in model solutions to modern development patterns, 30 Mar 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Understanding Resource Specific Consent for Microsoft Graph and SharePoint Online

Description

This module introduces you to the Resource Specific Consent authorization model of Azure Active Directory and SharePoint Online. You will learn how to rely on the Sites.Selected application permissions in order to consume SharePoint Online with an application only Access Token with permissions limited to selected list of Site Collections.

This video is part of a series in a playlist about "Transform SharePoint Add-in model solutions to modern development pattern": https://www.youtube.com/playlist?list=PLR9nK3mnD-OXJLA29Q0Xk7psbAUqzQZwe

➡️ Next video on this series - https://www.youtube.com/watch?v=a1snL_hc94k&list=PLR9nK3mnD-OXJLA29Q0Xk7psbAUqzQZwe&index=11
⬅️ Previous video on this series - https://www.youtube.com/watch?v=jNKX6qos8ZI&list=PLR9nK3mnD-OXJLA29Q0Xk7psbAUqzQZwe&index=9

#Microsoft365 #AzureAD #MicrosoftGraph #SharePointREST #ResourceSpecificConsent #RSC #SitesSelected #SharePointOnline

In this video, you will learn about

- Permissions for SharePoint Online in Azure Active Directory
- Resource Specific Consent for SharePoint Online
- Sites.Selected application permission scope

📖 All guidance content including code samples can be found here: http://aka.ms/sp/add-in/modernize/samples

✨ Presenter
• Paolo Pialorsi (PiaSys.com)

📃 Agenda
0:00 Introduction
1:52 Granting selected permissions
2:34 Demo
3:36 Certificate authentication for application only Access Tokens
4:48 Granting selected permissions
7:18 Consuming SharePoint Online with Sites.Selected permissions

📝 Learn more
• YouTube playlist for this video series - https://www.youtube.com/playlist?list=PLR9nK3mnD-OXJLA29Q0Xk7psbAUqzQZwe
• Permission resource type - https://learn.microsoft.com/en-us/graph/api/resources/permission?view=graph-rest-1.0
• Controlling app access on a specific SharePoint site collections is now available in Microsoft Graph - https://devblogs.microsoft.com/microsoft365dev/controlling-app-access-on-specific-sharepoint-site-collections/

💡 Learn more about the Microsoft 365 & Power Platform community
• Microsoft 365 Unified Sample gallery - https://aka.ms/community/samples
• Microsoft 365 & Power Platform Community in YouTube - https://aka.ms/community/videos
• Microsoft 365 & Power Platform - http://aka.ms/community/home

Sharing is caring! You are awesome! 🧡

A

A

Specific consent, permission for SharePoint online and Microsoft graph initial active directory. We have an application permission, called site dot selected that we can configure for micrograph and SharePoint online, and when you do that for SharePoint online, you need to get an access token, with a certificate authentication against Azure active directory. This permission for application is really useful whenever you want to have a set of permissions restricted to a specific site or set of site Collections and not to the whole tenant. Just to make an example.

A

It is something like what you used to do with the Azure access cardboard service when you registered an application in a Dean built with initial pointed in model just with permissions for a specific site collection. Nowadays we decide dot selected permission. You can do the same without relying to Azure ACS, but just relying on each directly directory and open authorization, and you don't need anymore to provide the size.fullcontrol.all permission to your Azure active directory registered applications in order to being able to have access to a specific set collection with the elevated privileges.

A

Whenever you do that, you will require a global administrator or someone with designs.fullcontrol.all or an application with those permissions to Grant the selected permission to the Target site, indeed that the requirement, otherwise it would be an hack. So when you use the scithe.selected permissions, you need to Grant those permissions to a specific Target site collection, either using a micrographing point or using PMP Powershell. Then you can simply use system or SPO rest and you can consume SharePoint and why consuming SharePoint? You can configure the selected permission as read, only write manage or full control.

A

This is a really powerful capability and let's move to the domain variant, to see how to use it in practice in Azure, active directory I registered an application in order to show you how the resource specific consent works. This application is configured with certificate authentication, as well as with client secret I have configured certificate authentication because, as already said from a SharePoint online point of view, if you want to consume SharePoint online with application only token, you need to authenticate using an x509 certificate while decline secret can be used.

A

The one you want to rely on Microsoft graph in the API permission section for this application: I simply have the size.selected application permission for graph and decide the selected application permission for SharePoint and you can find them by clicking on micrograph application permission and then you search for sites and you will find site dot selected and the same applies a for SharePoint. So, first of all, how can you create a certificate for certificate authentication?

A

Well, you can rely on the PMP Powershell commandlets and you can use the new PMP Azure certificate, which allows you to create a certificate to save the certificate as a pfx, with private key and as a DOT Sir with just the public key, and you can specify a password for your certificate. So by doing that, you will get back a certificate that you can upload from right. Here. You click on certificate.

A

You upload the public key, so the dot sir file and you are done and then, of course, you will also have to store in a safe place, the private key of your certificate. So now, let's say that we want to use this application to access a Target site collection with a selected permission. So I don't want to give the permission to see all of the site collection to this application, but I simply want to Target a specific set collection or a specific set of site collections.

A

So here I have in SharePoint online one set collection, which is called the site selected granted site and another one, which is the site selected, not granted site. What I'm going to do here in the graph Explorer is to show you that, right now, from a permissions point of view in this target site, I will query the permissions and I don't have any specific permission assigned to this set collection.

A

This is the endpoint that you can use in micrograph to read or assign permissions to an app whenever we have, as the size, dot selected application permission granted so now, I want to use the PMP Powershell command lens, to connect to the site selected granted site and to Grant a specific permission to my application. So first of all, I will connect to the Target side. Let's do that run, selection and now I'm connected.

A

If I will do a get PMP Azure ID upside permissions, we can see that right now as like as it was with graph Explorer, we don't have any permission specific permission granted to any application, but by using the grand PMP Azure ID up site permission, commandlet, providing the ID of the application that we have in Azure active directory.

A

So this is the application ID that we have right here and by providing a display name for this permission, Grant the target URL of the site and a permission that we want to provide, for example, the right permission. We will be able to Grant to that application. So let me run the selection again. We will be able to Grant to that application. A specific permission.

A

This will be the unique ID of the permission that was granted to my application and, if now I will make one more time a get of the permissions, we can see that now we have one permission now. You can also use the set PMP Azure ID upside permission, providing the unique ID of the permission that you want to update and providing the new permission, which can even be full control. So if I will do that, f8 to run the selection I, now Grant it full control, compare with the right permission that I granted initially now.

A

My application can only have full control targeting this specific selected site collection. If I will Target any other set collection, my application will not have any access permission. Okay, so how can we test it? Well, however, an application based on.net framework through which we can try to access a Target site, collection and right here. This is a console application with dependency injection in place.

A

I have a consume, SPO selected site via graph, which I will try to use targeting a site where I have granted the permission and which I will try targeting a site where I have not granted the permissions to see how the behavior will change and we do the same with SharePoint online via season instead of graph, so that you can also see how it behaves when you use season. So the consume SPO selective site via graph is a really simple method.

A

We can dig into it, so we can see what's inside of it and we can see that we simply use a client's secret credential object to authenticate with Microsoft graph SDK to get access to the site that we have in Target. So we say graph, client, dot size and we get a site by path and we try to create a new list in the Target site.

A

You see, we create a new list, object of micrograph SDK and then we add asynchronously the new list and of course, if we can successfully at the list, it means that we have proper permissions.

A

If not, it means that we are not granted the permission to work targeting that site and the same logic, but with season is in the consumers peer selected site by a season where we get through the PMP framework, Library the authentication manager and we use the create, with certificate method of the authentication manager of PMP framework to get a season client context for providing the x509 certificate to authenticate against Azure ID.

A

And then we see if the current user is an admin or not just for the sake of it, and then we try to create a new instance of a list still using season as like, as we did with graph, but now using system, and we execute the query and again if it will be successfully created, it means that we have proper permissions. If not, we will get a failure and we will see what the behavior will be.

A

So let me execute this application now that we have the permissions granted to the first side that I showed you so Ctrl F5. This is the console application running. As you can see here, I start the application. I start consuming the site selected granted site with selected permission via micrograph and I can successfully add a list to the site, and we will see the list shortly.

A

Then, when we try to do the same with the site selected, not granted site, we will get an access denied, because the current application does not have access to the site not granted side, and the same applies for season. So when we try to use season to create a list that we successfully do that targeting the site where we have got the permissions granted and we fail, and we cannot create the list in the other side and we get an attempt to perform in an authorized operation.

A

If I will go back to my SharePoint site, we can go to site contents and we can see that right here we have the generated via micrograph and degenerative biasism lists in this site selected with granted permissions, while in the site contents of this site. We don't have any list because we were not able to create such a content.

A

Of course, if you want to later on get rid of the permissions, you can also use the revoke PMP Azure ID up site permissions, providing the permission ID and you will be able to remove the permission and revoke the grind. This is a really powerful capability, because you will be able to Target just specific site collector with application only without the need to have any more decide, dot, full control, dot all permission that we used to use in the past in application only to consume SharePoint online size.

A

Here you can see additional links if you want to dig into the topic covered and like always, thank you for watching this video foreign.