Scenario

You are a software developer. Your company uses Microsoft Office 365 (SharePoint, Teams etc.). The need is to work with a specific site collection programmatically (from code – Python, C#, Java, PowerShell, JavaScript etc.) – e.g. upload/download documents, update list items, search etc.

The code must run without user interaction (unattended, aka daemon app). Sometimes this is also called “SharePoint Automation”.

The solution is based on a new Graph API feature – Sites.Selected and a classic SP-Only app.

Solution

1. Register an Azure App and configure it as usual.
   Select API Permissions blade and add two permissions:
   – Microsoft Graph -> Applications Permissions -> “sites.selected”
   – SharePoint -> Applications Permissions -> “sites.selected“
2. Request “Grant admin consent” from a tenant/global admin
3. Request SharePoint admin to run PowerShell code (e.g. this one) to assign proper permissions to your azure app for a specific site collection (consider site owner consent)
4. (optionally) Provide SharePoint API permissions:
   (require Site Collection Owner/Admin account) – use
   https://YourTenant.sharepoint.com/teams/YourSite/_layouts/15/appinv.aspx
   to add SharePoint API permissions to your app. E.g. full control permissions to site collection would be

<AppPermissionRequests AllowAppOnlyPolicy="true">  
   <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" 
    Right="FullControl" />
</AppPermissionRequests>

Consider minimal permissions (e.g. Right=”Read” see more with Sumit)

Problem Solved

• you get access to one and only one site collection (“least privilege” principal)
• you get both – SharePoint API and Microsoft Graph API permissions to SharePoint
• you can use app secret or certificate to authenticate – depending on what are your security requirements

Note: if your scenario require authenticated user present – the solution would be a little different: Connect-PnPOnline Interactive with Client App Id

Update:

Sites.Selected API MS Graph permissions was introduced by Microsoft in 2021. It was a huge step forward, but still devs were limited with MS Graph API against SharePoint.
So devs had to use AppInv at site level to provide ACS permissions to their apps to use SharePoint CSOM and REST APIs.
Recently Microsoft introduced Sites.Selected SharePoint API permissions for registered Azure Apps! So now devs should be fully happy without ACS-based permissions AppInv.aspx. (See more here on disabling SP Apps Only SPNs)

Thanks to Leon Armston and Scott Murdock

Update 2:

Microsoft announced end-of-life for ACS permissions, so we’d need to avoid ACS permissions for new development.

References:

• Register an application with the Microsoft identity platform
• Controlling app access on a specific SharePoint site collections is now available in Microsoft Graph
• Working with SharePoint sites in Microsoft Graph
• SharePoint Add-In — Permission XML cheat sheet
• Accessing SharePoint using an application context, also known as app-only
• Connect-PnPOnline Interactive with Client App Id
• Disable Custom App Authentication