SharePoint Setup on Microsoft Entra ID

1. Create Multi-Tenant App (One-Time Setup)

Step 1: Register App

• Go to: Microsoft Entra ID

• Navigate to:

• App registrations → New registration

• Fill details:

• Name: YourAppName

• Supported account types: Accounts in any organizational directory (Multi-tenant)

• Redirect URI: (optional for app-only)

• Click Register

---

Step 2: Capture Required Values

After creation, copy:

• Application (Client) ID

• Directory (Tenant) ID

• Client Secret (create new client secret under Certificates & Secrets)

---

Configure API Permissions (Application Permissions)

Go to: API Permissions → Add Permission → Microsoft Graph

Add:

Required Permissions:

• Sites.Read.All (Read access)

• Sites.ReadWrite.All (Write access)

Choose Application Permissions (NOT Delegated)

---

Step 3: Grant Admin Consent

Click: Grant admin consent

This is required for your home tenant only

---

Multi-Tenant Client Onboarding (Important)

Each client tenant must authorize your app.

---

Admin Consent URL (Recommended)

Send this URL to client admin:

https://login.microsoftonline.com/{client-tenant-id}/adminconsent?client_id={your-client-id}

Example:

https://login.microsoftonline.com/common/adminconsent?client_id=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

What happens:

• Client admin logs in

• Accepts permissions

• Your app is now trusted in their tenant

---

Enterprise App Auto Creation

After consent:

• Your app appears in: Enterprise Applications in client tenant

---

Step 4: Generate Access Token (Client Credentials Flow)

Use:

POST https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token

Body (x-www-form-urlencoded):

client_id=YOUR_CLIENT_ID client_secret=YOUR_CLIENT_SECRET scope=https://graph.microsoft.com/.default grant_type=client_credentials

---

Step 5: Access SharePoint Sites

Now you can call:

GET https://graph.microsoft.com/v1.0/sites

or

GET https://graph.microsoft.com/v1.0/sites/{site-id}

---

Problem: Shows ALL Sites?

Yes — by default:

Sites.Read.All gives access to ALL sites in tenant

---

Step 6: Restrict Site Access (IMPORTANT)

To limit access to specific sites only, use:

Sites.Selected Permission

---

Change Permission

Instead of:

Sites.Read.All

Use:

Sites.Selected

---

Grant Site-Level Access via API / PowerShell

Now your app has NO access by default You must explicitly assign access per site.

---

Using Microsoft Graph API

POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions

Body:

{ "roles": ["write"], "grantedToIdentities": [ { "application": { "id": "YOUR_CLIENT_ID", "displayName": "Your App Name" } } ] }

---

Using PowerShell

Using Microsoft Graph PowerShell SDK:

Connect-MgGraph -Scopes "Sites.FullControl.All" Grant-MgSitePermission ` -SiteId "SITE_ID" ` -Roles "write" ` -ApplicationId "YOUR_CLIENT_ID"

---

Step 7: How Your App Should Work (Architecture)

Your Flow:

• Store:

• TenantId

• ClientId

• ClientSecret

• When user selects tenant:

• Generate token dynamically

• Call Graph API

• Fetch:

• Sites

• Drives

• Files

---

Step 8: Show Only Allowed Sites in UI

Since you're using Sites.Selected, you can:

Step 9: Testing via Postman

• Get Token

• Call API

Example:

GET https://graph.microsoft.com/v1.0/sites Authorization: Bearer <token>

---

Step 10: Common Issues

Issue	Reason	Fix
403 Forbidden	No site permission	Grant via API
No sites returned	Using Sites.Selected but not assigned	Assign sites
All sites visible	Using Sites.Read.All	Switch to Sites.Selected
Consent error	Admin not granted	Use admin consent URL

---