# 🔐 Managing SharePoint with an Azure App using Sites.Selected Permissions ## Use Cases Why even go through this setup? Here's where this setup totally makes sense: * You want to **manage SharePoint without using personal credentials** (aka ditch the annoying login prompts). * You need to **upload, download, or tweak files** in SharePoint from scripts or automated jobs. * You want to build **automation workflows** that don’t ask you to "Sign in with Microsoft" every five minutes. > 🔍 *"Manage" means Read, Write, and even changing permissions* --- ## How Azure Permissions Work Before we dive in, let’s get our heads around two key types of Azure API permissions: * **Delegated permissions**: These require a signed-in user. Think **"act on behalf of a user"** — good for interactive apps. * **Application permissions**: These don’t need a user at all. Perfect for automation and backend stuff. Full freedom with the right consents. The key player here? `Sites.Selected` permission. It’s **available in both modes**, but we’re going with **Application** permission because we’re all about that sweet non-interactive automation. --- ## Prerequisites Here’s what you need to follow along: * PowerShell with the [PnP module](https://github.com/pnp/powershell) * An Azure AD Application (we’ll set it up in a sec) * Admin consent for Graph API permissions * Access to the SharePoint site you wanna manage --- ## Step-by-Step ### 1\. Register a New Azure App Go to **Azure Portal** → **App registrations** → **New registration**. ![](https://vng-docs.s3-accelerate.amazonaws.com/uploads/07dc8c6d-b12e-445e-a77e-fb5e897a46a9/096b2149-fd53-42d4-b40f-1c1581c4478c/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIARBLY6MQN745PDDHH%2F20250513%2Fap-southeast-1%2Fs3%2Faws4_request&X-Amz-Date=20250513T061007Z&X-Amz-Expires=60&X-Amz-Signature=3384465154a15908f8e79e5dbc9f325ad478d283e80681bacc1c699ef226afb5&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject align="left") --- ### 2\. Add Permissions * Go to your app → **API permissions** → Add: * `Sites.FullControl.All` (used only temporarily) * `Sites.Selected` 🛑 Heads-up: You *must* request admin consent for these permissions. Microsoft requires `Sites.FullControl.All` to grant site-specific permissions via `Sites.Selected`. ![](https://vng-docs.s3-accelerate.amazonaws.com/uploads/07dc8c6d-b12e-445e-a77e-fb5e897a46a9/52df343a-6fcb-4e4d-8c9d-31617c44a484/image.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIARBLY6MQN745PDDHH%2F20250513%2Fap-southeast-1%2Fs3%2Faws4_request&X-Amz-Date=20250513T061007Z&X-Amz-Expires=60&X-Amz-Signature=5974e4be610275335968c379e280067d54d6b43b5815ea126d75a0a267984f01&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject align="left") --- ### 3\. Create a Certificate Use PowerShell to generate a cert: ```powershell New-PnPAzureCertificate -OutPfx pnp.pfx -OutCert pnp.cer -CommonName .sharepoint.com ``` Now you’ve got `pnp.pfx` and `pnp.cer`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1747116693626/83b0376b-c792-4b17-b16b-aaef3c2665c6.png align="center") --- ### 4\. Import Certificates Browse to the folder, then import both files to **Current User** → just **Next** → **Finish**. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1747116715746/76b337fc-ef03-41ef-a750-a99bd6fce589.png align="center") --- ### 5\. Upload Certificate to Azure In the Azure Portal, go back to your app → **Certificates & secrets** → **Certificates tab** → Upload `pnp.cer` 💡 Save the Thumbprint — you'll need it soon. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1747116731332/77d79fe3-bea0-4a24-b991-f7282373100e.png align="center") --- ### 6\. Connect to SharePoint + Grant Permissions Let’s put this all together in PowerShell: ```powershell $siteUrl = "https://.sharepoint.com/sites/" $tenant = ".sharepoint.com" $clientId = "" $certThumbprint = "" Connect-PnPOnline -Url:$siteUrl -ClientId:$clientId -Thumbprint:$certThumbprint -Tenant:$tenant # FullContol/Read/Write/Manage permission https://pnp.github.io/powershell/cmdlets/Grant-PnPAzureADAppSitePermission.html Grant-PnPAzureADAppSitePermission -Sưite $siteUrl -AppId $clientId -DisplayName "SharePoint Permission" -Permissions "Write" # Check Get-PnPAzureADAppSitePermission -Site $siteUrl -AppIdentity $clientId ``` Now your app officially has access to that SharePoint site with `Sites.Selected`. --- ### 7\. Clean Up Once everything works, you can go back and remove `Sites.FullControl.All` permission. You don’t need it anymore — your app’s now living on like a pro. --- ## Final Thoughts Using `Sites.Selected` with application permissions is low-key one of the best ways to build secure, automated SharePoint workflows — especially when you wanna keep things headless and passwordless. You get fine-grained control, and you can automate all the boring stuff without needing to run it interactively. SysOps, Power Users, and Scripters — this one's for you. --- Let me know if you want a follow-up post on automating uploads/downloads using this setup. Happy scripting! 🚀💻 ## References * [Overview of Selected Permissions in OneDrive and SharePoi](https://learn.microsoft.com/en-us/graph/permissions-selected-overview?tabs=http#what-permissions-do-i-need-to-manage-permissions)nt * [New-PnPAzureCertificate](https://learn.microsoft.com/en-us/graph/permissions-selected-overview?tabs=http#what-permissions-do-i-need-to-manage-permissions) * [Grant-PnPAzureADAppSitePermission](https://learn.microsoft.com/en-us/graph/permissions-selected-overview?tabs=http#what-permissions-do-i-need-to-manage-permissions)