Grant Microsoft Graph permissions

Still in the Azure Portal, in the app registration you just created. The permission you add depends on which mode you are running, so have that decision made first. See Choosing an authentication mode.

Add the permission

1. In your app registration, click API permissions in the left sidebar.

2. Click + Add a permission.

3. Pick Microsoft Graph, the big tile.

4. Choose the permission type:

   • For Service Principal mode, click Application permissions. Search for Sites.Selected and check the box. Click Add permissions.
   • For Delegated mode, click Delegated permissions. Search for and check Sites.Selected and offline_access. Click Add permissions.

   Both modes use Sites.Selected. The only difference is the permission type, Application versus Delegated. You can add both if you intend to support both modes; they do not conflict.

5. Back on the API permissions page, the new permissions show a yellow “Not granted” status. Click Grant admin consent for [tenant name] at the top, then Yes to confirm. The status column flips to green Granted for [tenant].

Why Sites.Selected for both modes

It is Microsoft’s recommended least-privilege pattern, and it is the whole point of this setup: the app has no access to anything by default, and you explicitly grant it the single site Sliick will manage. Tenant admins can audit exactly which site Sliick can reach.

The broad alternatives (Sites.ReadWrite.All application, or Sites.Read.All plus Files.ReadWrite.All delegated) would let the app reach every SharePoint site, and in delegated mode every site the signed-in user can reach, which most enterprise security reviews reject. In Delegated mode the Sites.Selected grant is also intersected with the signed-in user’s own permissions, so access is the narrowest of the two.

Next: Grant access to the SharePoint site.