Use Sites.Selected instead of Sites.FullControl.All in SharePoint Permissions?

[timo-rempe]

I was wondering if it was possible to use the Sites.Selected permissions instead of giving the application full control of all sites in SharePoint. We are evaluating the usage of Wikitraccs for our company but are concerned about the security when giving it full permissions.
Is this possible at all or does it fail because Sites.Selected can only be given application permissions, not delegated?

[heinrich-ulbricht]

@timo-rempe It's pretty new that Sites.Selected started working delegated as well: https://devblogs.microsoft.com/microsoft365dev/sharepoint-now-supports-delegated-sites-selected-authentication/

Didn't test this, yet, but this should work :)

[timo-rempe]

I found that post too, it's good to hear that, in theory, there should be a way to make Wikitraccs work with Sites.Selected. As the comments point out however, only the Graph API supports delegated authentication so far, not the SharePoint API.

My initial assumption was that both Graph and SharePoint API need delegated permissions for it to work; is there a way to use Sites.Selected with delegated only on GraphAPI and still make it work or are we stuck waiting for SharePoint API to included delegated auth for selected sites?

[heinrich-ulbricht]

@timo-rempe Ah I should've read the comments! Lots of folks asking about delegated for SharePoint, too. So this is not possible at the moment for the SharePoint API.

So far my assumption with regard to WikiTraccs was that nobody would want to use application permissions as that would give WikiTraccs too much power. This did not factor in that Sites.Selected + app permissions might be fine. So far I had no inquiries in this direction.

WikiTraccs uses a mix of Graph API and SharePoint API calls. What should work right now is configuring delegated Sites.Selected for Graph and delegated full control (or manage) for SharePoint (as long as we wait for delegated Sites.Selected for the SharePoint API). But does that change anything, security-wise?

What solution would you prefer, if you could choose? Would that be Sites.Selected application permissions for both Graph API and SharePoint API? Using a certificate for authentication that you provide to WikiTraccs in some format (cert file, base64 string, you name it)?

[timo-rempe]

@heinrich-ulbricht Thanks for clarifying! I think for now, security-wise it's better to just use the delegated Full Control with a special migration user as suggested by you. If and when delegated Sites.Selected comes to the SharePoint API, that might be a good alternative but I agree with you that the application permissions would probably be more risky all in all.

Thanks for your help in this, it's good to know that, in theory, delegated Sites.Selected should work once it's available for both Graph and SharePoint API.