SharePoint API: Can't authenticate 'Sites.FullControl.All' in client_credential flow

user_2899630 0
Viewed 2135

I've have an App that would like to access SharePoint API. I've registered it in AD, and gave it the following permissions:

enter image description here

But when I ask it to be authenticated with the following scopes

    - https://graph.microsoft.com/User.Read.All
    - https://graph.microsoft.com/Group.Read.All
    - https://graph.microsoft.com/Sites.Read.All
    - https://graph.microsoft.com/Calendars.Read.Shared
    - https://graph.microsoft.com/MailboxSettings.Read
    - https://graph.microsoft.com/Files.Read.All
    - https://graph.microsoft.com/Directory.Read.All
    - https://graph.microsoft.com/AuditLog.Read.All
    - https://graph.microsoft.com/AuditLog.Read.All
    - offline_access
    - https://manage.office.com/ActivityFeed.Read
    - https://microsoft.sharepoint-df.com/Sites.FullControl.All
    - https://microsoft.sharepoint-df.com/Sites.Read.All
    - https://microsoft.sharepoint-df.com/User.Read.All

I get this error:

invalid_client&error_description=AADSTS650053: 
enter code here`The application 'XXX' asked for scope
'Sites.FullControl.All' that doesn't exist on the resource
'00000003-0000-0ff1-ce00-000000000000'. 
Contact the app vendor.

What does this mean that it that doesn't exist on the resource? With all the other scopes (except SharePoint's) it all works fine

sharepoint-api microsoft-graph-sdks microsoft-graph-api active-directory
2 Answers

Looks like the Sites.FullControl.All has moved to the Graph API section but trying to add it in the Azure portal results in a different error saying that permission is not currently supported (see on screenshot below).

In my test application, I succeeded using AllSites.FullControl (AllSites as a single word, no periods) and then listing all sites on SharePoint Online tenant with MSAL for .NET.

var app = PublicClientApplicationBuilder.Create(MyAppId)
    .WithAuthority("https://login.microsoftonline.com/common", false)
    .WithDefaultRedirectUri()
    .Build();

return await app
    .AcquireTokenInteractive(new string[] { "https://tenantxx.sharepoint.com/.default" })
    .WithParentActivityOrWindow(parentWindow) // optional, used to center the browser on the window
    .WithPrompt(Prompt.SelectAccount)
    .ExecuteAsync();

API Permissions in the Azure portal: API Permissions in the portal

user_14516450
user_8054980
Related