I'm trying to access sharepoint site lists with MS Graph. I've got application permissions Sites.Selected admin consent. The global admin is getting a 403 when doing post to add permission to the specific site in graph explorer
POST https://graph.microsoft.com/v1.0/sites/{siteId}/permissions
I signed up to microsoft 365 developer account and got a sandbox AAD and sharepoint site. The permissions POST worked for the main account I got when creating the sandbox. Sites.Selected works fine for my test app.
Now I'm trying to figure out if maybe the global admin is not the person who has access to granting site permissions.
I gave global admin to a user and got a 403 trying to get permissions from the specific site.
I gave sharepoint admin to a user and got 403 trying to get permissions from the specific site.
Would anyone know what role is needed to do the POST (or GET)
https://graph.microsoft.com/v1.0/sites/{siteId}/permissions
EDIT Well after paying closer attention to my sandbox global admin...he was indeed missing the permission Sites.FullControll.All in graph explorer. I saw a checkmark besides it and quickly thought "he's got it already!!" but the checkmark is in the column "Admin consent required", just can't see the column title after scrolling down to sites. It needs to say "Consented".
EDIT2 So the POST to grant permission to read or write only seems to work in the sandbox. This was brought up to Microsoft and they didn't really explain why it worked in the sandbox, only that the only supported way it works is if an application with Sites.FullControll.All makes the POST. If you come across posts/websites saying it works with graph explorer, they probably only tried it with a sandbox. I assume this will also fail with the 3rd method of granting the read/write permission to a site with powershell.