SharePoint

Review the validated minimum OAuth scopes and Sites.Selected limitations for every SharePoint action.

Review the validated minimum standard delegated scope for every SharePoint action. Each action uses one content scope in addition to the connection baseline.

Minimal scopes per action

Action Description Minimum scopes

Add section to page Adds section to page. Sites.ReadWrite.All

Check file access Checks whether a file can be accessed. Files.Read.All

Copy file Copies file. Files.ReadWrite.All

Create attachment from URL Creates an attachment from a URL. Sites.Read.All

Create folder Creates folder. Files.ReadWrite.All

Create list Creates list. Sites.Manage.All

Create list item Creates list item. Sites.ReadWrite.All

Create page Creates page. Sites.ReadWrite.All

Download file Downloads file. Files.Read.All

Find site users Finds site users. Sites.Read.All

Get column Gets column. Sites.Read.All

Get drive Gets drive. Files.Read.All

Get file Gets file. Files.Read.All

Get file metadata Gets file metadata. Files.Read.All

Get folder Gets folder. Files.Read.All

Get list Gets list. Sites.Read.All

Get list item Gets list item. Sites.Read.All

Get page Gets page. Sites.Read.All

Get profile Gets profile. User.Read

Get sensitivity label Gets the sensitivity label of a file. Files.Read.All

Get site Gets site. Sites.Read.All

List columns Lists columns. Sites.Read.All

List drive children Lists drive children. Files.Read.All

List drives Lists drives. Files.Read.All

List files in folder Lists files in folder. Files.Read.All

List files in SharePoint folder Lists files in sharepoint folder. Files.Read.All

List folder changes Lists folder changes. Files.Read.All

List list items Lists list items. Sites.Read.All

List recent files Lists recent files. Sites.Read.All

List site lists Lists site lists. Sites.Read.All

List site pages Lists site pages. Sites.Read.All

List subsites Lists subsites. Sites.Read.All

Move file Moves file. Files.ReadWrite.All

Query list items Queries list items. Sites.Read.All

Replace page content Replaces page content. Sites.ReadWrite.All

Resolve drive Resolves drive. Files.Read.All

Resolve file Resolves file. Files.Read.All

Resolve folder Resolves folder. Files.Read.All

Resolve list Resolves list. Sites.Read.All

Resolve page Resolves page. Sites.Read.All

Resolve parent Resolves parent. Files.Read.All

Resolve SharePoint URL Resolves a shared SharePoint URL. Files.Read.All

Resolve site Resolves site. Sites.Read.All

Search files Searches files. Files.Read.All

Search SharePoint Searches sharepoint. Sites.Read.All

Search sites Searches sites. Sites.Read.All

Update list item Updates list item. Sites.ReadWrite.All

Update page title Updates page title. Sites.ReadWrite.All

Upload file Uploads file. Files.ReadWrite.All

Actions affected by Sites.Selected

The following actions may not work completely with selected site permissions:

Uses Microsoft Graph GET /sites?search. This endpoint queries tenant-wide directory indexes and does not reliably return sites granted solely through Sites.Selected, so dynamic site discovery fails.

Uses Microsoft Search, which searches tenant-wide indexes based on the user's personal SharePoint permissions rather than the application's Sites.Selected grant. Search results can include items from sites outside your selected grant, though direct access to those ungranted items will still be denied.

Queries tenant-wide Microsoft Search indexes. It may return file results from sites outside the selected grant, although attempting to open or interact with those files will fail if permissions are not explicitly granted.

Resolves shared links through /shares/{shareToken}/driveItem. If a user provides a direct link to a file or folder on a granted site, resolution succeeds. If the link points to an ungranted site, Graph denies access even if the user individually has access in SharePoint.

Native features

Additionally, the following native features may be affected by a Selected grant:

• Folder Sync: Synchronizes local and cloud folders across your workspace.
• Company Knowledge: Indexes connected drives and documents for AI search and chat context.

When using selected-only permissions, dynamic site and library discovery does not work, preventing UI pickers from listing sites. While sync and indexing can read files from a granted site once exact site and drive paths are provided, automatic discovery is unavailable.

Create list requires manage permissions on the site.

Related pages

• Microsoft Integration Scopes
• Microsoft integrations: permissions and admin approval