Understanding Resource Specific Consent for Microsoft Graph and SharePoint Online

Summary

This video script discusses the implementation of resource-specific permissions in SharePoint Online and Microsoft Graph, focusing on the 'site.selected' application permission. It explains how to configure this permission for access to specific site collections without granting full control to the entire tenant. The script guides through the process of setting up certificate authentication in Azure Active Directory, granting permissions using Microsoft Graph and PowerShell, and testing access with a .NET application. It demonstrates the powerful capability of targeting specific site collections with application-only tokens, enhancing security and control.

Takeaways

• 🔒 SharePoint Online and Microsoft Graph require specific permissions for accessing sites, which can be configured using application permissions.
• 🌐 The 'site.selected' permission allows access to a specific site or set of site collections, rather than the entire tenant.
• 🔑 To use 'site.selected' permissions, you need to authenticate with a certificate against Azure Active Directory.
• 📜 Azure Access Control Service (ACS) is no longer needed; direct authentication through Azure Active Directory and OAuth is sufficient.
• 👤 A global administrator or someone with 'designs.fullcontrol.all' permissions is required to grant 'site.selected' permissions to a target site.
• 📊 The permissions can be configured as read-only, write, manage, or full control, providing flexibility in access control.
• 📝 Azure Active Directory applications can be registered with certificate authentication and client secrets for secure access.
• 📜 Certificates for authentication can be created using PowerShell cmdlets, with both public and private keys managed separately.
• 🤖 Testing access permissions can be done using .NET Framework applications that attempt to interact with SharePoint Online via Microsoft Graph or the SharePoint REST API.
• 🚫 Access is denied when attempting to interact with a site collection that has not been granted permissions, demonstrating the effectiveness of the 'site.selected' permission.
• 🗑 Permissions can be revoked using PowerShell cmdlets, allowing for dynamic management of access rights.

Q & A

What is the purpose of the 'site.*selected' permission in SharePoint Online and Microsoft Graph?

The 'site.*selected' permission is used to restrict a set of permissions to a specific site or set of site collections in SharePoint Online and Microsoft Graph, rather than granting access to the entire tenant.

Why is certificate authentication required for SharePoint Online with application-only tokens?

Certificate authentication is required for SharePoint Online when using application-only tokens because it provides a secure way to authenticate against Azure Active Directory without relying on user credentials.

How can you configure the 'site.*selected' permission for a specific site collection?

You can configure the 'site.*selected' permission for a specific site collection by using either Microsoft Graph API or PowerShell, specifically the PnP (Patterns and Practices) PowerShell cmdlets.

What are the steps to create a certificate for certificate authentication?

To create a certificate for certificate authentication, you can use the PnP PowerShell cmdlets to generate a certificate, save it as a PFX file with a private key, and as a .cer file with just the public key. You also need to specify a password for the certificate.

How can you grant the 'site.*selected' permission to a specific site collection using PowerShell?

You can grant the 'site.*selected' permission to a specific site collection using the 'Grant-PnPAzureADSitePermission' PowerShell cmdlet, providing the application ID, display name, target URL of the site, and the desired permission level.

What is the difference between using Microsoft Graph and SharePoint REST API for accessing SharePoint Online?

Microsoft Graph is a unified API endpoint that provides access to various Microsoft services including SharePoint Online, while the SharePoint REST API is specifically designed for SharePoint Online. Both can be used to access and manipulate SharePoint resources, but Microsoft Graph offers a broader range of services.

How can you test the permissions granted to an application in SharePoint Online?

You can test the permissions by attempting to perform actions on the SharePoint site, such as creating a list. If the action is successful, it indicates that the permissions are correctly granted. If not, it will result in an access denied error.

What is the role of a global administrator in granting the 'site.*selected' permission?

A global administrator or someone with 'designs.fullcontrol.all' permission is required to grant the 'site.*selected' permission to the target site collection, ensuring that the permission is correctly assigned and secure.

How can you revoke the 'site.*selected' permission that was granted to an application?

You can revoke the 'site.*selected' permission using the 'Revoke-PnPAzureADSitePermission' PowerShell cmdlet, providing the permission ID to remove the permission and revoke the grant.

What are the benefits of using resource-specific consent in Azure Active Directory?

Resource-specific consent allows you to target specific resources with application permissions, enhancing security by limiting the scope of access and reducing the need for broad permissions like 'site.fullcontrol.all'.