Skip to main content
Review the validated minimum standard delegated scope for every SharePoint action. Each action uses one content scope in addition to the connection baseline.

​
Minimal scopes per action

Each SharePoint connection also requests offline_access and User.Read. These connection scopes apply in addition to the action scope in the table.
ActionDescriptionMinimum scopes
Add section to pageAdds section to page.Sites.ReadWrite.All
Check file accessChecks whether a file can be accessed.Files.Read.All
Copy fileCopies file.Files.ReadWrite.All
Create attachment from URLCreates an attachment from a URL.Sites.Read.All
Create folderCreates folder.Files.ReadWrite.All
Create listCreates list.Sites.Manage.All
Create list itemCreates list item.Sites.ReadWrite.All
Create pageCreates page.Sites.ReadWrite.All
Download fileDownloads file.Files.Read.All
Find site usersFinds site users.Sites.Read.All
Get columnGets column.Sites.Read.All
Get driveGets drive.Files.Read.All
Get fileGets file.Files.Read.All
Get file metadataGets file metadata.Files.Read.All
Get folderGets folder.Files.Read.All
Get listGets list.Sites.Read.All
Get list itemGets list item.Sites.Read.All
Get pageGets page.Sites.Read.All
Get profileGets profile.User.Read
Get sensitivity labelGets the sensitivity label of a file.Files.Read.All
Get siteGets site.Sites.Read.All
List columnsLists columns.Sites.Read.All
List drive childrenLists drive children.Files.Read.All
List drivesLists drives.Files.Read.All
List files in folderLists files in folder.Files.Read.All
List files in SharePoint folderLists files in sharepoint folder.Files.Read.All
List folder changesLists folder changes.Files.Read.All
List list itemsLists list items.Sites.Read.All
List recent filesLists recent files.Sites.Read.All
List site listsLists site lists.Sites.Read.All
List site pagesLists site pages.Sites.Read.All
List subsitesLists subsites.Sites.Read.All
Move fileMoves file.Files.ReadWrite.All
Query list itemsQueries list items.Sites.Read.All
Replace page contentReplaces page content.Sites.ReadWrite.All
Resolve driveResolves drive.Files.Read.All
Resolve fileResolves file.Files.Read.All
Resolve folderResolves folder.Files.Read.All
Resolve listResolves list.Sites.Read.All
Resolve pageResolves page.Sites.Read.All
Resolve parentResolves parent.Files.Read.All
Resolve SharePoint URLResolves a shared SharePoint URL.Files.Read.All
Resolve siteResolves site.Sites.Read.All
Search filesSearches files.Files.Read.All
Search SharePointSearches sharepoint.Sites.Read.All
Search sitesSearches sites.Sites.Read.All
Update list itemUpdates list item.Sites.ReadWrite.All
Update page titleUpdates page title.Sites.ReadWrite.All
Upload fileUploads file.Files.ReadWrite.All
The validated mapping does not include SensitivityLabel.Read for Get sensitivity label. Add it when your Microsoft Purview setup requires it.

​
Actions affected by Sites.Selected

The following actions may not work completely with selected site permissions:
Uses Microsoft Graph GET /sites?search. This endpoint queries tenant-wide directory indexes and does not reliably return sites granted solely through Sites.Selected, so dynamic site discovery fails.
Uses Microsoft Search, which searches tenant-wide indexes based on the user’s personal SharePoint permissions rather than the application’s Sites.Selected grant. Search results can include items from sites outside your selected grant, though direct access to those ungranted items will still be denied.
Queries tenant-wide Microsoft Search indexes. It may return file results from sites outside the selected grant, although attempting to open or interact with those files will fail if permissions are not explicitly granted.
Resolves shared links through /shares/{shareToken}/driveItem. If a user provides a direct link to a file or folder on a granted site, resolution succeeds. If the link points to an ungranted site, Graph denies access even if the user individually has access in SharePoint.

​
Native features

Additionally, the following native features may be affected by a Selected grant:
  • Folder Sync: Synchronizes local and cloud folders across your workspace.
  • Company Knowledge: Indexes connected drives and documents for AI search and chat context.
When using selected-only permissions, dynamic site and library discovery does not work, preventing UI pickers from listing sites. While sync and indexing can read files from a granted site once exact site and drive paths are provided, automatic discovery is unavailable. Create list requires manage permissions on the site.