Set up the Microsoft SharePoint Connector with Sites.Selected

Sites.Selected is a Microsoft Graph application permission that grants access to only the SharePoint sites you explicitly authorize. Every other site in the tenant remains invisible to the connector.

This is the recommended least-privilege option for enterprise deployments — it satisfies most InfoSec reviews and avoids the tenant-wide blast radius of Sites.Read.All or Sites.FullControl.All.

Create a dedicated app registration for the raia SharePoint connector. Single tenant is the right choice for most deployments.

1. 01

   Sign in to the Azure Portal and open Microsoft Entra ID → App registrations.

2. 02

   Click New registration. Give it a clear name (for example, raia SharePoint Connector) and pick Single tenant. Leave the redirect URI empty.

3. 03

   After the app is created, copy the Application (client) ID and the Directory (tenant) ID from the Overview page — you'll paste these into Command later.

4. 04

   Keep the Overview tab open; you'll need the display name in Step 05.

Grant the app the narrowest SharePoint permission Microsoft supports, then have an admin consent to it.

1. 01

   In the app registration, open API permissions → Add a permission → Microsoft Graph → Application permissions.

2. 02

   Search for Sites.Selected, check it, and click Add permissions.

3. 03

   Back on the API permissions page, click Grant admin consent for <your tenant>. Confirm the status turns to Granted.

4. 04

   Do not add Sites.Read.All or Files.ReadWrite.All — those defeat the purpose of Sites.Selected.

Generate a secret so raia can authenticate as the app, then paste it into the SharePoint connector form in Command.

1. 01

   In the app registration, open Certificates & secrets → Client secrets → New client secret.

2. 02

   Give it a description (for example, raia connector) and pick an expiry that matches your rotation policy.

3. 03

   Immediately copy the Value column — not the Secret ID. The Value is only shown once and cannot be retrieved later.

4. 04

   Open raia Command → Connectors → Microsoft SharePoint and paste the Tenant ID, Client ID, and Client Secret into the connector form.

5. 05

   Save and click Test connection. You should see a success message — but individual sites will still fail until you complete Step 05.

Sites.Selected only unlocks the mechanism — it does not grant access to any site. For each SharePoint site you want the connector to read, you have to explicitly grant the app permission using Microsoft Graph.

A SharePoint site is identified by a composite ID with three comma-separated parts: {hostname},{site-collection-id},{site-id}. The easiest way to get it — and to run the grant — is Microsoft Graph Explorer at developer.microsoft.com/graph/graph-explorer.

Step A — resolve the site ID

Sign in to Graph Explorer with a tenant admin account and run a GET to look up the site by its server-relative path:

GET https://graph.microsoft.com/v1.0/sites/{hostname}:/sites/{site-name}

For example, if the site URL is https://contoso.sharepoint.com/sites/ThomasTestSite1:

GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/ThomasTestSite1

The response's id field is the composite site ID. Copy the full string — you'll need it in Step B.

Step B — grant read access to the app

Change the method to POST, paste the URL below (substituting the site ID from Step A), and send the JSON body:

POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions
Content-Type: application/json

{
  "roles": ["read"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "{APPLICATION_CLIENT_ID}",
        "displayName": "{APPLICATION_DISPLAY_NAME}"
      }
    }
  ]
}

Repeat Step 05 for every SharePoint site you want the connector to read. Remove access at any time by DELETEing the permission from the same endpoint.

Confirm the connector can now see the site you just authorized.

1. 01

   Return to Command → Connectors → Microsoft SharePoint.

2. 02

   Enter the site URL (or path) into the Test permissions field.

3. 03

   The site should resolve successfully. If it still fails, wait a minute for the Graph permission to propagate, then re-check the permission was created against the correct site ID.