Unable to Assign Sites.Selected Write Access to a Single SharePoint Site: Grant-PnPAzureADAppSitePermission Failing

Question

Unable to Assign Sites.Selected Write Access to a Single SharePoint Site: Grant-PnPAzureADAppSitePermission Failing

Gamage 20

Hi everyone,

I’m trying to configure restricted SharePoint access for an automation workflow (n8n chatbot). My goal is to allow an Azure App Registration to access ONE SharePoint site only using Sites.Selected with Write permissions.

However, I keep running into multiple PowerShell errors and cannot successfully grant the permission.

✔ What I already did

1. App Registration (Azure Entra ID)

Created an App Registration using an admin account.

Added API Permissions: Sites.Selected (Application) & Files.ReadWrite.All (Application)

Created a Client Secret.

2. SharePoint Setup

Created a dedicated site ONLY for my specific work

3.Installed PnP.PowerShell Using PowerShell 7.5.4

Whenever I try to connect or grant the permission, I get errors.

ERROR 1 — Connect-PnPOnline -Url "https://

Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-12-11T17:01:02.27+00:00

Hello Gamage,

Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Gamage 20 Reputation points

2025-12-12T02:44:27.92+00:00

Thank you for your reply. I followed the exact steps you shared, but I'm still running into an issue.

When I tested it in the Graph Explorer, I received a 400 Bad Request with an empty response body (screenshot attached) error01.PNG.

To double-check, I also tried the same request using PowerShell, but that returned an "itemNotFound" error, even though I’m certain that the siteId I used is correct (screenshot attached) error02.PNG.

Do you have any idea what might be causing this?
Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-12-12T17:30:48.2966667+00:00

Hello Gamage,

Can we connect offline to resolve the issue? Please share your emailID and available time and time zone over private messages.

Answer accepted by question author

0 additional answers

Your answer

Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-12-11T17:01:02.27+00:00

Hello Gamage,

Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Gamage 20 Reputation points

2025-12-12T02:44:27.92+00:00

Thank you for your reply. I followed the exact steps you shared, but I'm still running into an issue.

When I tested it in the Graph Explorer, I received a 400 Bad Request with an empty response body (screenshot attached) error01.PNG.

To double-check, I also tried the same request using PowerShell, but that returned an "itemNotFound" error, even though I’m certain that the siteId I used is correct (screenshot attached) error02.PNG.

Do you have any idea what might be causing this?
Rukmini 44,000 Reputation points Microsoft External Staff Moderator

2025-12-12T17:30:48.2966667+00:00

Hello Gamage,

Can we connect offline to resolve the issue? Please share your emailID and available time and time zone over private messages.

Answer 1

Hello Gamage,

To restrict Sites.Selected SharePoint API permission to apply only to one specific site, not the whole tenant, make sure your app is granted the Sites.Selected permission:

User's image

Now create a permission to restrict the application to access only one SharePoint site. To perform this, refer this Microsoft Document for permissions:

YAML

POST https://graph.microsoft.com/v1.0/sites/{siteId}/permissions
{
  "roles": ["write"],
  "grantedToIdentities": [{
    "application": {
      "id": "ClientIDofApp",
      "displayName": "ruk33"
    }
  }]
}

User's image

Generated access token using client credentials flow:

YAML

POST https://login.microsoftonline.com/tenantId/oauth2/v2.0/token
grant_type:client_credentials
client_id: appId 
client_secret: secret

User's image

Using the above access token, the app can access ruk33 site:

JSON


GET https://graph.microsoft.com/v1.0/sites/m365xxx.sharepoint.com:/sites/ruk33

User's image

When tried to access another SharePoint site, received 403 error:**

User's image

Let me know if any further queries - feel free to reach out!