Microsoft Entra ID のアプリ登録で、Microsoft Graph API の権限について確認させてください。

Hi @muto-y ,

For your requirement of reading files from only specific SharePoint Online sites using a background Python application (Client ID / Client Secret), the recommended configuration is to grant Microsoft Graph Application Permission – Sites.Selected and then assign the application access to the required SharePoint sites.

It is technically possible to grant both Sites.Selected and Files.Read.All; however, this is not recommended. Files.Read.All provides tenant-wide file read permissions and is not restricted by Sites.Selected. Therefore, if both permissions are granted, the application may have broader access than intended.

The recommended approach is:

• Grant Sites.Selected only.
• Provide Admin Consent.
• Explicitly grant Read permissions to the required SharePoint sites.
• Use Client (Client ID/Client Secret) for authentication.

This follows Microsoft's least-privilege security model and ensures the application can access only the approved SharePoint sites.

Hope this information helps. Let us know if you have any queries. Happy to assist you further.

Hi @muto-y ,

following up to see if the above response is helpful. Let us know if you have any queries. Happy to assist you further

ご回答ありがとうございます。

Microsoft Graph のアプリケーション権限について追加で確認させてください。

SharePoint Online の特定サイト内に、権限の異なる複数フォルダがあります。

今回、Python アプリから特定の１つのフォルダ内のファイルのみを読み取りたいと考えています。

Files.SelectedOperations.Selected を使用すれば、サイト全体ではなく、特定フォルダ単位でアプリに read 権限を付与できますでしょうか。

また、その場合、read 権限を付与していない同一サイト内の別フォルダにはアクセスできない、という理解で正しいでしょうか。

最小権限の観点から、Sites.Selected でサイト全体に read を付与するのではなく、Files.SelectedOperations.Selected で対象フォルダのみに read を付与する構成が適切か確認したいです。

よろしくお願いいたします。

Hi @muto-y ,

Yes, if you want to restrict access to a specific folder rather than an entire SharePoint Online site, you can use the Microsoft Graph application permission Files.SelectedOperations.Selected. This permission allows access to specific files or library folders that are explicitly assigned to the application. In this configuration, the application will not be able to access other folders within the same site unless permissions are separately granted for those folders.

From a least-privilege perspective, Files.SelectedOperations.Selected is more granular than Sites.Selected and is the recommended approach when the application only needs access to a specific folder. In addition to granting and consenting to the permission, a resource-specific permission assignment must be created for the target folder; otherwise, the application will not have access to the content.

Let us know if you have any queries. Happy to assist you further.

Hi Muto ,

following up to see if there is an update on the previous response. let us know if you have any queries.