← cd ~/compare
// compare · graph permissions
Sites.Read.All vs Sites.Selected
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Use Sites.Selected and grant access to only the sites the app needs.
| Sites.Read.All | Sites.Selected | |
|---|---|---|
| Application | Read items in all site collections Allows the app to read documents and list items in all site collections without a signed in user. Always needs admin consent · High risk | Access selected site collections Allow the application to access a subset of site collections without a signed in user. The specific site collections and the permissions granted will be configured in SharePoint Online. Always needs admin consent · Low risk |
| Delegated | Read items in all site collections Allows the application to read documents and list items in all site collections on behalf of the signed-in user Users can consent · Medium risk | Access selected Sites, on behalf of the signed-in user Allow the application to access a subset of site collections on behalf of the signed-in user. The specific site collections and the permissions granted will be configured in SharePoint Online. Users can consent · Low risk |