← cd ~/compare
// compare · graph permissions
Sites.ReadWrite.All vs Sites.Selected
Two Microsoft Graph permissions that are easy to mix up, side by side.
In short: Use Sites.Selected and grant access to only the sites the app needs.
| Sites.ReadWrite.All | Sites.Selected | |
|---|---|---|
| Application | Read and write items in all site collections Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user. Always needs admin consent · High risk | Access selected site collections Allow the application to access a subset of site collections without a signed in user. The specific site collections and the permissions granted will be configured in SharePoint Online. Always needs admin consent · Low risk |
| Delegated | Edit or delete items in all site collections Allows the application to edit or delete documents and list items in all site collections on behalf of the signed-in user. Users can consent · High risk | Access selected Sites, on behalf of the signed-in user Allow the application to access a subset of site collections on behalf of the signed-in user. The specific site collections and the permissions granted will be configured in SharePoint Online. Users can consent · Low risk |