Files.SelectedOperations.SelectedMicrosoft Graph permission · Low risk
Allow the application to access a subset of files without a signed in user. The specific files and the permissions granted will be configured in SharePoint Online or OneDrive.
Application permission
Low riskAccess selected Files without a signed in user.. Allow the application to access a subset of files without a signed in user. The specific files and the permissions granted will be configured in SharePoint Online or OneDrive.
| ID | bd61925e-3bf4-4d62-bc0b-06b06c96d95c |
|---|---|
| Consent | Always needs admin consent |
| Risk | Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice. |
Delegated permission
Low riskAccess selected Files, on behalf of the signed-in user. Allow the application to access files explicitly permissioned to the application on behalf of the signed in user. The specific files and the permissions granted will be configured in SharePoint Online or OneDrive.
| ID | ef2779dc-ef1b-4211-8310-8a0ac2450081 |
|---|---|
| Consent | Needs admin consent |
| Risk | Only reaches the specific sites, lists or items an admin grants it, which makes it the least-privilege choice. |
Grant it to an app
In the portal: App registrations › your app › API permissions › Add a permission › Microsoft Graph › Application permissions, then grant admin consent. Or with Graph PowerShell:
Connect-MgGraph -Scopes "Application.Read.All", "AppRoleAssignment.ReadWrite.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$app = Get-MgServicePrincipal -Filter "appId eq '<your app's client id>'"
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $app.Id `
-PrincipalId $app.Id -ResourceId $graph.Id -AppRoleId "bd61925e-3bf4-4d62-bc0b-06b06c96d95c"Ask for it when signing in
Delegated permissions act as the signed-in user, so the app can never do more than that user can.
Connect-MgGraph -Scopes "Files.SelectedOperations.Selected"Which apps already have it?
# Apps that hold Files.SelectedOperations.Selected as an application permission
Connect-MgGraph -Scopes "Application.Read.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graph.Id -All |
Where-Object AppRoleId -eq "bd61925e-3bf4-4d62-bc0b-06b06c96d95c" |
Select-Object PrincipalDisplayName, PrincipalId, CreatedDateTime# Apps with delegated consent for Files.SelectedOperations.Selected
Connect-MgGraph -Scopes "Application.Read.All", "Directory.Read.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
Get-MgOauth2PermissionGrant -All |
Where-Object { $_.ResourceId -eq $graph.Id -and ($_.Scope -split " ") -contains "Files.SelectedOperations.Selected" } |
Select-Object ClientId, ConsentType, PrincipalId