Granting Site Access to Your SharePoint Integration

Overview

After registering your Azure AD app (see SharePoint App Registration & Certificate Setup), the app still can't read anything in SharePoint. That's by design.

Important: Your app was granted the Microsoft Graph Sites.Selected permission, which means it has no access to any SharePoint site until you explicitly grant it one.

Before You Begin

Make sure you have:

• Completed the app registration in SharePoint App Registration & Certificate Setup, including the Sites.Selected permission and admin consent
• The Client ID of the app you registered
• The URL of the SharePoint site you want Conveyor to access (e.g. https://yourtenant.sharepoint.com/sites/YourSite)
• Admin rights sufficient to grant app permissions on that site (typically a SharePoint Administrator or Global Administrator role)

Granting Access to a Site

Unlike the app registration steps, granting a Sites.Selected permission to a specific site isn't done through a page in the Azure portal. There currently isn't a graphical UI for it. Instead, it's done with a single Microsoft Graph API call (or the equivalent PowerShell command), run once by an administrator. This is not something you'll repeat regularly.

Conceptually, the grant does one thing: it assigns your app's Client ID a role (read, or read/write) on one specific site. Once that grant exists, the app can enumerate and read files on that site and only that site.

There are two common ways to perform the grant:

Option A: Microsoft Graph API call, made by an administrator (for example, using Graph Explorer signed in with admin credentials):

POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions
{
  "roles": ["read"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "{your-app-client-id}",
        "displayName": "Conveyor SharePoint Integration"
      }
    }
  ]
}

Option B: PnP PowerShell, if your organization already uses it for SharePoint administration:

Install-Module -Name PnP.PowerShell -Scope CurrentUser
Connect-PnPOnline -Url "https://yourtenant.sharepoint.com/sites/YourSite" -Interactive
Grant-PnPAzureADAppSitePermission -AppId "{your-app-client-id}" `
  -DisplayName "Conveyor SharePoint Integration" `
  -Site "https://yourtenant.sharepoint.com/sites/YourSite" -Permissions Read

Either approach accomplishes the same thing. If your organization doesn't have someone comfortable running an API call or PowerShell command, this is a good task to hand to whoever administers your Microsoft 365 environment — it takes a couple of minutes once you have the site URL and the app's Client ID.

Important: Read permission is sufficient for Conveyor to sync your documents. Conveyor only needs to read files, not modify them.