---
updatedAt: 2026-07-31T02:37:46.000Z
agentTools:
  projectIndex: https://docs.conveyor.com/llms.txt
---

# Granting Site Access to Your SharePoint Integration

## Overview

After registering your Azure AD app (see [SharePoint App Registration & Certificate Setup](https://docs.conveyor.com/docs/sharepoint-app-registration-certificate-setup)), the app still can't read anything in SharePoint. That's by design.

**Important:** Your app was granted the Microsoft Graph **Sites.Selected** permission, which means it has **no access to any SharePoint site until you explicitly grant it one**. 

## Before You Begin

Make sure you have:

* Completed the app registration in [SharePoint App Registration & Certificate Setup](https://docs.conveyor.com/docs/sharepoint-app-registration-certificate-setup), including the `Sites.Selected` permission and admin consent
* The **Client ID** of the app you registered
* The **URL of the SharePoint site** you want Conveyor to access (e.g. `https://yourtenant.sharepoint.com/sites/YourSite`)
* Admin rights sufficient to grant app permissions on that site (typically a SharePoint Administrator or Global Administrator role)

## Granting Access to a Site

Unlike the app registration steps, granting a `Sites.Selected` permission to a specific site isn't done through a page in the Azure portal. There currently isn't a graphical UI for it. Instead, it's done with a single Microsoft Graph API call (or the equivalent PowerShell command), run once by an administrator. This is not something you'll repeat regularly.

Conceptually, the grant does one thing: it assigns your app's **Client ID** a **role** (read, or read/write) on **one specific site**. Once that grant exists, the app can enumerate and read files on that site and only that site.

There are two common ways to perform the grant:

**Option A: Microsoft Graph API call**, made by an administrator (for example, using [Graph Explorer](https://developer.microsoft.com/en-us/graph/graph-explorer) signed in with admin credentials):

```
POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions
{
  "roles": ["read"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "{your-app-client-id}",
        "displayName": "Conveyor SharePoint Integration"
      }
    }
  ]
}
```

**Option B: PnP PowerShell**, if your organization already uses it for SharePoint administration:

```powershell
Install-Module -Name PnP.PowerShell -Scope CurrentUser
Connect-PnPOnline -Url "https://yourtenant.sharepoint.com/sites/YourSite" -Interactive
Grant-PnPAzureADAppSitePermission -AppId "{your-app-client-id}" `
  -DisplayName "Conveyor SharePoint Integration" `
  -Site "https://yourtenant.sharepoint.com/sites/YourSite" -Permissions Read
```

Either approach accomplishes the same thing. If your organization doesn't have someone comfortable running an API call or PowerShell command, this is a good task to hand to whoever administers your Microsoft 365 environment — it takes a couple of minutes once you have the site URL and the app's Client ID.

> **Important:** Read permission is sufficient for Conveyor to sync your documents. Conveyor only needs to read files, not modify them.

<br />