Restrict SharePoint access

This guide explains how to restrict access for a service account (with or without own client credentials).

By default, using a service account grants access to all SharePoint sites. However, this level of access is typically unnecessary. To follow the principle of least privilege, you should restrict access to only the specific sites required.

Prerequisites

Before proceeding, ensure you have configured the Entra ID application registration with the Sites.Selected permission scope. For details on this step, please refer to our separate article on Entra ID configuration.

Assign permission to specific SharePoint sites

You can either use CLI for Microsoft 365 or PnP PowerShell to assign permissions. 

Permission Levels

When assigning permissions, you can choose from the following levels:

• read: Read items in a site collection
• write: Read and write items in a site collection
• manage: Read and write items and lists in a site collection
• fullcontrol: Have full control of a site collection

Select the permission level that best fits the service account's requirements, always following the principle of least privilege.

Using CLI for Microsoft 365

1. Login to Microsoft 365:

m365 login

2. Grant permissions to a specific site:

m365 spo site apppermission add --appId "YOUR_APP_ID" --permission \nfullcontrol --siteUrl "https://contoso.sharepoint.com/sites/your-site"

3. List existing permissions:

m365 spo site apppermission list --appId "YOUR_APP_ID" \n--siteUrl "https://contoso.sharepoint.com/sites/your-site"

4. Update permissions:

m365 spo site apppermission add --appId "YOUR_APP_ID" \n--permission read --siteUrl "https://contoso.sharepoint.com/sites/your-site"

5. Remove permissions:

m365 spo site apppermission remove --appId "YOUR_APP_ID" \n--siteUrl "https://contoso.sharepoint.com/sites/your-site"

Using PnP PowerShell

1. Connect to SharePoint with the ClientId that was used to authenticate 

Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/your-site" -Interactive -ClientId XXXX

2. Grant permissions:

$permission = Grant-PnPAzureADAppSitePermission -AppId "YOUR_APP_ID" \n-DisplayName "YourAppName" -Permissions Write

3. Update permissions if needed:

Set-PnPAzureADAppSitePermission -PermissionId $permission.Id -Permissions FullControl

*Note: You must be a site collection admin to execute these commands.

PowerShell Version Requirements: If you encounter errors related to your PowerShell version when running these commands, it's recommended to update to the latest version. Some commands may require PowerShell 5.1 or higher for proper functionality. To check your PowerShell version, run $PSVersionTable.PSVersion in your PowerShell terminal. If you need to update PowerShell, refer to Microsoft's official documentation for the most current installation methods.

This article was written based on this blog post