Running sharepoint/onedrive file storage with less permissions¶
The recommended setup for Live docs is to let the CRM app in Azure have Files.ReadWrite.All and Sites.ReadWrite.All permissions. If there is a need to limit the CRM app to a specific SharePoint site that is also possible, but it is more complicated and requires more knowledge for the adminstrator configuring it.
Follow the normal setup instructions but configure the API Permissions for the app registration like this instead:
Configuring which "selected" Sharepoint site it applies to is not possible through any user interface, instead one must use the Microsoft Graph API with a user that has Sites.FullControl permissions.
Using for example Microsoft Graph Explorer
GET https://graph.microsoft.com/v1.0/sites/<YOU_SITE_ID>/permissions/
POST https://graph.microsoft.com/v1.0/sites/<YOU_SITE_ID>/permissions/
{
"roles": [
"write"
],
"grantedToIdentities": [
{
"application": {
"id": "<YOUR_CLIENT_ID>",
"displayName": "Dev Sharepoint Staging OnedriveFS"
}
}
]
}
