{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44541,"path":"security-management/security-incident-response/grant-azure-app-access-sharepoint-site-commands.md","title":"Commands to grant Azure application access to the Microsoft SharePoint site","bundle":null,"doc_type":null,"release":"australia","body":"\n# Commands to grant Azure application access to the Microsoft SharePoint site\n\nUse one of the following three methods to grant your registered Azure application write access to the Microsoft SharePoint site at the site level, using the Microsoft Graph API.\n\n**Note:** These commands are provided for reference only and are not sourced from an external tool vendor. Only one method is required — choose the method that best matches what the Azure administrator already has installed. All three methods achieve the same result.\n\n|Placeholder|Example value|Where to find it|\n|-----------|-------------|----------------|\n|YOUR\\_TENANT\\_ID|xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx|Azure App Registration > Overview > Directory \\(tenant\\) ID|\n|YOUR\\_CLIENT\\_ID|yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy|Azure App Registration > Overview > Application \\(client\\) ID|\n|YOUR\\_CLIENT\\_SECRET|abc123XYZ~mySecretValue|Azure App Registration > Certificates & secrets > Client secrets > Value|\n|YOUR\\_TENANT / TENANT\\_NAME|contoso|The Microsoft 365 tenant name — the subdomain before .sharepoint.com|\n|YOUR\\_SITE\\_NAME / SITE\\_NAME|MSIMSite|The Microsoft SharePoint site name — the relative path segment after /sites/|\n|APP\\_REGISTRATION\\_DISPLAY\\_NAME|Microsoft SharePoint Graph|The display name entered when registering the App|\n|YOUR\\_TOKEN\\_FROM\\_STEP1|eyJ0eXAiOiJKV1Qi...|Curl method only — the access\\_token value from the Step 1 response|\n|YOUR\\_SITE\\_ID\\_FROM\\_STEP\\_2|contoso.sharepoint.com,abc123,def456|Curl method only — the id value from the Step 2 response|\n\n## Method 1 — Curl\n\nReplace all placeholders with values from the table above before executing. Copy the access\\_token from Step 1 and the site id from Step 2 for use in Step 3.\n\n```\n# Step 1: Get OAuth Token for the Registered Azure Application\ncurl --location --request GET 'https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/token' \\\n    --header 'accept: application/json' \\\n    --data-urlencode 'grant_type=client_credentials' \\\n    --data-urlencode 'client_id=YOUR_CLIENT_ID' \\\n    --data-urlencode 'client_secret=YOUR_CLIENT_SECRET' \\\n    --data-urlencode 'scope=https://graph.microsoft.com/.default'\n# From the response JSON, copy the access_token value -- this becomes YOUR_TOKEN_FROM_STEP1\n\n# Step 2: Retrieve SharePoint Site ID\ncurl --location 'https://graph.microsoft.com/v1.0/sites/YOUR_TENANT.sharepoint.com:/sites/YOUR_SITE_NAME' \\\n    --header 'Authorization: Bearer YOUR_TOKEN_FROM_STEP1'\n# From the response JSON, copy the id value -- this becomes YOUR_SITE_ID_FROM_STEP_2\n\n# Step 3: Grant Azure Application Permissions to the SharePoint Site\ncurl --location 'https://graph.microsoft.com/v1.0/sites/YOUR_SITE_ID_FROM_STEP_2/permissions' \\\n    --header 'Content-Type: application/json' \\\n    --header 'Authorization: Bearer YOUR_TOKEN_FROM_STEP1' \\\n    --data '{\"roles\": [\"write\"], \"grantedToIdentities\": [{\"application\": {\"id\": \"YOUR_CLIENT_ID\", \"displayName\": \"APP_REGISTRATION_DISPLAY_NAME\"}}]}'\n```\n\n## Method 2 — Azure CLI\n\nReplace the placeholder variable values at the top of the script with your actual values, then execute the full script. Requires the Azure CLI. For installation, see [Install Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli).\n\n```\n#!/bin/bash\n# Replace placeholder values with your actual values\nTENANT_ID=\"YOUR_TENANT_ID\"\nCLIENT_ID=\"YOUR_CLIENT_ID\"\nCLIENT_SECRET=\"YOUR_CLIENT_SECRET\"\nTENANT_NAME=\"YOUR_TENANT\"  # e.g., contoso\nSITE_NAME=\"YOUR_SITE_NAME\"\nAPP_DISPLAY_NAME=\"APP_REGISTRATION_DISPLAY_NAME\"\n\n# Authenticate with Azure AD (without requiring a subscription)\naz login --service-principal -u \"$CLIENT_ID\" -p \"$CLIENT_SECRET\" --tenant \"$TENANT_ID\" --allow-no-subscriptions\n\n# Get access token for Microsoft Graph API\nACCESS_TOKEN=$(az account get-access-token --resource https://graph.microsoft.com --query accessToken --output tsv)\nif [ -z \"$ACCESS_TOKEN\" ]; then echo \"Failed to retrieve access token.\" >&2; exit 1; fi\n\n# Fetch SharePoint Site ID\nSITE_ID=$(az rest --method GET --uri \"https://graph.microsoft.com/v1.0/sites/$TENANT_NAME.sharepoint.com:/sites/$SITE_NAME\" --headers \"Authorization=Bearer $ACCESS_TOKEN\" --query \"id\" --output tsv)\nif [ -z \"$SITE_ID\" ]; then echo \"Failed to retrieve SharePoint Site ID.\" >&2; exit 1; fi\n\n# Grant App Permissions to SharePoint Site\naz rest --method POST --uri \"https://graph.microsoft.com/v1.0/sites/$SITE_ID/permissions\" \\\n    --headers \"Authorization=Bearer $ACCESS_TOKEN\" \"Content-Type=application/json\" \\\n    --body \"{\\\"roles\\\": [\\\"write\\\"], \\\"grantedToIdentities\\\": [{\\\"application\\\": {\\\"id\\\": \\\"$CLIENT_ID\\\", \\\"displayName\\\": \\\"$APP_DISPLAY_NAME\\\"}}]}\"\n```\n\n## Method 3 — PowerShell\n\nReplace the placeholder variable values at the top of the script with your actual values, then execute the full script. For installation, see [Install PowerShell](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell).\n\n```\n# Define Variables -- Replace placeholder values with actual values\n$tenantId = \"YOUR_TENANT_ID\"\n$clientId = \"YOUR_CLIENT_ID\"\n$clientSecret = \"YOUR_CLIENT_SECRET\"\n$tenantName = \"YOUR_TENANT\"\n$siteName = \"SITE_NAME\"\n$appDisplayName = \"APP_REGISTRATION_DISPLAY_NAME\"\n\ntry {\n    # Step 1: Get Access Token\n    $tokenResponse = Invoke-RestMethod -Method Post -Uri \"https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token\" -Body @{ grant_type = \"client_credentials\"; client_id = $clientId; client_secret = $clientSecret; scope = \"https://graph.microsoft.com/.default\" } -ContentType \"application/x-www-form-urlencoded\"\n    $accessToken = $tokenResponse.access_token\n    if (-not $accessToken) { throw \"Failed to retrieve access token.\" }\n\n    # Step 2: Get SharePoint Site ID\n    $siteResponse = Invoke-RestMethod -Uri \"https://graph.microsoft.com/v1.0/sites/$tenantName.sharepoint.com:/sites/$siteName\" -Method Get -Headers @{ \"Authorization\" = \"Bearer $accessToken\" }\n    $siteId = $siteResponse.id\n    if (-not $siteId) { throw \"Failed to retrieve SharePoint Site ID.\" }\n\n    # Step 3: Grant App Permissions\n    $body = @{ roles = @(\"write\"); grantedToIdentities = @(@{ application = @{ id = $clientId; displayName = $appDisplayName } }); displayName = \"$appDisplayName\" } | ConvertTo-Json -Depth 10\n    Invoke-RestMethod -Uri \"https://graph.microsoft.com/v1.0/sites/$siteId/permissions\" -Method Post -Headers @{ \"Authorization\" = \"Bearer $accessToken\"; \"Content-Type\" = \"application/json\" } -Body $body\n} catch { Write-Host \"Error: $_\" -ForegroundColor Red; exit 1 }\n```\n\n## External references\n\nThese references are external to ServiceNow® and are provided for tooling installation and API reference only. The commands above are sourced from the Major Security Incident Management Workspace UI, not from these external links.\n\n-   [Microsoft Graph API — Site Permissions reference](https://learn.microsoft.com/en-us/graph/api/site-post-permissions)\n-   [Microsoft Entra ID App Registration reference](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app)\n\n**Parent Topic:**[Integrate Major Security Incident Management with Microsoft SharePoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/integrate-msim-sharepoint.md)\n\n"}}