Questions on Sharepoint connectors and permissions

Help Integration Service
,
1

Hi all,

we are currently trying to get API connections to our M365 accounts. Our company has strict security rules and we need to apply for these connections. We need to list all necessary permissions and about that I’m not sure.
The required and optional permissions (for delegated permissions) are listed in Integration service which was very helpful already. So I added most of them to our list.

image
image826×270 9.25 KB

I’m not sure about the remaining ones, however:

  • Group.Read.All
  • Group.ReadWrite.All

Those two require Admin Consent (whatever that means).

Our robots (with their individual M365 accounts) access files and folders which have been directly assigned to them by the owners, with access permissions to only those files/folders, not their parents (for the most part).
The URLs look like this:

image
image523×172 2.58 KB

I edited the URLs in this list to look like root level URLs, they originally would look like that:

image

(I don’t know if that makes any difference in our application?)

Most say “teams”, few say “sites” - I don’t understand the difference really…

So here the questions:

  1. If the robots had access on root level, would it say “sites” instead of “teams”?

  2. If “teams” refers to Groups, do we need Group.Read permissions to handle files or will Files.Read and Sites.Read be enough?

  3. Additionally, I found this info here in the forum: 365 SharePoint - #15 by Anil_G - would we require access rights on much higher level in general then? I thought the purpose of delegated permissions was that it acts within the user’s granted access rights.

(Additional, maybe helpful, background info: we are blocked from using OneDrive synchronization in our company, so we cannot just access the files through synched OneDrive folders.)

Thank you for your help. This topic is really confusing for me, as I don’t have any IT background and all this stuff is twisting my brain…

2

Hi @Juli

First question that I would like to ask you - I see you are choosing delegated permissions, does that mean you will be using attended processes?

As per my understanding, delegated permission doesn’t work for unattended processes, you will need to use application level permissions for unattended processes.

3

Hi @sonaliaggarwal47

No, we are using unattended robots.
The activities for SharePoint/Onedrive will be used on runtime, so delegated is fine, since the robots are always logging in on their Virtual Machines with their own M365 accounts.

(We are requesting access to Outlook with Application permissions, so that we can use Event Triggers for emails.)

…Or did I misunderstand everything completely?
We cannot apply for Application permission if we require *.All permissions for some things to work. It will be denied by Headquarter.

Edit:
According to this, delegated is fine for unattended robots: Activities - How to connect to Microsoft 365 activities