RUN-GRAPH-001 / SOURCE CONTROLLED
Microsoft Graph Selected-permission review runbook
Use when an unattended application accesses a bounded SharePoint workload but holds broad Microsoft Graph application permission such as Sites.ReadWrite.All.
Authority and zero gate
- Name business, application, SharePoint and security owners.
- Classify active incident versus planned least-privilege migration.
- Freeze unapproved consent and credential changes.
- Preserve service-principal sign-in, consent, deployment and API evidence.
- Never record credential values or access tokens in the review pack.
Identity and authority inventory
| OBJECT | CAPTURE | PROOF |
|---|---|---|
| Application | App ID, object ID, tenant, publisher, owners | Application export |
| Service principal | Object ID, enabled state, app-role assignments | Enterprise-app export |
| Credentials | Type, key ID, owner, store, expiry | Metadata only |
| Token | Audience, tenant, app identity, roles, issue/expiry | Redacted decoded claims |
| SharePoint grants | Site/list/item, app identity, role | Permission resource output |
| Host | Runtime, deployment source, vault/RBAC, network | Configuration evidence |
Operation-to-permission contract
| OPERATION | RESOURCE | ENDPOINT/METHOD | MINIMUM ROLE | FAILURE EFFECT |
|---|---|---|---|---|
| Resolve target | Known site | Record exact call | Prove Selected fit | Stop; no broad discovery fallback |
| Read source state | Named list/library | Record exact call | Read | Visible retry/reconcile |
| Create/update | Named list/library | Record exact call | Write | Idempotent replay |
| Delete/manage | Explicit item/site | Record exact call | Only if approved | Business approval required |
Populate this table from code and observed traffic. Do not select permissions from product names alone.
Selected-permission implementation
- Choose the narrowest supported Selected scope: site, list, list item/folder or file.
- Grant that scope to the runtime application in Entra ID.
- Using a separate authorised grantor, create the explicit resource permission with the minimum role.
- Acquire a new runtime token containing the Selected scope.
- Test every contracted endpoint on the target.
- Remove global SharePoint application roles only after the bounded path passes.
- Acquire another new token and prove unrelated-resource denial.
Selected scope consent without a resource assignment provides no access. A resource assignment without the matching token scope also provides no access.
Positive and negative matrix
| TEST | EXPECTED | EVIDENCE |
|---|---|---|
| Contracted target operations | Success | Business record + Graph status |
| Unrelated project site | Denied | Fresh-token response |
| Sensitive finance/people site | Denied | Fresh-token response |
| Similarly named site | Denied | Fresh-token response |
| Out-of-scope list/item | Denied when narrower grant used | Fresh-token response |
| Permission/grant modification | Denied to runtime | Graph response |
| Credential revocation | New token denied | Sign-in/token result |
Credential and host control
- Prefer managed identity or workload identity federation where supported.
- Otherwise govern certificate or client-secret storage, rotation, expiry and revocation.
- Separate development, test and production identities and sites.
- Remove departed owners; retain accountable primary and backup operators.
- Constrain host, vault and pipeline rights independently of Graph consent.
- Never give the runtime identity consent-granting or resource-granting authority.
Release and review gate
Release only when every contracted operation passes, every prohibited resource is denied with a fresh token, the broad app role is absent, the explicit resource grant matches the intended application and role, obsolete credentials are revoked, and a second operator can rotate or disable the workload. Review quarterly and after code, endpoint, owner, credential, hosting or consent changes.
Limits
Selected permissions constrain supported SharePoint and OneDrive resource access; they do not constrain unrelated Graph permissions, Azure RBAC, host compromise or the damage possible inside the granted resource. Endpoint compatibility must be tested. This runbook does not authorise incident closure, consent grant or deletion of an unknown enterprise application.