Skip to main content

​
What Flow indexes from SharePoint Scoped

Selected sites only ingests files and pages from SharePoint sites that an administrator explicitly grants to a dedicated Entra app. It uses Microsoft Graph Sites.Selected instead of tenant-wide Sites.Read.All. Use this when your security team will not approve tenant-wide SharePoint read access.

​
Prerequisites

  • A Microsoft Entra Privileged Role Administrator or Global Administrator who can grant consent in the Microsoft tenant you connect.
  • An administrator who can create the dedicated app registration.
  • A SharePoint Administrator who can grant the app to specific sites (Graph Explorer, curl, or PnP).
  • A Flow admin who can connect providers in Integrations.

​
Prepare the provider

SharePoint Scoped requires two separate approvals: The SharePoint Administrator role alone cannot grant application consent. Application Administrator and Cloud Application Administrator also cannot approve Microsoft Graph application permissions. See Microsoft’s application permission requirements. Sites.Selected limits which sites the app can access. It still requires Entra consent, followed by an explicit grant for each site. Consent alone gives the app no SharePoint site access. See Microsoft’s selected permission model.
1

Create a dedicated Entra app for SharePoint Scoped.

Do not reuse the broad SharePoint Online app.
2

Grant Microsoft Graph application permissions.

Sites.Selected, User.Read.All, and Group.Read.All (or GroupMember.Read.All).
3

Grant SharePoint (Office 365 SharePoint Online) application permission.

Sites.Selected.
4

Do not add application Sites.Read.All, Files.Read.All, or application Sites.FullControl.All.

5

Grant admin consent in the tenant you connect.

Ask an existing Privileged Role Administrator or Global Administrator to review and approve the app’s requested permissions. The SharePoint administrator does not need a permanent Global Administrator role.
6

For SharePoint site groups whose membership Flow must crawl, set Who can view the membership of this group to Everyone, or use Entra groups instead.

​
Connect in Flow

Open Integrations and choose SharePoint Online. After Teams, on the Permissions step, open Advanced and select Selected sites only. Enter up to 20 HTTPS SharePoint site URLs or Graph site IDs, then select Continue. This input names the intended sites. It does not grant the app access. Flow cannot list the tenant’s sites under Sites.Selected. Separate sites with newlines, commas, or spaces. If a URL path contains a space or comma, wrap the whole URL in double quotes, for example "https://contoso.sharepoint.com/sites/HR, Finance". You can also use %20 for a space and %2C for a comma. Keep each Graph site ID together, including its two commas. On Connect, check the selected sites and Microsoft organization. Open the tenant lookup’s Advanced section only if you need a different domain or Directory (tenant) ID. Complete authorization with the scoped app Client ID and certificate or secret. When Microsoft asks for consent, use the administrator account that can approve the application permissions. If another administrator approves a pending request, start the connection again from Flow after approval. After Entra consent, a SharePoint administrator must grant the app read access to each selected site. The administrator must use a separate grant tool authorized for Microsoft Graph Sites.FullControl.All, with sufficient SharePoint rights. The scoped app itself must not receive this broad permission. See Microsoft’s site permission API and selected permission model. For each site, the administrator can use Microsoft Graph to resolve its site ID and create the app permission. Replace the placeholders with the selected site’s host and path, its returned ID, and the scoped app’s Client ID:
Flow checks Entra consent and content access after authorization. If Entra consent is incomplete, setup shows Waiting for Microsoft Entra consent. Ask an Entra administrator to approve the listed permissions, then select Check admin consent. If Flow cannot read content from a selected site, setup shows Waiting for SharePoint site access. Ask a SharePoint administrator to check the app’s site grant and library access, then select Verify site access. Close for now saves setup in this browser for up to 24 hours. The retry window can be shorter while Flow verifies authorization. After it expires, authorize again with the saved selection. Select Discard setup to clear the saved setup and start again. After the connection completes, open its Knowledge tab and add a source. Flow automatically resolves the sites entered during connection. If a document library is readable but Site Pages is denied, the site remains available to browse. Flow shows which content it cannot read and disables whole-site selection. Choose accessible content or ask a SharePoint administrator to correct the app’s access. A successful connection check does not guarantee access to every library or file. Each new connection keeps its own authorization and selected sites. Reconnect updates the existing connection and preserves its selected sites. For each resolved site, choose how much to index:
  • Select the whole site. Selected sites are indexed together in one crawl.
  • Browse into the site and select a document library, a folder, a single file, Site pages, or a single site page. Each of these becomes its own source.
Sites.Selected does not include Microsoft Graph search, so SharePoint Scoped setup has no search box. Browse the granted site instead; each folder loads one page of items at a time with Load more. Repeat the resolve step for more sites. Content already added for this team is marked Already added and cannot be selected again. This label does not mean indexing has finished.

​
Sync and behavior

Flow supports the same file formats and indexing diagnostics as SharePoint Online, including textual CSV and Markdown. This does not require additional Microsoft permissions.
  • Flow polls granted sites on a schedule.
  • File permissions use Microsoft Graph item permissions.
  • Site pages are indexed with the same page access control list (ACL) model as SharePoint Online knowledge sources.
  • Near-real-time webhooks are not available under Sites.Selected.
  • A team connection is how you select granted sites. Read access follows the SharePoint permissions Flow crawled, not team membership. Connecting the source does not grant read, and it is not required for org-wide Knowledge or search. SharePoint does not expose per-page permissions for site pages, so the source’s Access for SharePoint pages option decides the audience those pages get: Allow the whole organization (the default) makes them readable by every Flow organization member; Restrict pages gives them no extra audience from SharePoint permissions. Either way, anyone Who can read this in Flow? covers can still read pages. That setting applies to the whole source, pages included. Change the option under Source options on the source.

​
Troubleshooting