> ## Documentation Index > Fetch the complete documentation index at: https://docs.letsflow.ai/llms.txt > Use this file to discover all available pages before exploring further. # SharePoint Scoped > Least-privilege SharePoint Online ingestion using Sites.Selected site grants. ## What Flow indexes from SharePoint Scoped **Selected sites only** ingests files and pages from SharePoint sites that an administrator explicitly grants to a dedicated Entra app. It uses Microsoft Graph `Sites.Selected` instead of tenant-wide `Sites.Read.All`. Use this when your security team will not approve tenant-wide SharePoint read access. ## Prerequisites * A Microsoft Entra **Privileged Role Administrator** or **Global Administrator** who can grant consent in the Microsoft tenant you connect. * An administrator who can create the dedicated app registration. * A SharePoint Administrator who can grant the app to specific sites (Graph Explorer, curl, or PnP). * A Flow admin who can connect providers in **Integrations**. ## Prepare the provider SharePoint Scoped requires two separate approvals: | Approval | Required administrator | What it allows | | - | - | - | | Microsoft Graph application consent | Privileged Role Administrator or Global Administrator | Authorizes the app's application permissions in Entra. | | Access to each SharePoint site | SharePoint Administrator with an authorized grant tool | Allows the app to read that site. | The SharePoint Administrator role alone cannot grant application consent. Application Administrator and Cloud Application Administrator also cannot approve Microsoft Graph application permissions. See [Microsoft's application permission requirements](https://learn.microsoft.com/en-us/graph/permissions-overview#application-permissions). `Sites.Selected` limits which sites the app can access. It still requires Entra consent, followed by an explicit grant for each site. Consent alone gives the app no SharePoint site access. See [Microsoft's selected permission model](https://learn.microsoft.com/en-us/graph/permissions-selected-overview#how-selected-scopes-work-with-sharepoint-and-onedrive-permissions). Do not reuse the broad SharePoint Online app. `Sites.Selected`, `User.Read.All`, and `Group.Read.All` (or `GroupMember.Read.All`). `Sites.Selected`. Ask an existing Privileged Role Administrator or Global Administrator to review and approve the app's requested permissions. The SharePoint administrator does not need a permanent Global Administrator role. ## Connect in Flow Open **Integrations** and choose **SharePoint Online**. After **Teams**, on the **Permissions** step, open **Advanced** and select **Selected sites only**. Enter up to 20 HTTPS SharePoint site URLs or Graph site IDs, then select **Continue**. This input names the intended sites. It does not grant the app access. Flow cannot list the tenant's sites under `Sites.Selected`. Separate sites with newlines, commas, or spaces. If a URL path contains a space or comma, wrap the whole URL in double quotes, for example `"https://contoso.sharepoint.com/sites/HR, Finance"`. You can also use `%20` for a space and `%2C` for a comma. Keep each Graph site ID together, including its two commas. On **Connect**, check the selected sites and Microsoft organization. Open the tenant lookup's **Advanced** section only if you need a different domain or Directory (tenant) ID. Complete authorization with the scoped app Client ID and certificate or secret. When Microsoft asks for consent, use the administrator account that can approve the application permissions. If another administrator approves a pending request, start the connection again from Flow after approval. After Entra consent, a SharePoint administrator must grant the app **read** access to each selected site. The administrator must use a separate grant tool authorized for Microsoft Graph `Sites.FullControl.All`, with sufficient SharePoint rights. The scoped app itself must not receive this broad permission. See [Microsoft's site permission API](https://learn.microsoft.com/en-us/graph/api/site-post-permissions?view=graph-rest-1.0) and [selected permission model](https://learn.microsoft.com/en-us/graph/permissions-selected-overview). For each site, the administrator can use Microsoft Graph to resolve its site ID and create the app permission. Replace the placeholders with the selected site's host and path, its returned ID, and the scoped app's Client ID: ```http theme={null} GET https://graph.microsoft.com/v1.0/sites/{hostname}:/{site-path} POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions Content-Type: application/json {"roles":["read"],"grantedToIdentities":[{"application":{"id":"{client-id}"}}]} ``` Flow checks Entra consent and content access after authorization. If Entra consent is incomplete, setup shows **Waiting for Microsoft Entra consent**. Ask an Entra administrator to approve the listed permissions, then select **Check admin consent**. If Flow cannot read content from a selected site, setup shows **Waiting for SharePoint site access**. Ask a SharePoint administrator to check the app's site grant and library access, then select **Verify site access**. **Close for now** saves setup in this browser for up to 24 hours. The retry window can be shorter while Flow verifies authorization. After it expires, authorize again with the saved selection. Select **Discard setup** to clear the saved setup and start again. After the connection completes, open its **Knowledge** tab and add a source. Flow automatically resolves the sites entered during connection. If a document library is readable but Site Pages is denied, the site remains available to browse. Flow shows which content it cannot read and disables whole-site selection. Choose accessible content or ask a SharePoint administrator to correct the app's access. A successful connection check does not guarantee access to every library or file. Each new connection keeps its own authorization and selected sites. Reconnect updates the existing connection and preserves its selected sites. For each resolved site, choose how much to index: * Select the whole site. Selected sites are indexed together in one crawl. * Browse into the site and select a document library, a folder, a single file, **Site pages**, or a single site page. Each of these becomes its own source. `Sites.Selected` does not include Microsoft Graph search, so SharePoint Scoped setup has no search box. Browse the granted site instead; each folder loads one page of items at a time with **Load more**. Repeat the resolve step for more sites. Content already added for this team is marked **Already added** and cannot be selected again. This label does not mean indexing has finished. ## Sync and behavior Flow supports the same [file formats and indexing diagnostics as SharePoint Online](/integrations/knowledge/sharepoint#sync-and-behavior), including textual CSV and Markdown. This does not require additional Microsoft permissions. * Flow polls granted sites on a schedule. * File permissions use Microsoft Graph item permissions. * Site pages are indexed with the same page access control list (ACL) model as SharePoint Online knowledge sources. * Near-real-time webhooks are not available under `Sites.Selected`. * A team connection is how you select granted sites. Read access follows the SharePoint permissions Flow crawled, not team membership. Connecting the source does not grant read, and it is not required for org-wide Knowledge or search. SharePoint does not expose per-page permissions for site pages, so the source's **Access for SharePoint pages** option decides the audience those pages get: **Allow the whole organization** (the default) makes them readable by every Flow organization member; **Restrict pages** gives them no extra audience from SharePoint permissions. Either way, anyone **Who can read this in Flow?** covers can still read pages. That setting applies to the whole source, pages included. Change the option under **Source options** on the source. ## Troubleshooting | Symptom | What to check | | - | - | | Microsoft shows **Need admin approval** | Ask a Privileged Role Administrator or Global Administrator in the tenant you connect to review and grant consent. SharePoint Administrator alone is insufficient, including for `Sites.Selected`. | | Connection fails with `access_denied` | Consent did not complete. If you requested admin approval, wait for approval, then start the connection again from Flow. Otherwise, ask the consenting administrator to check the Microsoft error details and tenant policies. | | Connect fails role check | Confirm the app has `Sites.Selected` and does not have `Sites.Read.All` / `Files.Read.All`, with admin consent. | | Tenant lookup fails | Open **Advanced** and enter the organization's initial Microsoft domain or paste the Directory (tenant) ID from Entra. | | Site resolve returns 403 | Confirm the site grant exists for this app on Graph (and SharePoint API if required). | | Site verification remains pending | Check the site URL or Graph ID, the app Client ID in each site's read grant, and the administrator's grant tool permissions. Entra consent alone gives the app no site access. | | Group members missing | Check SharePoint group membership visibility is **Everyone**, or use Entra groups. | | Files sync but no site pages | Open the site in SharePoint and confirm **Site Pages** exists under Site contents. Sites without a modern Site Pages library have no pages for Flow to index. Also confirm the app still has a `read` grant on that site. | | Connected file is not searchable | Check **Search index** for the reason. Use a supported format and encoding; CSV must contain text, not a renamed Excel workbook. Do not broaden site grants to fix a file-format problem. | ## Related topics * [SharePoint Online](/integrations/knowledge/sharepoint) * [Knowledge overview](/integrations/knowledge/overview) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.