Grant Power Shell App access to only 1 Sites.Selected

Use a Sites.Selected permission model and grant the PowerShell app access only to the specific site.

High-level steps:

1. Register or identify the Microsoft Entra application used by the PowerShell script.
2. Assign it only Sites.Selected (not Sites.Read.All or Sites.FullControl.All) in Microsoft Graph / SharePoint.
3. Grant site-level permissions for just the target site using PnP PowerShell.

From the context, PnP PowerShell supports resource-specific consent (RSC) for SharePoint Online:

1. Connect to the target site with PnP PowerShell (using an admin account):

      Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/TargetSite -Interactive
   

2. Grant the Entra app permissions only on that site:

      Grant-PnPAzureADAppSitePermission \
        -AppId {client-id} \
        -DisplayName "PowerShell App" \
        -Permissions Write \
        -Site (Get-PnPSite)
   

   • {client-id} is the Entra app’s client ID used by the PowerShell script.
   • -Permissions can be Read, Write, Manage, or FullControl depending on what the script needs.

This grants the app access only to that specific site collection. Because the app has only Sites.Selected at the tenant level, it cannot access any other sites unless similar site-level permissions are granted elsewhere.

When running the PowerShell script, authenticate using that Entra app (for example via certificate-based auth with PnP PowerShell or Microsoft Graph SDK). The script will then be limited to the designated site.

References:

• Understanding Resource Specific Consent for Microsoft Graph and SharePoint Online
• Alternative model for web app policies in SharePoint Online
• Output the results$results | Format-Table -AutoSize