---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Commands to grant Azure application access to the Microsoft SharePoint site

# Commands to grant Azure application access to the Microsoft SharePoint site {#ariaid-title1}

* Release version: Australia
* 
* Updated July 3, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Commands to Grant Azure Application Access to the Microsoft SharePoint Site

This guide provides three command-line methods to grant write access permissions to a registered Azure application on a Microsoft SharePoint site using the Microsoft Graph API.
Each method accomplishes the same goal, allowing ServiceNow customers to choose the approach that best fits their existing tools and environment.
The documented commands require replacing placeholder values with your tenant-specific Azure and SharePoint details.
Show full answer Show less  

## Prerequisites and Key Parameters

* **Tenant ID:** Your Azure Active Directory tenant identifier.
* **Client ID and Secret:** Credentials from your Azure app registration.
* **Tenant and Site Names:** Your Microsoft 365 tenant subdomain and SharePoint site name.
* **App Display Name:** The registered Azure application's display name.

These values are required to authenticate, retrieve the SharePoint site ID, and assign permissions.

## Methods to Grant Permissions

* **Method 1 -- Curl:** Three-step process involving obtaining an OAuth token, retrieving the SharePoint site ID, and posting the write permission assignment using raw REST API calls.
* **Method 2 -- Azure CLI:** Bash script that authenticates as a service principal, fetches the access token and site ID, then grants write permissions. This method requires Azure CLI installed and configured.
* **Method 3 -- PowerShell:** PowerShell script that performs the same three steps with error handling. Requires PowerShell and appropriate modules installed.

## What This Enables

By executing any of these methods, ServiceNow customers can programmatically grant their Azure-registered application write access to a specific SharePoint site. This is essential for integrations or automations that need to manipulate SharePoint content securely using Azure service principals.

## Important Notes

* Only one method needs to be used; choose based on your environment and tool availability.
* The commands are for reference and sourced from ServiceNow's Major Security Incident Management Workspace UI, not external vendors.
* External documentation is available for Microsoft Graph API site permissions and Azure app registration but is not required to follow these commands.  
Use one of the following three methods to grant your registered Azure application
write access to the Microsoft SharePoint site at the site level, using the Microsoft Graph
API.
Note:  
These commands are provided for reference only and are not sourced from an external tool vendor. Only one method is required --- choose the method that best matches what the Azure administrator already has installed. All three methods achieve the same result.
{#grant-azure-app-access-sharepoint-site-commands__table_placeholders_khg__entry__3}

| Placeholder | Example value | Where to find it |
|-|-|-|
| YOUR_TENANT_ID | xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx | Azure App Registration \> Overview \> Directory (tenant) ID |
| YOUR_CLIENT_ID | yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy | Azure App Registration \> Overview \> Application (client) ID |
| YOUR_CLIENT_SECRET | abc123XYZ\~mySecretValue | Azure App Registration \> Certificates \& secrets \> Client secrets \> Value |
| YOUR_TENANT / TENANT_NAME | contoso | The Microsoft 365 tenant name --- the subdomain before .sharepoint.com |
| YOUR_SITE_NAME / SITE_NAME | MSIMSite | The Microsoft SharePoint site name --- the relative path segment after /sites/ |
| APP_REGISTRATION_DISPLAY_NAME | Microsoft SharePoint Graph | The display name entered when registering the App |
| YOUR_TOKEN_FROM_STEP1 | eyJ0eXAiOiJKV1Qi... | Curl method only --- the access_token value from the Step 1 response |
| YOUR_SITE_ID_FROM_STEP_2 | contoso.sharepoint.com,abc123,def456 | Curl method only --- the id value from the Step 2 response |
[Table 1. Values to replace in the commands below]

{#grant-azure-app-access-sharepoint-site-commands__table_placeholders_khg}

## Method 1 --- Curl

Replace all placeholders with values from the table above before executing. Copy
the access_token from Step 1 and the site id from Step 2 for use in Step 3.

    # Step 1: Get OAuth Token for the Registered Azure Application
    curl --location --request GET 'https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/token' \
        --header 'accept: application/json' \
        --data-urlencode 'grant_type=client_credentials' \
        --data-urlencode 'client_id=YOUR_CLIENT_ID' \
        --data-urlencode 'client_secret=YOUR_CLIENT_SECRET' \
        --data-urlencode 'scope=https://graph.microsoft.com/.default'
    # From the response JSON, copy the access_token value -- this becomes YOUR_TOKEN_FROM_STEP1

    # Step 2: Retrieve SharePoint Site ID
    curl --location 'https://graph.microsoft.com/v1.0/sites/YOUR_TENANT.sharepoint.com:/sites/YOUR_SITE_NAME' \
        --header 'Authorization: Bearer YOUR_TOKEN_FROM_STEP1'
    # From the response JSON, copy the id value -- this becomes YOUR_SITE_ID_FROM_STEP_2

    # Step 3: Grant Azure Application Permissions to the SharePoint Site
    curl --location 'https://graph.microsoft.com/v1.0/sites/YOUR_SITE_ID_FROM_STEP_2/permissions' \
        --header 'Content-Type: application/json' \
        --header 'Authorization: Bearer YOUR_TOKEN_FROM_STEP1' \
        --data '{"roles": ["write"], "grantedToIdentities": [{"application": {"id": "YOUR_CLIENT_ID", "displayName": "APP_REGISTRATION_DISPLAY_NAME"}}]}'

## Method 2 --- Azure CLI

Replace the placeholder variable values at the top of the script with your actual
values, then execute the full script. Requires the Azure CLI. For installation,
see [Install Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli).

    #!/bin/bash
    # Replace placeholder values with your actual values
    TENANT_ID="YOUR_TENANT_ID"
    CLIENT_ID="YOUR_CLIENT_ID"
    CLIENT_SECRET="YOUR_CLIENT_SECRET"
    TENANT_NAME="YOUR_TENANT"  # e.g., contoso
    SITE_NAME="YOUR_SITE_NAME"
    APP_DISPLAY_NAME="APP_REGISTRATION_DISPLAY_NAME"

    # Authenticate with Azure AD (without requiring a subscription)
    az login --service-principal -u "$CLIENT_ID" -p "$CLIENT_SECRET" --tenant "$TENANT_ID" --allow-no-subscriptions

    # Get access token for Microsoft Graph API
    ACCESS_TOKEN=$(az account get-access-token --resource https://graph.microsoft.com --query accessToken --output tsv)
    if [ -z "$ACCESS_TOKEN" ]; then echo "Failed to retrieve access token." >&2; exit 1; fi

    # Fetch SharePoint Site ID
    SITE_ID=$(az rest --method GET --uri "https://graph.microsoft.com/v1.0/sites/$TENANT_NAME.sharepoint.com:/sites/$SITE_NAME" --headers "Authorization=Bearer $ACCESS_TOKEN" --query "id" --output tsv)
    if [ -z "$SITE_ID" ]; then echo "Failed to retrieve SharePoint Site ID." >&2; exit 1; fi

    # Grant App Permissions to SharePoint Site
    az rest --method POST --uri "https://graph.microsoft.com/v1.0/sites/$SITE_ID/permissions" \
        --headers "Authorization=Bearer $ACCESS_TOKEN" "Content-Type=application/json" \
        --body "{\"roles\": [\"write\"], \"grantedToIdentities\": [{\"application\": {\"id\": \"$CLIENT_ID\", \"displayName\": \"$APP_DISPLAY_NAME\"}}]}"

## Method 3 --- PowerShell

Replace the placeholder variable values at the top of the script with your actual
values, then execute the full script. For installation, see [Install PowerShell](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell).

    # Define Variables -- Replace placeholder values with actual values
    $tenantId = "YOUR_TENANT_ID"
    $clientId = "YOUR_CLIENT_ID"
    $clientSecret = "YOUR_CLIENT_SECRET"
    $tenantName = "YOUR_TENANT"
    $siteName = "SITE_NAME"
    $appDisplayName = "APP_REGISTRATION_DISPLAY_NAME"

    try {
        # Step 1: Get Access Token
        $tokenResponse = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Body @{ grant_type = "client_credentials"; client_id = $clientId; client_secret = $clientSecret; scope = "https://graph.microsoft.com/.default" } -ContentType "application/x-www-form-urlencoded"
        $accessToken = $tokenResponse.access_token
        if (-not $accessToken) { throw "Failed to retrieve access token." }

        # Step 2: Get SharePoint Site ID
        $siteResponse = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/sites/$tenantName.sharepoint.com:/sites/$siteName" -Method Get -Headers @{ "Authorization" = "Bearer $accessToken" }
        $siteId = $siteResponse.id
        if (-not $siteId) { throw "Failed to retrieve SharePoint Site ID." }

        # Step 3: Grant App Permissions
        $body = @{ roles = @("write"); grantedToIdentities = @(@{ application = @{ id = $clientId; displayName = $appDisplayName } }); displayName = "$appDisplayName" } | ConvertTo-Json -Depth 10
        Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/sites/$siteId/permissions" -Method Post -Headers @{ "Authorization" = "Bearer $accessToken"; "Content-Type" = "application/json" } -Body $body
    } catch { Write-Host "Error: $_" -ForegroundColor Red; exit 1 }

## External references

These references are external to ServiceNow® and are provided for tooling installation and API
reference only. The commands above are sourced from the Major Security Incident Management Workspace UI, not from these external links.

* [Microsoft Graph API --- Site Permissions reference](https://learn.microsoft.com/en-us/graph/api/site-post-permissions)
* [Microsoft Entra ID App Registration reference](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app)
{#grant-azure-app-access-sharepoint-site-commands__ul_external_refs_khg}