๐๐จ๐ฎ ๐๐๐ง ๐ง๐จ๐ฐ ๐๐ซ๐๐๐ญ๐ ๐๐ก๐๐ซ๐๐๐จ๐ข๐ง๐ญ ๐ฌ๐ข๐ญ๐ ๐๐จ๐ฅ๐ฅ๐๐๐ญ๐ข๐จ๐ง๐ฌ ๐๐ข๐ซ๐๐๐ญ๐ฅ๐ฒ ๐ฎ๐ฌ๐ข๐ง๐ ๐๐ข๐๐ซ๐จ๐ฌ๐จ๐๐ญ ๐๐ซ๐๐ฉ๐ก!
No more relying on legacy APIs. But hereโs the best part!
This update introduces a new low-privilege permission:
โจ ๐๐ข๐ญ๐๐ฌ.๐๐ซ๐๐๐ญ๐.๐๐ฅ๐ฅ โจ
โ Purpose-built for secure provisioning
โ Lets apps create new sites
โ DOES NOT allow reading other sites in the tenant
โ Auto-grants FullControl only on the site it creates
This is a huge shift from the old Sites.FullControl.All requirement โ which basically gave apps access to everything.
If youโre currently using Sites.FullControl.All:
โก๏ธ Replace with Sites.Create.All + Sites.Selected
โก๏ธ Add app permissions to existing sites via /permissions API
โก๏ธ Keep everything else mostly unchanged
The fact that it took this long is frustrating. But the fact that they built it RIGHT with true least-privilege architecture is worth celebrating.