Azure AD APP API Sites.Selected

This is always an issue to control SharePoint sites permission access. If this is for the user or the Application. 

User permission can be controlled by SharePoint permission list but Application permission can not be controlled directly and that is possible from the Application configuration through graph API . 

1) Select sites.selected from API for requested App

2) Run PS script to allow respective app to connect with specific SharePoint site with provided roles only

    

Install-Module -Name PnP.PowerShell -RequiredVersion 1.12.0

Install-Module PnP.PowerShellc
Get-Command -Module PnP.Powershell

#Connect with PnP online
# NO WEBLOGIN This will work with Get-Credential ONLY having Global Admin rights
Connect-PnPOnline -Url "https://miracl.sharepoint.com/sites/testsite-1/" -Credential (Get-Credential)

#Get All Lists
Get-PnPList

1) Approach-1

Grant-PnPAzureADAppSitePermission -AppId 'e5b3606c-341c-492f-8b65-e109c94be' -DisplayName 'TESTSP' -Site 'https://miracl.sharepoint.com/sites/testsite-1' -Permissions Write
Grant-PnPAzureADAppSitePermission -AppId 'e5b3606c-341c-492f-8b65-e109c94be' -DisplayName 'TESTSP' -Site 'https://miracl.sharepoint.com/sites/testsite-1' -Permissions Read

here -DisplayName can be any name , just to recognize the configured app
below command will confirm the applied changes.
Get-PnPAzureADAppSitePermission -Site https://miracl.sharepoint.com/sites/testsite-1

2) Approach-2

Need to execute two commandlets. 

First grant Read or Write permissions. Then update it to Manage or FullControl

https://www.blimped.nl/running-application-with-limited-sharepoint-permissions/

https://www.leonarmston.com/2022/01/pnp-powershell-csom-now-works-with-sharepoint-sites-selected-permission-using-azure-ad-app/

$PermissionId = Get-PnPAzureADAppSitePermission -AppIdentity e5b3606c-341c-492f-8b65-e109c94be
# $PermissionId will return ID, Roles and Apps name and ID

Set-PnPAzureADAppSitePermission -Site https://miracl.sharepoint.com/sites/testsite-1 -PermissionId $(($PermissionId).Id) -Permissions "FullControl"
Set-PnPAzureADAppSitePermission -Site https://miracl.sharepoint.com/sites/testsite-1 -PermissionId $(($PermissionId).Id) -Permissions "Read"
Set-PnPAzureADAppSitePermission -Site https://miracl.sharepoint.com/sites/testsite-1 -PermissionId $(($PermissionId).Id) -Permissions "Write"
Set-PnPAzureADAppSitePermission -Site https://miracl.sharepoint.com/sites/testsite-1 -PermissionId $(($PermissionId).Id) -Permissions "Manage"

Revoke the Access

Connect-PnPOnline -Url $siteURL -Interactive
$PermissionId = Get-PnPAzureADAppSitePermission -AppIdentity  $appID 
Revoke-PnPAzureADAppSitePermission -PermissionId $PermissionId.Id -Force

Test with Client ID and Secret

$abc=Connect-PnPOnline -Url "https://miracl.sharepoint.com/sites/testsite-2" -ClientId "920cf67c-2973-423a-b419-" -ClientSecret "Rol8Q~WyNV_fA0IdCXWfyl5hhq2V5LA5_PMBLakt"
Get-PnPWeb

New-PnPList -Title "Contoso AD App List" -Template GenericList

###################

Complete Script is mentioned in another blog

###################

Copy page from one sharepoint site to other sharepoint site

    
    $group_list = Import-Csv 'C:\WW\SiteList.csv'
      
    $srcUrl = "https://shared.sharepoint.com/sites/fj-mech-dev/"
    $pageName = "Home-Team.aspx" 

    #$cred = Get-Credential  
    Connect-PnPOnline -Url $srcUrl -Credentials $cred 

    #$Cred=Get-Credential

  foreach ($group in $group_list) 
    
    {


            try {  
     
            $destUrl = $group.SiteName #Read-Host "Enter the destination site url"  
             
                         
            $tempFile = [System.IO.Path]::GetTempFileName();  
            
            Export-PnPClientSidePage -Force -Identity $pageName -Out $tempFile  
            
            Connect-PnPOnline -Url $destUrl -Credentials $cred  
            
            Invoke-PnPSiteTemplate -Path $tempFile
            
            $group.SiteName  
            Write-Host "ModernPage is successfully copied."  
            
            sleep 10 
            Set-PnPHomePage -RootFolderRelativeUrl "sitepages/Home-Team.aspx"#$pageName
        } catch {  
            $group.SiteName
            Write-Host -ForegroundColor Red 'Error ', ':'  
            $Error[0].ToString(); 
           
            sleep 10  
        }



    }

Add all users except guest account as a Sharepoint online site viewer access

 

$SiteURL = "https://test.sharepoint.com/sites/team"
Connect-PnPOnline -Url $SiteURL -UseWebLogin
$Group = Get-PnPGroup -AssociatedVisitorGroup
$User = "Everyone except external users"
Add-PnPGroupMember -LoginName $User -Identity $Group

Create Headerless search result plage

#1)Create a page with normal layout in SharePoint
Connect-PnPOnline https://shared.sharepoint.com/sites/IT
Get-PnPClientSidePage -Identity results
Set-PnPClientSidePage -Identity results -LayoutType HeaderlessSearchResults

Get the office 365 Compliance report

Install-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement

$Credential = Get-Credential #-credential  used to connect Azure AD 

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $Credential -Authentication Basic -AllowRedirection
Import-PSSession $Session -DisableNameChecking -AllowClobber

$StartDate=(((Get-Date).AddDays(-30))).Date  # Report for last 30 days 
$EndDate=Get-Date
$Operation="UserLoggedIn" #Login details
$Results=Search-UnifiedAuditLog  -UserIds 'Abc@abc.com' -StartDate $StartDate -EndDate $EndDate -operations $Operation -ResultSize 1 |select UserIds , CreationDate 
$Results

Finding data in CSV file from other CSV file

#http://hilite.me/
#Create folder 
$Path = "C:\Temp\PowerShell - Enterprise\PSTN\90 days" # Location of file to be saved
$PSTNLicenseUserSource = Import-Csv -Path "$($path)\PSTNLicenseUserDomesticlCalling120.csv" # CSV file having list of user with license 
$30DaysTeamsLogs = Import-Csv -Path "$($path)\TeamsLogs.csv" # CSV file downloaded from Teams logs for last 30 days 

$Datetime= Get-Date -Format dd_MM_yyyy_HH.mm.ss
$LogFileName=([string]::Concat("$($path)\Teams_Report " , $Datetime ,".csv"))
New-Item  $LogFileName  -ItemType file
Add-Content $LogFileName -Value ([string]::Concat("Email"+","+ "Total Call" +","+ "Accessed in 30 days Yes/No"))


    ForEach ($PSTNLicenseUser in $PSTNLicenseUserSource)
    {

        $30DaysTeamLogsSingleUserData = $30DaysTeamsLogs |  where {$_.UPN -eq $PSTNLicenseUser."User principal name" } 
        
        $DataMatchInTeamsLogs =  $30DaysTeamLogsSingleUserData | Select-Object -first 1

        If($DataMatchInTeamsLogs) # If record gets found 
        {
        
            
            #Write-Host $DataMatchInTeamsLogs.UPN -ForegroundColor green
            #Add-Content $LogFileName -Value ([string]::Concat($($DataMatchInTeamsLogs.UPN) +","+ $($DataMatchInTeamsLogs."Duration Seconds") +","+ "Yes"))

        
        }
        else #Unable to find the record
        {

        Write-Host $PSTNLicenseUser."User principal name" -ForegroundColor white
        Add-Content $LogFileName -Value ([string]::Concat($($PSTNLicenseUser."User principal name") +","+ "0" +","+ "No"))
        }
    }

Azure AD service principal enterprise app disable

try 
    { 

        $var = Get-AzureADTenantDetail 
    } 

   catch [Microsoft.Open.Azure.AD.CommonLibrary.AadNeedAuthenticationException] 
    { 
        Write-Host "You're not connected."; 
        Write-Host -ForegroundColor Red " *** Error With Azure AD Connection **" 
              
       
        $Credential = Get-Credential #-credential  used to connect Azure AD 
        Connect-AzureAD -Credential $Credential

    }

$Path = "C:\Temp\PowerShell - Enterprise\Process" # Location of file to be saved

Get-AzureADServicePrincipal -All $true | Export-Csv -Path ""$($path)\Processes.csv"" -NoTypeInformation # Pull the list of all enterprise apps in the Tenant
$AppListSource = Import-Csv -Path "$($path)\Processes.csv" # Read the CSV file having list of all Apps name , 


$Datetime= Get-Date -Format dd_MM_yyyy_HH.mm.ss
$LogFileName=([string]::Concat("$($path)\Apps_Report " , $Datetime ,".csv"))
New-Item  $LogFileName  -ItemType file
Add-Content $LogFileName -Value ([string]::Concat("Application Display Name"+","+ "Oject ID" +","+ "App ID"+","+ "Application Access Dates"+","+ "UserPrincipalName"))


    ForEach ($AppNameSource in $AppListSource)
    {

        
        
        $varAppId = $AppNameSource.AppId
        
        $LoginDetails  = Get-AzureAdAuditSigninLogs -top 1 -filter "AppId eq '$varAppId'" | select CreatedDateTime, userprincipalname 

             
            
           Write-Host $AppNameSource.DisplayName "--"   $LoginDetails.userprincipalname  -ForegroundColor white
           Add-Content $LogFileName -Value ([string]::Concat($($AppNameSource.DisplayName) +","+ $($AppNameSource.ObjectId) +","+ $($AppNameSource.AppId)+","+ $LoginDetails.CreatedDateTime+","+ $LoginDetails.userprincipalname))

           $value = $LoginDetails.userprincipalname
           
                if ( $value -ne $null )
            {
                

                 $appId = $AppNameSource.AppId

                # Check if a service principal already exists for the app
                $servicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$appId'"
                if ($servicePrincipal) {
                # Service principal exists already, disable it
                  Set-AzureADServicePrincipal -ObjectId $servicePrincipal.ObjectId -AccountEnabled $false
                } 

            }

        
       
    }