Graph API: Sites Selected

5min
To setup granular permissions for the middleware application you will need to create an azure application that already has the permission Sites.Selected with admin consent granted. (See the below screenshot to setup granular permissions for the middleware application)asd
﻿
Once that is completed we will use the graph explorer to give permissions to our azure application for the selected site.
Visit https://developer.microsoft.com/en-us/graph/graph-explorer (login as a tenant admin)
In the URL input for query enter the following https://graph.microsoft.com/beta/sites/<insert-hostname>:/sites/<insert-site-name> (See example below) and click run query. **subsites are not supported
﻿
 In the response object copy the highlighted value under "id".  
(This is different for each tenant and site. Do not use the sample site id provided in the screenshot)
﻿
In URL input for query enter the following and run the following query. 
        https://graph.microsoft.com/beta/sites/<insert-site-id>/permissions﻿
 You may recieve a 403 forbidden access response. If so click modify response and consent the permissions 
﻿
Change the request from a GET to POST. Click request body tab and modify the following json object sample below with the applicable azure application id and display name for your organization.  Copy and paste the modified object into the request body tab. (You can get the azure app id and display name from the overview page of the azure application). Run the query.
﻿
JSON
{
  "roles": [
    "fullcontrol"
  ],
  "grantedToIdentities": [
    {
      "application": {
        "id": "Insert Azure Application ID",
        "displayName": "Insert Azure Application Display Name"
      }
    }
  ]
}
{
  "roles": [
    "fullcontrol"
  ],
  "grantedToIdentities": [
    {
      "application": {
        "id": "Insert Azure Application ID",
        "displayName": "Insert Azure Application Display Name"
      }
    }
  ]
}
﻿
﻿
Below is a screenshot if the permissions have been setup successful. 
﻿
﻿
Configure app within M365 - Application based permissions (recommended)
Anonymous Shared URL Configuration