Revised 08/21/2026

  Run the permission script

1. Open 64-bit Windows PowerShell 5.1 or PowerShell 7.
2. Copy and run the command below.
3. Enter the complete SharePoint site or subsite URL when prompted.
4. Complete browser sign-in using a Global Administrator or SharePoint Administrator account for the client tenant.
5. Review Requested site and Grant scope (site collection).
6. If the displayed site collection is correct, type GRANT.
7. Confirm that the script reports SUCCESS.

PowerShelliex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/akoyago/public/refs/heads/main/scripts/deployment/Grant-akoyaGOSharePointSitePermission.ps1'))

If the script reports 403 accessDenied: In SharePoint admin center > Active sites, select the target site collection, open Membership > Site admins, and add the exact account shown under Signed in as. Wait for the change to propagate, run Disconnect-MgGraph, and rerun the script.

  How the script works

This article applies to Grant-akoyaGOSharePointSitePermission.ps1 version 0.10 or later. The script accepts either a site-collection URL or a subsite URL. If a subsite is entered, the script automatically resolves its containing site-collection root before creating or checking the permission grant.

Important: Sites.Selected is scoped at the site-collection level. Microsoft Graph cannot grant access to only a SharePoint subsite. If the entered URL is a subsite, Manage access applies to the entire containing site collection.

  Application and permission identifiers

Use these identifiers to distinguish the target integration application from the separate application used to sign in to Microsoft Graph.

Name	Type	Identifier	Purpose
BCO akoyaGO Integration	Application (client) ID	a86b9632-42bf-4dfe-83c8-bbc95145504b	The target enterprise application receiving site access.
Microsoft Graph	Resource application ID	00000003-0000-0000-c000-000000000000	The API resource used by the script and the integration.
Sites.Selected	Application role ID	883ea226-0bf2-4a8f-9f9d-92c9162a727d	Allows the target application to use explicitly selected site collections.
Sites.FullControl.All	Delegated scope ID	5a54b8b3-347c-476d-8f8e-42d5c7424d29	Allows the interactive provisioning client to manage site grants on behalf of the signed-in administrator.
Microsoft Graph Command Line Tools	Application (client) ID	14d82eec-204b-4c2f-b7e8-296a70dab67e	The Microsoft application normally used by Connect-MgGraph for interactive sign-in.

Note: An enterprise application's object ID is tenant-specific. In Entra ID > Enterprise applications, search by application (client) ID a86b9632-42bf-4dfe-83c8-bbc95145504b. Do not substitute the tenant-specific object ID for this client ID.

How site URLs are handled

The script uses Microsoft Graph metadata rather than assuming that a URL path represents a site collection.

Entered URL	Resulting grant scope	Behavior
https://akoyagoinc.sharepoint.com/d365-test	https://akoyagoinc.sharepoint.com	The entered URL is a subsite; the containing site collection is used.
https://akoyagoinc.sharepoint.com	https://akoyagoinc.sharepoint.com	The entered URL is already the tenant-root site collection.
https://akoyagoinc.sharepoint.com/constituents	Determined by Microsoft Graph	If this is a subsite, the script grants its containing site collection.
https://akoyagoinc.sharepoint.com/sites/akoyaGOdev	https://akoyagoinc.sharepoint.com/sites/akoyaGOdev	This is a separate site collection when Graph returns the siteCollection facet.
https://akoyago.sharepoint.com	https://akoyago.sharepoint.com	The entered URL is the tenant-root site collection for that tenant.

Scope warning: Two subsites in the same site collection share one application grant. They cannot be isolated from one another with Sites.Selected. Use separate site collections when separate application-access boundaries are required.

  Troubleshooting

Use the failing section, HTTP status, Graph error code, and request ID to identify the correct remediation.

403 accessDenied while finding the SharePoint site

Meaning: The failure occurred during the initial site lookup, before Graph inspected or changed the BCO application grant. The signed-in account has a tenant administrator role but does not have access to that site collection.

1. Check the exact account shown under Signed in as.
2. In SharePoint admin center > Active sites, select the target site collection.
3. Open Membership > Site admins and add that exact account.
4. Wait for the assignment to propagate, run Disconnect-MgGraph, and rerun the script.
5. After the application grant succeeds, the temporary site-admin assignment can be removed.

This error does not indicate a missing Sites.Selected permission on the BCO application.

400 Bad Request while checking site permissions

Older versions attempted to list permissions directly on a subsite, which Microsoft Graph does not support. Use script version 0.10 or later; it resolves subsites to their containing site-collection roots before accessing the permissions endpoint.

If the latest script reports this error for a confirmed site-collection root, retry once and provide support with the exact Graph method and URL, error body, request ID, client-request ID, and timestamp printed by the script.

An existing grant has a role other than Manage

The interactive script uses a delegated user token. Microsoft Graph does not support updating an individual site-permission record with that delegated token.

An administrator must remove or update the existing permission ID using an app-only Microsoft Graph connection with Sites.FullControl.All application permission. After the old grant is removed, rerun the script to create the Manage grant.

The wrong account or tenant is used

1. Compare Signed in as and Tenant ID with the intended client tenant.
2. Run Disconnect-MgGraph.
3. Rerun the script and select the correct site-admin account in the browser.
4. Confirm that the Graph context contains delegated Sites.FullControl.All and that tenant admin consent was granted.

  Unattended provisioning alternative

Organizations that cannot temporarily grant the operator site-admin access can use a dedicated provisioning application with certificate authentication and Microsoft Graph Sites.FullControl.All application permission.

This is a separate application from BCO akoyaGO Integration. It avoids dependence on the signed-in user's site membership, but it has tenant-wide SharePoint control and requires a separate security review, certificate lifecycle, admin-consent process, and deployment procedure.

  Information to provide to support

• The entered SharePoint URL and resolved site-collection URL.
• The section where the script failed.
• The HTTP status and Graph error code.
• The Graph request ID, client-request ID, and timestamp.
• The signed-in account, tenant ID, sign-in client application ID, and Graph site ID.
• The script version and Microsoft.Graph.Authentication module version.

Do not send access tokens, passwords, client secrets, or certificate private keys.

Related Resources

• Overview of Selected permissions in OneDrive and SharePoint
• List permissions on a SharePoint site
• Working with SharePoint sites in Microsoft Graph
• Microsoft Graph permissions reference
• Add or remove a SharePoint site collection administrator