Skip to content

Clarify behavior when both FSC.Manage.All and FSC.Selected are granted for admin and nonadmin #10763

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
lilealdai wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

Clarify behavior when both FSC.Manage.All and FSC.Selected are granted for admin and nonadmin #10763

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
26cdf32
Clarify behavior when both FSC.Manage.All and FSC.Selected are grante…
Apr 10, 2026
a9e0f9b
fix filestoragecontainertypemanageall link
Apr 10, 2026
3664737
update date
Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions docs/embedded/development/auth.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
title: SharePoint Embedded Authentication and Authorization
description: This article describes the authentication and authorization model for SharePoint Embedded applications.
ms.date: 04/02/2026
ms.date: 04/10/2026
ms.localizationpriority: high
---

Expand Down Expand Up @@ -35,15 +35,26 @@ SharePoint Embedded operations are exposed via Microsoft Graph. SharePoint Embed

SharePoint Embedded applications need to request the following Microsoft Graph permissions in their application manifest to work with SharePoint Embedded:

- **[FileStorageContainerType.Manage.All](/graph/permissions-reference#filestoragecontainermanageall)** to allow an application to create and manage container types on the owning tenant. This permission is only needed on the owning tenant where the container type is created.
- **[FileStorageContainerType.Manage.All](/graph/permissions-reference#filestoragecontainertypemanageall)** to allow an application to create and manage container types on the owning tenant. This permission is only needed on the owning tenant where the container type is created.
- **[FileStorageContainerTypeReg.Selected](/graph/permissions-reference#filestoragecontainertyperegselected)** to allow an application to register the container type on consuming tenants.
- **[FileStorageContainer.Selected](/graph/permissions-reference#filestoragecontainerselected)** to allow an application to access containers of the given container type on consuming tenants.

#### Access on behalf of a user

SharePoint Embedded operations [on behalf of a user](/graph/auth-v2-user) require applications to receive consent for Microsoft Graph **[FileStorageContainer.Selected](/graph/permissions-reference#filestoragecontainerselected)** delegated permission.
SharePoint Embedded operations [on behalf of a user](/graph/auth-v2-user) support two Microsoft Graph permissions: **[FileStorageContainer.Selected](/graph/permissions-reference#filestoragecontainerselected)**, which allows an application to access containers on behalf of the signed-in user, and **[FileStorageContainer.Manage.All](/graph/permissions-reference#filestoragecontainermanageall)**, which allows an application to utilize file storage container administration capabilities on behalf of an administrator.

In addition to your application receiving consent for **[FileStorageContainer.Selected](/graph/permissions-reference#filestoragecontainerselected)** on a consuming tenant, the user that it's acting on behalf of is required to have [user permissions](#user-permissions). The effective permissions that the application has are the intersection of the application permissions and the user permissions when acting on behalf of a user.
For APIs that support both **FileStorageContainer.Selected** and **FileStorageContainer.Manage.All** permissions, the effective access depends on the permissions granted to the application and whether the user is an administrator.

| User | Permissions granted | Effective access |
| :--------------- | :------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Administrator | FileStorageContainer.Selected | The application can access containers on behalf of the user as a nonadministrator. Administrator capabilities aren't applicable. |
| Administrator | FileStorageContainer.Manage.All | The application utilizes file storage container administration capabilities on behalf of the administrator. |
| Administrator | FileStorageContainer.Selected, FileStorageContainer.Manage.All | The application utilizes file storage container administration capabilities on behalf of the administrator. FileStorageContainer.Selected isn't applicable. |
| Nonadministrator | FileStorageContainer.Selected | The application can access containers on behalf of the nonadministrator user. |
| Nonadministrator | FileStorageContainer.Manage.All | Access denied. |
| Nonadministrator | FileStorageContainer.Selected, FileStorageContainer.Manage.All | The application can access containers on behalf of the nonadministrator user. FileStorageContainer.Manage.All isn't applicable. |

In addition to your application receiving consent for the required permissions on a consuming tenant, the user that it's acting on behalf of is required to have [user permissions](#user-permissions). The effective permissions that the application has are the intersection of the application permissions and the user permissions when acting on behalf of a user.

> [!IMPORTANT]
> Using SharePoint Embedded on behalf of a user is the recommended approach. This type of access enhances the security of your application. It also improves the auditability of actions performed by your application.
Expand Down