Step 3: Set-up API Permissions in Azure (Graph API)
API Permissions
24Files operates using delegated permissions because it is designed to work with an integration user rather than relying on the client credentials grant flow. As a result, application permissions (which are typically used in system-to-system authentication) are not supported in 24Files.
Microsoft Graph Permissions
We will configure Microsoft Graph permissions.
Navigate to API permissions in the Azure portal. Click on Add a permission, scroll down and select Microsoft Graph.
Now select ‘Delegated permissions’. Use the search bar to quickly navigate to the options below.
Select following options:
Files.ReadWrite.All
offline_access
openid
Sites.ReadWrite.All
User.Read
After selecting these options, click “update permissions”.
A few more words on the permission:
Files.ReadWrite.All — access to files you can access (read/write)
This allows 24Files to create, read, update, and delete files in SharePoint that you have access to. We use this to: upload files, update file versions, and manage documents in the connected location.
Sites.ReadWrite.All — access to SharePoint sites you can access (read/write)
This allows the app to create, read, update, and delete items in SharePoint site collections that you have access to. We use this to: browse SharePoint sites/libraries and write documents to the correct SharePoint library.
User.Read — basic profile information
This lets 24Files read basic profile info (name, user ID/email) to identify the signed-in user and complete the sign-in process.
openid — sign-in
This is required to sign you in securely using Microsoft.
offline_access — keep access when you are not actively signed in
This allows the app to keep the connection active (via a refresh token) so it does not require you to log in again each time and can continue to perform authorized actions without interrupting users.
important notes
24Files can only access files/sites that the signed-in user is allowed to access in SharePoint, as we make use of delegated permissions.
Because read/write permissions include delete capability, we recommend:
connecting with a dedicated service account (if your IT policy requires it), and/or
restricting that account’s SharePoint access to only the libraries needed for the integration.
Grant admin consent
Click “Grant admin consent for {your_company}” next to “Add a permission”.
After you granted the permissions as described above, your granted permissions should look as follows:
