Allow an application to access only selected SharePoint site collections after a separate site grant.

Why access still fails

• The app was granted a permission that does not cover the exact endpoint or method.
• The token contains delegated scopes when the app needs application roles, or application roles when a signed-in user is required.
• Consent was not completed, the token was not refreshed, or the signed-in user lacks the required Entra role or license.
• Admin consent alone grants no site access; a site-level permission assignment is also required.

Recommended setup

1. Confirm the exact endpoint and HTTP method, then select Sites.Selected only if its Microsoft method documentation lists it.
2. Choose delegated or application access and confirm this record supports that mode.
3. Grant admin consent only after the application, publisher, tenant, and requested permission have been reviewed.
4. Acquire a new token after the permission or consent change; old tokens do not gain new claims.
5. Retest the smallest read or write operation before expanding the application workflow.

Verify

1. Use Get-MgContext to confirm tenant, account, authentication type, and delegated scopes.
2. For delegated tokens, verify the scp claim; for app-only tokens, verify the roles claim contains the expected permission.
3. Confirm the token audience is Microsoft Graph and retry the exact endpoint with a new request ID.

Escalate when

• The endpoint documentation lists this permission, a new token contains the correct claim, and the request still returns 401/403.
• The same operation works for one identity or tenant but not another after role, license, ownership, and Conditional Access are compared.
• You can provide the UTC time, sanitized request/response, request ID, tenant/app IDs, token type, and granted permission list.