# Setting Microsoft Graph permission scopes and retrieving the SharePoint Site ID

Most SharePoint file/site operations require a **Site ID**. This page explains the prerequisites and the quickest way to retrieve the ID from a browser.

## Prerequisites

1. **Authentication & credentials**: your app registration (client ID/tenant ID/secret or cert) must be set up correctly. For the overall credential setup and token concepts, see [Authentication](../../authentication/).
2. **Microsoft Graph permission scopes** on your app registration (see below).

## Choose your permission scopes

You need to add specific permissions (called “scopes”) depending on how broad you want your app’s access to be.

# Path A: Broad access (tenant-wide)

This is the easiest to set up, but it gives your app access to **every site and file** in your organization.

- **`Sites.ReadWrite.All`**: lets you query Graph to find the SharePoint Site ID and the document library (Drive) ID, and navigate the folder hierarchy.
- **`Files.ReadWrite.All`**: allows the actual manipulation of files (read/download/copy/upload/cut/delete).

# Path B: Scoped access (highly recommended)

This restricts your app so it can only access specific SharePoint sites that you explicitly authorize.

- **Permission**: add **`Sites.Selected`**.
- **Important**: by itself, this permission grants access to _nothing_.
  - After granting it in Azure, a SharePoint Administrator must use Microsoft Graph API or PnP PowerShell to explicitly grant your App ID “Write” access to the target Site Collection.

---

# Get the Site ID from your browser

1. Navigate to your SharePoint site.
   - Example: `https://tenant.sharepoint.com/sites/Marketing`
2. In the browser address bar, append `/_api/site/id` to the end of the URL.
   - Example: `https://tenant.sharepoint.com/sites/Marketing/_api/site/id`
3. Press Enter.
4. In the XML response, copy the value between the `<d:Id ...>` tags.
   - This value is your SharePoint Site ID.

# Troubleshooting

- If you see an authentication prompt or access denied, confirm you are signed in with the right Microsoft account and have permission to the site.
- If the response errors, make sure your base URL is the site root (for example, `.../sites/Marketing`) and not a deeper library/file URL.