Permission & Access Issues

How to Grant a Service Principal Access to a SharePoint Online Site

Maira Mehtab Sep 22, 2026 869 views

Question details

The user needs to grant an Azure app registration or service principal read access to a specific SharePoint Online site, but finds that traditional on-premises SharePoint cmdlets are unavailable.

Product: SharePoint Online
Device & OS: not provided
Scenario: Configuring site-specific application permissions for an Azure app registration or service principal in a cloud environment.
Observed behavior: Cmdlets such as Get-SPAuthenticationRealm and Set-AppPrincipalPermission fail or are unrecognized because they are not supported in SharePoint Online.

Before you start

Ensure you have global administrator or SharePoint administrator privileges in your Microsoft Entra ID tenant before attempting to modify service principal permissions or app registrations.

Solution 1Recommended

Manage Application Permissions via Microsoft Entra ID

Since on-premises SharePoint Server cmdlets are unsupported for SharePoint Online, you must use Microsoft Entra ID to manage site-specific application permissions.

Traditional cmdlets like Get-SPAuthenticationRealm and Set-AppPrincipalPermission are exclusively designed for on-premises SharePoint Server environments. For SharePoint Online, service principal access must be managed through cloud-supported authentication methods and API permissions.

Verify cmdlet compatibility

Acknowledge that on-premises SharePoint cmdlets will not function in SharePoint Online and immediately stop using them to prevent administrative errors.

Access Microsoft Entra ID

Log into the Microsoft Entra admin center (formerly Azure Active Directory) using an administrator account to manage your App Registrations.

Configure API permissions

Navigate to your target app registration, open API permissions, and assign the appropriate Microsoft Graph or SharePoint Online application permissions (such as Sites.Selected) for site-specific access.

Consult Microsoft Q&A experts

For advanced configurations regarding site-specific service-principal authentication, search for or post your specific scenario in the Microsoft Entra ID and SharePoint Online forums on Microsoft Q&A.

Free Microsoft Office alternative

Try WPS Office for Seamless Document Management

While configuring backend SharePoint environments requires Microsoft administration tools, managing and editing the actual documents stored there doesn't have to be complicated or expensive. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for all your everyday document needs.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx) commonly stored in SharePoint environments.Free and lightweight, reducing system resource consumption compared to heavier office suites.Familiar user interface ensuring a seamless migration from Microsoft Office with zero learning curve.All-in-one suite that handles documents, spreadsheets, presentations, and PDFs in a single application.

microsoft office alternative - wps office

Frequently Asked Questions

Why do I get an error when running Get-SPAuthenticationRealm in SharePoint Online?

This cmdlet is designed specifically for on-premises SharePoint Server environments. It is not supported in SharePoint Online, which relies on Microsoft Entra ID for authentication.

How can I grant site-specific access to an application in SharePoint Online?

You can achieve this by assigning the 'Sites.Selected' application permission to your Azure app registration via Microsoft Graph API, and then using a supported method (like PnP PowerShell or Graph API) to grant that application access to the specific site.

Can I use Set-AppPrincipalPermission for Microsoft 365 tenants?

No, Set-AppPrincipalPermission is an on-premises SharePoint cmdlet. For Microsoft 365 and SharePoint Online, you must manage service principal authentication and permissions entirely through Microsoft Entra ID.

Document & File Issues