The easy way to let an AI assistant read SharePoint is one consent: the Microsoft Graph application permission Sites.Read.All. Microsoft describes it in one line: "Allows the app to read documents and list items in all site collections without a signed in user." The setup finishes, the crawler never meets a closed site, and nobody keeps a list of sites.

The narrow way is Sites.Selected. It has one awkward step, and this post is about that step.

Sites.Selected starts at zero

Selected scopes "require an explicit assignment action", so an app that has only been consented "would initially have no access." Three things must be true before the indexer can read a site:

The app is consented for Sites.Selected in Entra ID.

The site is granted to that app with a role, through POST /sites/{siteId}/permissions .

The token the app presents carries the scope.

Miss one and "the application doesn't have access." An indexer needs the read role and nothing more: "Read the metadata and contents of the resource."

The…