ShareMaster V2 is in beta, a complete rebuild. See what is new and request access →
Features All features overview
Migration Tools Overview Structure and content OneDrive ↔ SharePoint Content only Structure only Move / Copy Upload from this computer Download to this computer Dropbox to SharePoint Resume and incremental runs
Recycling Bin Overview Browse a site's recycle bin Empty recycle bins in bulk Restore and purge history
Archive Overview Configure the tenant On Demand Archive Restore Archived Files Archive Savings Report Blob Viewer
Optimise Storage Tools Overview Delete all items in a list Delete all files and folders in a library Remove empty folders Remove duplicate files Reduce image sizes Delete sites and subsites
SharePoint Tools Overview Tenant Explorer SharePoint Explorer Easy Settings Fix renamed groups List Explorer Search the Preservation Hold Library
Replace Overview Replace in SharePoint Replace in local files Find password-protected files
Shared Links Overview Report shared links Report unique permissions Remove a person from sharing links Remove shared links Remove unique permissions
Version History Overview Version trimming Version trimming report Reset file version
Reports Overview Inventory report Folder inventory Site and subsite storage Security matrix Teams permissions Pre-migration analysis Compare items Dropbox to Microsoft 365 compare Duplicate file report Empty folder report Image size report Recycle bin report Unused licences Report history
V2 beta Pricing Demos Blog Guides Use cases Compare Tools Alerts FAQ Contact Sign in Start free trial
  1. Home
  2. Documentation
  3. Shared links

App permissions

Grant or revoke an app on one site

Applications registered with Sites.Selected can reach only the sites they have been granted, one site at a time. This shows every application granted access to one site, with the name your directory gives it beside the name typed in when it was granted, and lets you grant an app, change its role or revoke it.

Makes changes. Changes who can reach a site. A revoked grant can be granted again from Recent changes, with a new id.
On this page What it does How it runs How it works What you need What it will not do

What it does

  • Which applications can read or change this site, and with which role.
  • Whether a grant's name matches the app's real name in your directory. A grant can call itself anything, so a mismatch is worth a look.
  • Whether an app was registered by your own tenant or by another organisation.
  • What was granted, changed or revoked on this site, and when.

How it runs

  1. Sign in. One sign-in when you click the tile. All three credentials can list and change grants; only App authentication also reads app names from your directory.
  2. Choose a site. The shared site picker, or paste a URL.
  3. Read. Every grant on the site is read live. If the read is refused the page says so; it never shows that as no apps.
  4. Grant, change or revoke. Each change is checked against the live site first, saved as a record, confirmed, sent once and read back. Only Microsoft's own answer counts as done.

How it works

Every app grant on the site is read live when the page opens, and read again after every change; the grid is never filled from a saved copy. A read that SharePoint refuses is shown as a refusal, never as an empty list. Where the sign-in can read your directory, each app is looked up there, which gives its real name, whether your tenant or another organisation registered it, and whether that name differs from the one typed in when the grant was made. When you grant an app that is not registered in your tenant, the page warns that the grant will do nothing until the app is added.

Every change follows the same order. The grant is read again live, and if it is no longer what the screen showed, nothing is sent and the page says it changed. The grant as it is now is saved to a backup file on this computer; if the backup cannot be written, nothing is sent. Only then are you asked to confirm, and told where the backup is. The change is sent once, and the site's grants are read back. A read-back that does not show the app with the role you asked for is reported as a failure, and a read-back that cannot be read is reported as sent but not confirmed.

Grant is refused, unsent, when the live read shows the app already holds a grant on the site, and offers to change that grant's role instead. Change role sets the existing grant to exactly the role you pick, and must land on that same grant. Choosing Manage or Full control adds a warning that the app could then change who has access to the site.

Revoke removes the grant from the site, and there is nowhere it goes. The backup taken first is what Grant again works from: it creates a new grant for the same app, with the same name and role, through the same steps, and the new grant has a new id. Each backed-up change is listed under Recent changes for the site, with how it ended.

What you need

  • Site collection administrator on the site, in practice, to read or change its app grants. A certificate sign-in acts as ShareMaster's own app and needs no site role.
  • Seeing each app's directory name needs App authentication with permission to read applications in your directory (Application.Read.All). On a browser session or a certificate the name stored with the grant is shown instead, and the page says so.
  • Granting, changing and revoking need a paid plan. Listing is open on every plan.

What it will not do

  • One site at a time, and one app at a time. There is no bulk grant.
  • Grants made to a single list or item (Lists.SelectedOperations.Selected) are not covered.
  • Microsoft has no recycle bin for a grant. ShareMaster saves each grant before changing or revoking it, and Grant again recreates a revoked one with the same app, name and role, under a new id.
  • If an app already has a grant on the site, Grant offers to change its role instead: a second grant for the same app would be a duplicate.
  • Revoking one of ShareMaster's own Archive apps asks you to type the site name first.

See every feature