New Permission Required for SharePoint Online Because of Switch to Graph APIs
Article ID: 83163
Article Type: Troubleshooting
Last Modified:
Commvault SharePoint Online agent uses CSOM APIs. Microsoft will start deprecating ACS authorization used for CSOM APIs on November 1, 2024, with complete deprecation on April 2, 2026. For complete details, see Microsoft's documentation article: Azure ACS retirement in Microsoft 365.
Additionally, Microsoft strongly recommends switching to Graph APIs because of the eventual retirement of CSOM APIs for SharePoint Online. Commvault is taking steps to prepare for this transition from CSOM to Graph APIs starting in Feature Release 11.36.
Graph APIs require the additional permission Sites.FullControl.All for the Azure App.
Symptoms
Any of the following symptoms indicate that you need to add the SharePoint permission for your Azure apps.
- The error "Sites.FullControl.All permission is missing in Job Status, please check Configuration tab - Verify Connection details" appears in the GUI.
- The SharePoint Connection Settings status indicates that this permission is missing.
- The Verify Connection initiated dialog box displays the message "'Sites.FullControl.All' permission is missing."
Causes
Commvault is switching to Microsoft Graph APIs. Graph APIs require the additional permission Sites.FullControl.All for Azure Apps.
Resolution
To resolve this issue, add the Sites.FullControl.All permission for all Azure Apps you use.
Log on to the Azure portal (https://portal.azure.com/) using your global admin user account.
1. Navigate to Microsoft Entra ID and click on App registrations
2. Under All Applications locate your Azure Application and click to open its properties
3. Under the Azure Application page for your app, click the API Permissions link under the Manage section of the Navigation pane.
4. Check to see if Sites.FullControl.All is in the list, if not click Add a permission to add it.
5. On the Request API permissions screen, under the Microsoft APIs tab select Microsoft Graph
6. Select Application permissions, filter the results by Sites.FullControl.All, select the checkbox next to the permission, and select Add permissions.
7. Back on the API Permissions screen, you will see the Sites.FullControl.All permission is in the list. You will need to select the Grant admin consent for Commvault option.
8. On the Grant admin consent confirmation screen review the consent message and press Yes to proceed.
