Sites.Create.All for WorkPoint Solutions

WorkPoint solutions use SharePoint sites to manage business entities such as projects, cases, contracts, and customers. When a business entity requires a dedicated site, WorkPoint must be able to create the site and complete the required solution-specific configuration.

Traditionally, the WorkPoint provisioning application has used Sites.FullControl.All to create and configure SharePoint sites. This application permission provides tenant-wide access to all SharePoint sites, including sites that are unrelated to WorkPoint.

For new WorkPoint solutions, Sites.Create.All will replace Sites.FullControl.All as the default permission for site creation. Sites.Create.All is a Microsoft Graph application permission. It allows WorkPoint to create new SharePoint sites without receiving access to all existing sites in the tenant.

After creating a site, the WorkPoint provisioning application receives Sites.Selected with Full Control for that specific site. WorkPoint can then configure and manage the new site without receiving tenant-wide access to unrelated SharePoint content.

This permission model reduces the application’s permission footprint and follows the principle of least privilege.

Site provisioning is a central part of many WorkPoint solutions.

For example, when a user creates a new customer, project, or case, WorkPoint often needs to:

• Create a SharePoint site for the business entity.
• Apply the appropriate WorkPoint site structure.
• Create and configure lists and document libraries.
• Add fields and content types.
• Configure metadata and default values.
• Apply the required security configuration.
• Add WorkPoint components and templates.
• Make the configured site available to the relevant users.

The application therefore requires sufficient permissions to create and configure the site.

With Sites.FullControl.All, the application receives broad access to all SharePoint sites in the tenant. With the new permission model, WorkPoint instead receives:

1. Sites.Create.All in Microsoft Graph, allowing it to create new sites.
2. Sites.Selected with Full Control for each site created and managed by WorkPoint.

This means that the application can perform the required provisioning on WorkPoint sites without automatically gaining access to existing sites outside the WorkPoint solution

The principle of least privilege states that an application should only be granted the permissions required to perform its intended tasks.

In a WorkPoint solution, site creation and site management are distinct requirements. Creating a SharePoint site requires the ability to provision a new site collection, while managing a site requires access only to that specific site after it has been created.

The combination of Sites.Create.All and Sites.Selected supports this model by separating these responsibilities:

• Sites.Create.All allows WorkPoint to create new SharePoint sites as part of entity provisioning.
• Sites.Selected provides access to the individual sites that WorkPoint is responsible for managing.
• No tenant-wide SharePoint permissions are required for standard site provisioning and administration.

By limiting application access to WorkPoint-owned sites, organizations can reduce the permissions granted to provisioning applications while maintaining the functionality required to create, configure, and manage WorkPoint solutions.

This approach aligns more closely with modern security recommendations and helps ensure that application permissions remain limited to the resources necessary for the solution to operate.

When WorkPoint provisions a new site, the process is:

1. A user creates a business entity, such as a project or case, in WorkPoint.
2. WorkPoint initiates the site-provisioning process.
3. The WorkPoint backend calls Microsoft Graph using the Sites.Create.All application permission and creates a new site.
4. The provisioning application receives Sites.Selected with Full Control for the new site.
5. WorkPoint configures the site according to the solution configuration.
6. The configured site becomes available for use.

The site-specific permission allows WorkPoint to configure elements that are available through the site itself, including lists, libraries, metadata, content types, security, and other solution components.

The provisioning application does not automatically receive access to unrelated SharePoint sites.

The provisioning flow is illustrated in the following image:

In this model, the provisioning application can complete the WorkPoint configuration without automatically obtaining access to existing sites outside the WorkPoint solution.

Most standard WorkPoint provisioning operations can use Sites.Create.All together with site-specific Sites.Selected permissions. However, some operations are performed through the SharePoint Admin service rather than through the individual site.

These operations cannot currently be completed using only site-specific permissions.

Sites.FullControl.All is still required when WorkPoint needs to:

• Configure tenant-level or admin-level sharing settings for a site.
• Apply or manage a sensitivity label at site level.
• Use functionality that depends on settings available only through the SharePoint Admin service, e.g., Sharing rules.
• Use the Discover functionality.

The additional permission is required only when the corresponding functionality is configured. It is not part of the default permission set for standard site provisioning.

Sensitivity labels applied at the document-library level are not affected in the same way. Additional Microsoft Graph permissions related to information-protection policies may also be required for sensitivity-label scenarios.

You can read more about which permissions are required for various functionalities in this article.

WorkPoint uses both application and delegated permissions. These permission types serve different purposes and have different security implications.

Application permissions

Application permissions allow a WorkPoint application to perform operations without acting as a signed-in user, e.g. to run backend jobs.

Sites.Create.All and the site-specific Sites.Selected permission used for provisioning are application permissions. The application’s access is determined by the permissions granted to the application.

Under the new provisioning model, the application can create sites and manage the specific sites to which it has been granted access. It does not automatically receive access to all existing SharePoint sites.

Delegated permissions

Delegated permissions allow WorkPoint to perform operations on behalf of a signed-in user. The operation is performed within the context of that user and generally remains limited by what the user is permitted to do.

WorkPoint uses delegated permissions for user-initiated operations, including actions and processes executed by a user through WorkPoint.

Some delegated permissions may appear broad because they cover all sites. However, they do not give the user access to SharePoint content that the user could not otherwise access. WorkPoint acts using the signed-in user’s context and permissions.

Customers should therefore evaluate application and delegated permissions separately:

• Application permissions define what the WorkPoint application can access independently.
• Delegated permissions define what WorkPoint can do on behalf of the signed-in user.

For new WorkPoint solutions, Sites.Create.All provides a more restricted alternative to using Sites.FullControl.All for standard site provisioning.

The model separates site creation from subsequent site management:

• Sites.Create.All allows WorkPoint to create a new site.
• Sites.Selected with Full Control allows WorkPoint to configure the specific site.
• WorkPoint does not receive access to unrelated SharePoint sites.
• Sites.FullControl.All remains necessary only for specific functionality that depends on the SharePoint Admin service.

This gives WorkPoint customers a provisioning model that supports automated site creation while establishing clearer and more limited application-permission boundaries.